devise 3.0.4 → 3.1.0.rc2

data/lib/devise/models/token_authenticatable.rb

@@ -79,7 +79,10 @@ module Devise
 
         # Generate a token checking if one does not already exist in the database.
         def authentication_token
-          generate_token(:authentication_token)
+          loop do
+            token = Devise.friendly_token
+            break token unless to_adapter.find_first({ :authentication_token => token })
+          end
         end
 
         Devise::Models.config(self, :token_authentication_key, :expire_auth_token_on_timeout)

data/lib/devise/parameter_sanitizer.rb

@@ -13,14 +13,25 @@ module Devise
       if block_given?
         @blocks[kind] = block
       else
-        block = @blocks[kind]
-        block ? block.call(default_params) : fallback_for(kind)
+        default_for(kind)
+      end
+    end
+
+    def sanitize(kind)
+      if block = @blocks[kind]
+        block.call(default_params)
+      else
+        default_sanitize(kind)
       end
     end
 
     private
 
-    def fallback_for(kind)
+    def default_for(kind)
+      raise ArgumentError, "a block is expected in Devise base sanitizer"
+    end
+
+    def default_sanitize(kind)
       default_params
     end
 
@@ -30,34 +41,53 @@ module Devise
   end
 
   class ParameterSanitizer < BaseSanitizer
-    private
-
-    def fallback_for(kind)
-      if respond_to?(kind, true)
-        send(kind)
-      else
-        raise NotImplementedError, "Devise Parameter Sanitizer doesn't know how to sanitize parameters for #{kind}"
-      end
+    def initialize(*)
+      super
+      @permitted = Hash.new { |h,k| h[k] = attributes_for(k) }
     end
 
-    # These are the params used to sign in a user so we don't need to
-    # mass-assign the password param in order to authenticate. Excluding it
-    # here allows us to construct a new user without sensitive information if
-    # authentication fails.
     def sign_in
-      default_params.permit(*auth_keys + [:password, :remember_me])
+      default_params.permit self.for(:sign_in)
     end
 
     def sign_up
-      default_params.permit(*(auth_keys + [:password, :password_confirmation]))
+      default_params.permit self.for(:sign_up)
     end
 
     def account_update
-      default_params.permit(*(auth_keys + [:password, :password_confirmation, :current_password]))
+      default_params.permit self.for(:account_update)
+    end
+
+    private
+
+    # Change for(kind) to return the values in the @permitted
+    # hash, allowing the developer to customize at runtime.
+    def default_for(kind)
+      @permitted[kind] || raise("No sanitizer provided for #{kind}")
+    end
+
+    def default_sanitize(kind)
+      if respond_to?(kind, true)
+        send(kind)
+      else
+        raise NotImplementedError, "Devise doesn't know how to sanitize parameters for #{kind}"
+      end
+    end
+
+    def attributes_for(kind)
+      case kind
+      when :sign_in
+        auth_keys + [:password, :remember_me]
+      when :sign_up
+        auth_keys + [:password, :password_confirmation]
+      when :account_update
+        auth_keys + [:password, :password_confirmation, :current_password]
+      end
     end
 
     def auth_keys
-      resource_class.authentication_keys.respond_to?(:keys) ? resource_class.authentication_keys.keys : resource_class.authentication_keys
+      @auth_keys ||= @resource_class.authentication_keys.respond_to?(:keys) ?
+                       @resource_class.authentication_keys.keys : @resource_class.authentication_keys
     end
   end
 end

data/lib/devise/rails.rb

@@ -29,21 +29,17 @@ module Devise
       end
     end
 
-    initializer "devise.mongoid_version_warning" do
-      if defined?(Mongoid)
-        require 'mongoid/version'
-        if Mongoid::VERSION.to_f < 2.1
-          puts "\n[DEVISE] Please note that Mongoid versions prior to 2.1 handle dirty model " \
-            "object attributes in such a way that the Devise `validatable` module will not apply " \
-            "its usual uniqueness and format validations for the email field. It is recommended " \
-            "that you upgrade to Mongoid 2.1+ for this and other fixes, but if for some reason you " \
-            "are unable to do so, you should add these validations manually.\n"
+    initializer "devise.secret_key" do
+      Devise.token_generator ||=
+        if secret_key = Devise.secret_key
+          Devise::TokenGenerator.new(
+            Devise::CachingKeyGenerator.new(Devise::KeyGenerator.new(secret_key))
+          )
         end
-      end
     end
 
     initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
-      # We can get rid of this once we support only Rails > 3.2
+      # Deprecate: Remove once we move to Rails 4 only.
       ActionDispatch::Routing::RoutesProxy.class_eval do
         def respond_to?(method, include_private = false)
           super || routes.url_helpers.respond_to?(method)

data/lib/devise/rails/routes.rb

@@ -80,7 +80,8 @@ module ActionDispatch::Routing
     #  * :path_names => configure different path names to overwrite defaults :sign_in, :sign_out, :sign_up,
     #    :password, :confirmation, :unlock.
     #
-    #      devise_for :users, :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification' }
+    #      devise_for :users, :path_names => { :sign_in => 'login', :sign_out => 'logout',
+    #        :password => 'secret', :confirmation => 'verification', registration: 'register }
     #
     #  * :controllers => the controller which should be used. All routes by default points to Devise controllers.
     #    However, if you want them to point to custom controller, you should do:
@@ -191,6 +192,7 @@ module ActionDispatch::Routing
     #
     def devise_for(*resources)
       @devise_finalized = false
+      raise_no_secret_key unless Devise.secret_key
       options = resources.extract_options!
 
       options[:as]          ||= @scope[:as]     if @scope[:as].present?
@@ -222,14 +224,6 @@ module ActionDispatch::Routing
         routes  = mapping.used_routes
 
         devise_scope mapping.name do
-          if block_given?
-            ActiveSupport::Deprecation.warn "Passing a block to devise_for is deprecated. " \
-              "Please remove the block from devise_for (only the block, the call to " \
-              "devise_for must still exist) and call devise_scope :#{mapping.name} do ... end " \
-              "with the block instead", caller
-            yield
-          end
-
           with_devise_exclusive_scope mapping.fullpath, mapping.name, options do
             routes.each { |mod| send("devise_#{mod}", mapping, mapping.controllers) }
           end
@@ -442,6 +436,15 @@ module ActionDispatch::Routing
         end
       end
 
+      def raise_no_secret_key #:nodoc:
+        raise <<-ERROR
+Devise.secret_key was not set. Please add the following to your Devise initializer:
+
+  config.secret_key = '#{SecureRandom.hex(64)}'
+
+ERROR
+      end
+
       def raise_no_devise_method_error!(klass) #:nodoc:
         raise "#{klass} does not respond to 'devise' method. This usually means you haven't " \
           "loaded your ORM file or it's being loaded too late. To fix it, be sure to require 'devise/orm/YOUR_ORM' " \

data/lib/devise/rails/warden_compat.rb

@@ -3,6 +3,7 @@ module Warden::Mixins::Common
     @request ||= ActionDispatch::Request.new(env)
   end
 
+  # Deprecate: Remove this check once we move to Rails 4 only.
   NULL_STORE =
     defined?(ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash) ?
       ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash : nil

data/lib/devise/strategies/authenticatable.rb

@@ -26,20 +26,8 @@ module Devise
       # In case the resource can't be validated, it will fail with the given
       # unauthenticated_message.
       def validate(resource, &block)
-        unless resource
-          ActiveSupport::Deprecation.warn "an empty resource was given to #{self.class.name}#validate. " \
-            "Please ensure the resource is not nil", caller
-        end
-
         result = resource && resource.valid_for_authentication?(&block)
 
-        case result
-        when Symbol, String
-          ActiveSupport::Deprecation.warn "valid_for_authentication? should return a boolean value"
-          fail!(result)
-          return false
-        end
-
         if result
           decorate(resource)
           true

data/lib/devise/strategies/database_authenticatable.rb

@@ -5,16 +5,13 @@ module Devise
     # Default strategy for signing in a user, based on his email and password in the database.
     class DatabaseAuthenticatable < Authenticatable
       def authenticate!
-        resource  = valid_password? && mapping.to.find_for_database_authentication(authentication_hash)
-        encrypted = false
+        resource = valid_password? && mapping.to.find_for_database_authentication(authentication_hash)
+        return fail(:not_found_in_database) unless resource
 
-        if validate(resource){ encrypted = true; resource.valid_password?(password) }
+        if validate(resource){ resource.valid_password?(password) }
           resource.after_database_authentication
           success!(resource)
         end
-
-        mapping.to.new.password = password if !encrypted && Devise.paranoid
-        fail(:not_found_in_database) unless resource
       end
     end
   end

data/lib/devise/token_generator.rb

@@ -0,0 +1,70 @@
+# Deprecate: Copied verbatim from Rails source, remove once we move to Rails 4 only.
+require 'thread_safe'
+require 'openssl'
+require 'securerandom'
+
+module Devise
+  class TokenGenerator
+    def initialize(key_generator, digest="SHA256")
+      @key_generator = key_generator
+      @digest = digest
+    end
+
+    def digest(klass, column, value)
+      value.present? && OpenSSL::HMAC.hexdigest(@digest, key_for(column), value.to_s)
+    end
+
+    def generate(klass, column)
+      key = key_for(column)
+
+      loop do
+        raw = Devise.friendly_token
+        enc = OpenSSL::HMAC.hexdigest(@digest, key, raw)
+        break [raw, enc] unless klass.to_adapter.find_first({ column => enc })
+      end
+    end
+
+    private
+
+    def key_for(column)
+      @key_generator.generate_key("Devise #{column}")
+    end
+  end
+
+  # KeyGenerator is a simple wrapper around OpenSSL's implementation of PBKDF2
+  # It can be used to derive a number of keys for various purposes from a given secret.
+  # This lets Rails applications have a single secure secret, but avoid reusing that
+  # key in multiple incompatible contexts.
+  class KeyGenerator
+    def initialize(secret, options = {})
+      @secret = secret
+      # The default iterations are higher than required for our key derivation uses
+      # on the off chance someone uses this for password storage
+      @iterations = options[:iterations] || 2**16
+    end
+
+    # Returns a derived key suitable for use.  The default key_size is chosen
+    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
+    # i.e. OpenSSL::Digest::SHA1#block_length
+    def generate_key(salt, key_size=64)
+      OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)
+    end
+  end
+
+  # CachingKeyGenerator is a wrapper around KeyGenerator which allows users to avoid
+  # re-executing the key generation process when it's called using the same salt and
+  # key_size
+  class CachingKeyGenerator
+    def initialize(key_generator)
+      @key_generator = key_generator
+      @cache_keys = ThreadSafe::Cache.new
+    end
+
+    # Returns a derived key suitable for use.  The default key_size is chosen
+    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
+    # i.e. OpenSSL::Digest::SHA1#block_length
+    def generate_key(salt, key_size=64)
+      @cache_keys["#{salt}#{key_size}"] ||= @key_generator.generate_key(salt, key_size)
+    end
+  end
+end

data/lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "3.0.4".freeze
+  VERSION = "3.1.0.rc2".freeze
 end

data/lib/generators/templates/devise.rb

@@ -1,13 +1,19 @@
 # Use this hook to configure devise mailer, warden hooks and so forth.
 # Many of these configuration options can be set straight in your model.
 Devise.setup do |config|
+  # The secret key used by Devise. Devise uses this key to generate
+  # random tokens. Changing this key will render invalid all existing
+  # confirmation, reset password and unlock tokens in the database.
+  config.secret_key = '<%= SecureRandom.hex(64) %>'
+
   # ==> Mailer Configuration
   # Configure the e-mail address which will be shown in Devise::Mailer,
-  # note that it will be overwritten if you use your own mailer class with default "from" parameter.
-  config.mailer_sender = "please-change-me-at-config-initializers-devise@example.com"
+  # note that it will be overwritten if you use your own mailer class
+  # with default "from" parameter.
+  config.mailer_sender = 'please-change-me-at-config-initializers-devise@example.com'
 
   # Configure the class responsible to send e-mails.
-  # config.mailer = "Devise::Mailer"
+  # config.mailer = 'Devise::Mailer'
 
   # ==> ORM configuration
   # Load and configure the ORM. Supports :active_record (default) and
@@ -61,8 +67,8 @@ Devise.setup do |config|
   # If http headers should be returned for AJAX requests. True by default.
   # config.http_authenticatable_on_xhr = true
 
-  # The realm used in Http Basic Authentication. "Application" by default.
-  # config.http_authentication_realm = "Application"
+  # The realm used in Http Basic Authentication. 'Application' by default.
+  # config.http_authentication_realm = 'Application'
 
   # It will change confirmation, password recovery and other workflows
   # to behave the same regardless if the e-mail provided was right or wrong.
@@ -217,7 +223,7 @@ Devise.setup do |config|
   # should add them to the navigational formats lists.
   #
   # The "*/*" below is required to match Internet Explorer requests.
-  # config.navigational_formats = ["*/*", :html]
+  # config.navigational_formats = ['*/*', :html]
 
   # The default HTTP method used to sign out a resource. Default is :delete.
   config.sign_out_via = :delete
@@ -241,12 +247,12 @@ Devise.setup do |config|
   # is mountable, there are some extra configurations to be taken into account.
   # The following options are available, assuming the engine is mounted as:
   #
-  #     mount MyEngine, at: "/my_engine"
+  #     mount MyEngine, at: '/my_engine'
   #
   # The router that invoked `devise_for`, in the example above, would be:
   # config.router_name = :my_engine
   #
   # When using omniauth, Devise cannot automatically set Omniauth path,
   # so you need to do it manually. For the users scope, it would be:
-  # config.omniauth_path_prefix = "/my_engine/users/auth"
+  # config.omniauth_path_prefix = '/my_engine/users/auth'
 end

data/test/controllers/passwords_controller_test.rb

@@ -4,16 +4,15 @@ class PasswordsControllerTest < ActionController::TestCase
   tests Devise::PasswordsController
   include Devise::TestHelpers
 
-  def setup
+  setup do
     request.env["devise.mapping"] = Devise.mappings[:user]
-
     @user = create_user.tap(&:confirm!)
-    @user.send_reset_password_instructions
+    @raw  = @user.send_reset_password_instructions
   end
 
   def put_update_with_params
     put :update, "user" => {
-      "reset_password_token" => @user.reset_password_token, "password" => "123456", "password_confirmation" => "123456"
+      "reset_password_token" => @raw, "password" => "123456", "password_confirmation" => "123456"
     }
   end
 

data/test/failure_app_test.rb

@@ -215,7 +215,7 @@ class FailureTest < ActiveSupport::TestCase
       }
       call_failure(env)
       assert @response.third.body.include?('<h2>Sign in</h2>')
-      assert @response.third.body.include?('Your account was not activated yet.')
+      assert @response.third.body.include?('Your account is not activated yet.')
     end
   end
 end

data/test/integration/confirmable_test.rb

@@ -28,9 +28,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
 
   test 'user should receive a confirmation from a custom mailer' do
     User.any_instance.stubs(:devise_mailer).returns(Users::Mailer)
-
     resend_confirmation
-
     assert_equal ['custom@example.com'], ActionMailer::Base.deliveries.first.from
   end
 
@@ -40,21 +38,11 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
     assert_contain /Confirmation token(.*)invalid/
   end
 
-  test 'user with valid confirmation token should be able to confirm an account' do
-    user = create_user(:confirm => false)
-    assert_not user.confirmed?
-    visit_user_confirmation_with_token(user.confirmation_token)
-
-    assert_contain 'Your account was successfully confirmed.'
-    assert_current_url '/'
-    assert user.reload.confirmed?
-  end
-
   test 'user with valid confirmation token should not be able to confirm an account after the token has expired' do
     swap Devise, :confirm_within => 3.days do
       user = create_user(:confirm => false, :confirmation_sent_at => 4.days.ago)
       assert_not user.confirmed?
-      visit_user_confirmation_with_token(user.confirmation_token)
+      visit_user_confirmation_with_token(user.raw_confirmation_token)
 
       assert_have_selector '#error_explanation'
       assert_contain /needs to be confirmed within 3 days/
@@ -66,10 +54,10 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
     swap Devise, :confirm_within => 3.days do
       user = create_user(:confirm => false, :confirmation_sent_at => 2.days.ago)
       assert_not user.confirmed?
-      visit_user_confirmation_with_token(user.confirmation_token)
+      visit_user_confirmation_with_token(user.raw_confirmation_token)
 
       assert_contain 'Your account was successfully confirmed.'
-      assert_current_url '/'
+      assert_current_url '/users/sign_in'
       assert user.reload.confirmed?
     end
   end
@@ -78,7 +66,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
     Devise::ConfirmationsController.any_instance.stubs(:after_confirmation_path_for).returns("/?custom=1")
 
     user = create_user(:confirm => false)
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
 
     assert_current_url "/?custom=1"
   end
@@ -87,7 +75,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
     user = create_user(:confirm => false)
     user.confirmed_at = Time.now
     user.save
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
 
     assert_have_selector '#error_explanation'
     assert_contain 'already confirmed'
@@ -98,7 +86,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
     user.confirmed_at = Time.now
     user.save
 
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
     assert_contain 'already confirmed'
 
     fill_in 'email', :with => user.email
@@ -106,21 +94,6 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
     assert_contain 'already confirmed'
   end
 
-  test 'sign in user automatically after confirming its email' do
-    user = create_user(:confirm => false)
-    visit_user_confirmation_with_token(user.confirmation_token)
-
-    assert warden.authenticated?(:user)
-  end
-
-  test 'increases sign count when signed in through confirmation' do
-    user = create_user(:confirm => false)
-    visit_user_confirmation_with_token(user.confirmation_token)
-
-    user.reload
-    assert_equal 1, user.sign_in_count
-  end
-
   test 'not confirmed user with setup to block without confirmation should not be able to sign in' do
     swap Devise, :allow_unconfirmed_access_for => 0.days do
       sign_in_as_user(:confirm => false)
@@ -175,7 +148,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
 
   test 'confirm account with valid confirmation token in XML format should return valid response' do
     user = create_user(:confirm => false)
-    get user_confirmation_path(:confirmation_token => user.confirmation_token, :format => 'xml')
+    get user_confirmation_path(:confirmation_token => user.raw_confirmation_token, :format => 'xml')
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
   end
@@ -256,10 +229,10 @@ class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
     admin = create_admin
     admin.update_attributes(:email => 'new_test@example.com')
     assert_equal 'new_test@example.com', admin.unconfirmed_email
-    visit_admin_confirmation_with_token(admin.confirmation_token)
+    visit_admin_confirmation_with_token(admin.raw_confirmation_token)
 
     assert_contain 'Your account was successfully confirmed.'
-    assert_current_url '/admin_area/home'
+    assert_current_url '/admin_area/sign_in'
     assert admin.reload.confirmed?
     assert_not admin.reload.pending_reconfirmation?
   end
@@ -269,17 +242,19 @@ class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
     admin.update_attributes(:email => 'first_test@example.com')
     assert_equal 'first_test@example.com', admin.unconfirmed_email
 
-    confirmation_token = admin.confirmation_token
+    raw_confirmation_token = admin.raw_confirmation_token
+    admin = Admin.find(admin.id)
+
     admin.update_attributes(:email => 'second_test@example.com')
     assert_equal 'second_test@example.com', admin.unconfirmed_email
 
-    visit_admin_confirmation_with_token(confirmation_token)
+    visit_admin_confirmation_with_token(raw_confirmation_token)
     assert_have_selector '#error_explanation'
     assert_contain(/Confirmation token(.*)invalid/)
 
-    visit_admin_confirmation_with_token(admin.confirmation_token)
+    visit_admin_confirmation_with_token(admin.raw_confirmation_token)
     assert_contain 'Your account was successfully confirmed.'
-    assert_current_url '/admin_area/home'
+    assert_current_url '/admin_area/sign_in'
     assert admin.reload.confirmed?
     assert_not admin.reload.pending_reconfirmation?
   end
@@ -291,7 +266,7 @@ class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
 
     create_second_admin(:email => "new_admin_test@example.com")
 
-    visit_admin_confirmation_with_token(admin.confirmation_token)
+    visit_admin_confirmation_with_token(admin.raw_confirmation_token)
     assert_have_selector '#error_explanation'
     assert_contain(/Email.*already.*taken/)
     assert admin.reload.pending_reconfirmation?