devise 4.9.4 → 5.0.0.rc
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +44 -392
- data/MIT-LICENSE +2 -2
- data/README.md +51 -47
- data/app/controllers/devise/confirmations_controller.rb +1 -1
- data/app/controllers/devise/sessions_controller.rb +4 -4
- data/app/controllers/devise/unlocks_controller.rb +1 -1
- data/app/helpers/devise_helper.rb +1 -26
- data/app/views/devise/confirmations/new.html.erb +2 -2
- data/app/views/devise/passwords/edit.html.erb +5 -5
- data/app/views/devise/passwords/new.html.erb +3 -3
- data/app/views/devise/registrations/edit.html.erb +9 -10
- data/app/views/devise/registrations/new.html.erb +8 -8
- data/app/views/devise/sessions/new.html.erb +6 -6
- data/app/views/devise/shared/_error_messages.html.erb +1 -1
- data/app/views/devise/shared/_links.html.erb +6 -6
- data/app/views/devise/unlocks/new.html.erb +2 -2
- data/lib/devise/controllers/sign_in_out.rb +1 -16
- data/lib/devise/failure_app.rb +12 -24
- data/lib/devise/hooks/activatable.rb +1 -1
- data/lib/devise/hooks/timeoutable.rb +1 -1
- data/lib/devise/mailers/helpers.rb +9 -15
- data/lib/devise/mapping.rb +1 -1
- data/lib/devise/models/authenticatable.rb +2 -14
- data/lib/devise/models/database_authenticatable.rb +6 -24
- data/lib/devise/models/lockable.rb +1 -1
- data/lib/devise/models/validatable.rb +3 -1
- data/lib/devise/orm.rb +10 -12
- data/lib/devise/parameter_sanitizer.rb +1 -2
- data/lib/devise/rails/routes.rb +3 -4
- data/lib/devise/rails.rb +7 -1
- data/lib/devise/test/controller_helpers.rb +1 -12
- data/lib/devise/version.rb +1 -1
- data/lib/devise.rb +12 -20
- data/lib/generators/active_record/devise_generator.rb +5 -11
- data/lib/generators/devise/controllers_generator.rb +1 -1
- data/lib/generators/templates/devise.rb +7 -4
- metadata +7 -16
- data/lib/devise/rails/deprecated_constant_accessor.rb +0 -39
- data/lib/devise/secret_key_finder.rb +0 -27
- data/lib/devise/test_helpers.rb +0 -15
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: c614ff852c7ef5f4f8a19ce048a1ad9027597703b530b9fdb03b3d5ad097bdd3
|
|
4
|
+
data.tar.gz: a9c46106a887c06284704f0597691da982be281443a831491a827613cff2e84c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 8f1bea0a5222a43eff7ff9757d7269818002bd8dfc8b2e9128a257360f0b1fbbb94787694b0c4d9a37706a6ed5209534c8e8fb4566eb44ccb661c2635f8b1fb7
|
|
7
|
+
data.tar.gz: 97218c88847c8d46a8009cd863d31fe38c5e7d1f94094b9d30b48bf2db2f67e289121d6b83a1ae2f80ab9e1c784067c715b335561c5118c627f921d1f824cf79
|
data/CHANGELOG.md
CHANGED
|
@@ -1,410 +1,62 @@
|
|
|
1
|
-
###
|
|
1
|
+
### 5.0.0.rc - 2025-12-31
|
|
2
2
|
|
|
3
|
-
*
|
|
4
|
-
*
|
|
5
|
-
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
* Add `Devise.deprecator` to integrate with new application deprecators in Rails 7.1. (@soartec-lab, @etiennebarrie)
|
|
14
|
-
|
|
15
|
-
### 4.9.2 - 2023-04-03
|
|
16
|
-
|
|
17
|
-
* deprecations
|
|
18
|
-
* Bring back `Devise.activerecord51?` and deprecate it, in order to avoid breakage with some libraries that apparently relied on it.
|
|
19
|
-
|
|
20
|
-
### 4.9.1 - 2023-03-31
|
|
21
|
-
|
|
22
|
-
* enhancements
|
|
23
|
-
* Allow resource class scopes to override the global configuration for `sign_in_after_reset_password` behaviour. [#5429](https://github.com/heartcombo/devise/pull/5429) [@mattr](https://github.com/mattr)
|
|
24
|
-
* Refactor conditional dirty tracking logic to a centralized module to simplify usage throughout the codebase. [#5575](https://github.com/heartcombo/devise/pull/5575)
|
|
25
|
-
* Improve support for Devise in apps with Active Record and Mongoid ORMs loaded, so it does not incorrectly uses new Active Record dirty tracking APIs with a Mongoid Devise model. [#5576](https://github.com/heartcombo/devise/pull/5576)
|
|
26
|
-
|
|
27
|
-
* bug fixes
|
|
28
|
-
* Failure app will respond with configured `redirect_status` instead of `error_status` if the recall app returns a redirect status (300..399) [#5573](https://github.com/heartcombo/devise/pull/5573)
|
|
29
|
-
* Fix frozen string exception in validatable. [#5563](https://github.com/heartcombo/devise/pull/5563) [#5465](https://github.com/heartcombo/devise/pull/5465) [@mameier](https://github.com/mameier)
|
|
30
|
-
|
|
31
|
-
### 4.9.0 - 2023-02-17
|
|
32
|
-
|
|
33
|
-
* enhancements
|
|
34
|
-
* Add support for Ruby 3.1/3.2.
|
|
35
|
-
* Add support for Hotwire + Turbo, default in Rails 7+.
|
|
36
|
-
* Devise uses the latest `responders` version (v3.1.0 or higher), which allows configuring the status used for validation error responses (`error_status`) and for redirects after POST/PUT/PATCH/DELETE requests (`redirect_status`). For backwards compatibility, Devise keeps `error_status` as `:ok` which returns a `200 OK` response, and `redirect_status` to `:found` which returns a `302 Found` response, but you can configure it to return `422 Unprocessable Entity` and `303 See Other` respectively, to match the behavior expected by Hotwire/Turbo:
|
|
37
|
-
|
|
38
|
-
```ruby
|
|
39
|
-
# config/initializers/devise.rb
|
|
40
|
-
Devise.setup do |config|
|
|
41
|
-
# ...
|
|
42
|
-
config.responder.error_status = :unprocessable_entity
|
|
43
|
-
config.responder.redirect_status = :see_other
|
|
44
|
-
# ...
|
|
45
|
-
end
|
|
46
|
-
```
|
|
47
|
-
|
|
48
|
-
These configs are already generated by default with new apps, and existing apps may opt-in as described above. Trying to set these with an older version of `responders` will issue a warning and have no effect, so please upgrade the `responders` version if you're upgrading Devise for this integration. Note that these defaults may change in future versions of Devise, to better match the Rails + Hotwire/Turbo defaults across the board.
|
|
49
|
-
* If you have a custom responder set on your application and expect it to affect Devise as well, you may need to override the Devise responder entirely with `config.responder = MyApplicationResponder`, so that it uses your custom one. The main reason Devise uses a custom responder is to be able to configure the statuses as described above, but you can also change that config on your own responder if you want. Check the `responders` readme for more info on that.
|
|
50
|
-
* If you have created a custom responder and/or failure app just to customize responses for better Hotwire/Turbo integration, they should no longer be necessary.
|
|
51
|
-
* `:turbo_stream` is now treated as a navigational format, so it works like HTML navigation when using Turbo. Note: if you relied on `:turbo_stream` to be treated as a non-navigational format before, you can reconfigure your `navigational_formats` in the Devise initializer file to exclude it.
|
|
52
|
-
* OmniAuth "Sign in with" links were changed to buttons that generate HTML forms with method=POST, instead of using link + method=POST that required rails-ujs to work. Since rails-ujs is no longer the default for new Rails apps, this allows the OmniAuth buttons to work in any scenario, with or without rails-ujs and/or Turbo. This only affects apps that are using the default `devise/shared/_links.html.erb` partial from Devise with OmniAuth enabled.
|
|
53
|
-
* The "Cancel my account" button was changed to include the `data-turbo-confirm` option, so that it works with both rails-ujs and Turbo by default.
|
|
54
|
-
* Devise does not provide "sign out" links/buttons in its shared views, but if you're using `sign_out_via` with `:delete` (the default), and are using links with `method: :delete`, those need to be updated with `data: { turbo_method: :delete }` instead for Turbo.
|
|
55
|
-
* Check [this upgrade guide](https://github.com/heartcombo/devise/wiki/How-To:-Upgrade-to-Devise-4.9.0-[Hotwire-Turbo-integration]) for more detailed information.
|
|
56
|
-
|
|
57
|
-
### 4.8.1 - 2021-12-16
|
|
58
|
-
|
|
59
|
-
* enhancements
|
|
60
|
-
* Add support for Rails 7.0. Please note that Turbo integration is not fully supported by Devise yet.
|
|
61
|
-
|
|
62
|
-
### 4.8.0 - 2021-04-29
|
|
63
|
-
|
|
64
|
-
* enhancements
|
|
65
|
-
* Devise now enables the upgrade of OmniAuth 2+. Previously Devise would raise an error if you'd try to upgrade. Please note that OmniAuth 2 is considered a security upgrade and recommended to everyone. You can read more about the details (and possible necessary changes to your app as part of the upgrade) in [their release notes](https://github.com/omniauth/omniauth/releases/tag/v2.0.0). [Devise's OmniAuth Overview wiki](https://github.com/heartcombo/devise/wiki/OmniAuth:-Overview) was also updated to cover OmniAuth 2.0 requirements.
|
|
66
|
-
- Note that the upgrade required Devise shared links that initiate the OmniAuth flow to be changed to `method: :post`, which is now a requirement for OmniAuth, part of the security improvement. If you have copied and customized the Devise shared links partial to your app, or if you have other links in your app that initiate the OmniAuth flow, they will have to be updated to use `method: :post`, or changed to use buttons (e.g. `button_to`) to work with OmniAuth 2. (if you're using links with `method: :post`, make sure your app has `rails-ujs` or `jquery-ujs` included in order for these links to work properly.)
|
|
67
|
-
- As part of the OmniAuth 2.0 upgrade you might also need to add the [`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection) gem to your app if you don't have it already. (and you don't want to roll your own code to verify requests.) Check the OmniAuth v2 release notes for more info.
|
|
68
|
-
* Introduce `Lockable#reset_failed_attempts!` model method to reset failed attempts counter to 0 after the user signs in.
|
|
69
|
-
- This logic existed inside the lockable warden hook and is triggered automatically after the user signs in. The new model method is an extraction to allow you to override it in the application to implement things like switching to a write database if you're using the new multi-DB infrastructure from Rails for example, similar to how it's already possible with `Trackable#update_tracked_fields!`.
|
|
70
|
-
* Add support for Ruby 3.
|
|
71
|
-
* Add support for Rails 6.1.
|
|
72
|
-
* Move CI to GitHub Actions.
|
|
73
|
-
|
|
74
|
-
* deprecations
|
|
75
|
-
* `Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION` is deprecated in favor of `Devise::Models::Authenticatable::UNSAFE_ATTRIBUTES_FOR_SERIALIZATION` (@hanachin)
|
|
76
|
-
|
|
77
|
-
### 4.7.3 - 2020-09-20
|
|
78
|
-
|
|
79
|
-
* bug fixes
|
|
80
|
-
* Do not modify `:except` option given to `#serializable_hash`. (by @dpep)
|
|
81
|
-
* Fix thor deprecation when running the devise generator. (by @deivid-rodriguez)
|
|
82
|
-
* Fix hanging tests for streaming controllers using Devise. (by @afn)
|
|
3
|
+
* breaking changes
|
|
4
|
+
* Drop support to Ruby < 2.7
|
|
5
|
+
* Drop support to Rails < 7.0
|
|
6
|
+
* Remove deprecated `:bypass` option from `sign_in` helper, use `bypass_sign_in` instead. [#5803](https://github.com/heartcombo/devise/pull/5803)
|
|
7
|
+
* Remove deprecated `devise_error_messages!` helper, use `render "devise/shared/error_messages", resource: resource` instead. [#5803](https://github.com/heartcombo/devise/pull/5803)
|
|
8
|
+
* Remove deprecated `scope` second argument from `sign_in(resource, :admin)` controller test helper, use `sign_in(resource, scope: :admin)` instead. [#5803](https://github.com/heartcombo/devise/pull/5803)
|
|
9
|
+
* Remove deprecated `Devise::TestHelpers`, use `Devise::Test::ControllerHelpers` instead. [#5803](https://github.com/heartcombo/devise/pull/5803)
|
|
10
|
+
* Remove deprecated `Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION` [#5598](https://github.com/heartcombo/devise/pull/5598)
|
|
11
|
+
* Remove deprecated `Devise.activerecord51?` method.
|
|
12
|
+
* Remove `SecretKeyFinder` and use `app.secret_key_base` as the default secret key for `Devise.secret_key` if a custom `Devise.secret_key` is not provided.
|
|
83
13
|
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
* enhancements
|
|
87
|
-
* Increase default stretches to 12 (by @sergey-alekseev)
|
|
88
|
-
* Ruby 2.7 support (kwarg warnings removed)
|
|
89
|
-
|
|
90
|
-
* bug fixes
|
|
91
|
-
* Generate scoped views with proper scoped errors partial (by @shobhitic)
|
|
92
|
-
* Allow to set scoped `already_authenticated` error messages (by @gurgelrenan)
|
|
93
|
-
|
|
94
|
-
### 4.7.1 - 2019-09-06
|
|
95
|
-
|
|
96
|
-
* bug fixes
|
|
97
|
-
* Fix an edge case where records with a blank `confirmation_token` could be confirmed (by @tegon)
|
|
98
|
-
* Fix typo inside `update_needs_confirmation` i18n key (by @lslm)
|
|
99
|
-
|
|
100
|
-
### 4.7.0 - 2019-08-19
|
|
101
|
-
|
|
102
|
-
* enhancements
|
|
103
|
-
* Support Rails 6.0
|
|
104
|
-
* Update CI to rails 6.0.0.beta3 (by @tunnes)
|
|
105
|
-
* refactor method name to be more consistent (by @saiqulhaq)
|
|
106
|
-
* Fix rails 6.0.rc1 email uniqueness validation deprecation warning (by @Vasfed)
|
|
107
|
-
|
|
108
|
-
* bug fixes
|
|
109
|
-
* Add `autocomplete="new-password"` to `password_confirmation` fields (by @ferrl)
|
|
110
|
-
* Fix rails_51_and_up? method for Rails 6.rc1 (by @igorkasyanchuk)
|
|
111
|
-
|
|
112
|
-
### 4.6.2 - 2019-03-26
|
|
113
|
-
|
|
114
|
-
* bug fixes
|
|
115
|
-
* Revert "Set `encrypted_password` to `nil` when `password` is set to `nil`" since it broke backward compatibility with existing applications. See more on https://github.com/heartcombo/devise/issues/5033#issuecomment-476386275 (by @mracos)
|
|
116
|
-
|
|
117
|
-
### 4.6.1 - 2019-02-11
|
|
118
|
-
|
|
119
|
-
* bug fixes
|
|
120
|
-
* Check if `root_path` is defined with `#respond_to?` instead of `#present` (by @tegon)
|
|
121
|
-
|
|
122
|
-
### 4.6.0 - 2019-02-07
|
|
123
|
-
|
|
124
|
-
* enhancements
|
|
125
|
-
* Allow to skip email and password change notifications (by @iorme1)
|
|
126
|
-
* Include the use of `nil` for `allow_unconfirmed_access_for` in the docs (by @joaumg)
|
|
127
|
-
* Ignore useless files into the `.gem` file (by @huacnlee)
|
|
128
|
-
* Explain the code that prevents enumeration attacks inside `Devise::Strategies::DatabaseAuthenticatable` (by @tegon)
|
|
129
|
-
* Refactor the `devise_error_messages!` helper to render a partial (by @prograhamer)
|
|
130
|
-
* Add an option (`Devise.sign_in_after_change_password`) to not automatically sign in a user after changing a password (by @knjko)
|
|
131
|
-
|
|
132
|
-
* bug fixes
|
|
133
|
-
* Fix missing comma in Simple Form generator (by @colinross)
|
|
134
|
-
* Fix error with migration generator in Rails 6 (by @oystersauce8)
|
|
135
|
-
* Set `encrypted_password` to `nil` when `password` is set to `nil` (by @sivagollapalli)
|
|
136
|
-
* Consider whether the request supports flash messages inside `Devise::Controllers::Helpers#is_flashing_format?` (by @colinross)
|
|
137
|
-
* Fix typo inside `Devise::Generators::ControllersGenerator` (by @kopylovvlad)
|
|
138
|
-
* Sanitize parameters inside `Devise::Models::Authenticatable#find_or_initialize_with_errors` (by @rlue)
|
|
139
|
-
* `#after_database_authentication` callback was not called after authentication on password reset (by @kanmaniselvan)
|
|
140
|
-
* Fix corner case when `#confirmation_period_valid?` was called at the same second as `confirmation_sent_at` was set. Mostly true for date types that only have second precisions. (by @stanhu)
|
|
141
|
-
* Fix unclosed `li` tag in `error_messages` partial (by @mracos)
|
|
142
|
-
* Fix Routes issue when devise engine is mounted in another engine on Rails versions lower than 5.1 (by @a-barbieri)
|
|
143
|
-
* Make `#increment_failed_attempts` concurrency safe (by @tegon)
|
|
144
|
-
* Apply Test Helper fix to Rails 6.0 as well as 5.x (by @matthewrudy)
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
* deprecations
|
|
148
|
-
* The second argument of `DatabaseAuthenticatable`'s `#update_with_password` and `#update_without_password` is deprecated and will be removed in the next major version. It was added to support a feature deprecated in Rails 4, so you can safely remove it from your code. (by @ihatov08)
|
|
149
|
-
* The `DeviseHelper.devise_error_messages!` is deprecated and will be removed in the next major version. Use the `devise/shared/error_messages` partial instead. (by @mracos)
|
|
150
|
-
|
|
151
|
-
### 4.5.0 - 2018-08-15
|
|
152
|
-
|
|
153
|
-
* enhancements
|
|
154
|
-
* Use `before_action` instead of `before_filter` (by @edenthecat)
|
|
155
|
-
* Allow people to extend devise failure app, through invoking `ActiveSupport.run_load_hooks` once `Devise::FailureApp` is loaded (by @wnm)
|
|
156
|
-
* Use `update` instead of `update_attributes` (by @koic)
|
|
157
|
-
* Split IP resolution from `update_tracked_fields` (by @mckramer)
|
|
158
|
-
* upgrade dependencies for rails and responders (by @lancecarlson)
|
|
159
|
-
* Add `autocomplete="new-password"` to new password fields (by @gssbzn)
|
|
160
|
-
* Add `autocomplete="current-password"` to current password fields (by @gssbzn)
|
|
161
|
-
* Remove redundant `self` from `database_authenticatable` module (by @abhishekkanojia)
|
|
162
|
-
* Update `simple_form` templates with changes from https://github.com/heartcombo/devise/commit/16b3d6d67c7e017d461ea17ed29ea9738dc77e83 and https://github.com/heartcombo/devise/commit/6260c29a867b9a656f1e1557abe347a523178fab (by @gssbzn)
|
|
163
|
-
* Remove `:trackable` from the default modules in the generators, to be more GDPR-friendly (by @fakenine)
|
|
14
|
+
This is potentially a breaking change because Devise previously used the following order to find a secret key:
|
|
164
15
|
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
* Fix error when params is not a hash inside `Devise::ParameterSanitizer` (by @b0nn1e)
|
|
168
|
-
* Look for `secret_key_base` inside `Rails.application` (by @gencer)
|
|
169
|
-
* Ensure `Devise::ParameterFilter` does not add missing keys when called with a hash that has a `default` / `default_proc`
|
|
170
|
-
configured (by @joshpencheon)
|
|
171
|
-
* Adds `is_navigational_format?` check to `after_sign_up_path_for` to keep consistency (by @iorme1)
|
|
172
|
-
|
|
173
|
-
### 4.4.3 - 2018-03-17
|
|
174
|
-
|
|
175
|
-
* bug fixes
|
|
176
|
-
* Fix undefined method `rails5?` for Devise::Test:Module (by @tegon)
|
|
177
|
-
* Fix: secret key was being required to be set inside credentials on Rails 5.2 (by @tegon)
|
|
178
|
-
|
|
179
|
-
### 4.4.2 - 2018-03-15
|
|
180
|
-
|
|
181
|
-
* enhancements
|
|
182
|
-
* Support for :credentials on Rails v5.2.x. (by @gencer)
|
|
183
|
-
* Improve documentation about the test suite. (by @tegon)
|
|
184
|
-
* Test with Rails 5.2.rc1 on Travis. (by @jcoyne)
|
|
185
|
-
* Allow test with Rails 6. (by @Fudoshiki)
|
|
186
|
-
* Creating a new section for controller configuration on `devise.rb` template (by @Danilo-Araujo-Silva)
|
|
187
|
-
|
|
188
|
-
* bug fixes
|
|
189
|
-
* Preserve content_type for unauthenticated tests (by @gmcnaughton)
|
|
190
|
-
* Check if the resource is persisted in `update_tracked_fields!` instead of performing validations (by @tegon)
|
|
191
|
-
* Revert "Replace log_process_action to append_info_to_payload" (by @tegon)
|
|
192
|
-
|
|
193
|
-
### 4.4.1 - 2018-01-23
|
|
194
|
-
|
|
195
|
-
* bug fixes
|
|
196
|
-
* Ensure Gemspec is loaded as utf-8. (by @segiddins)
|
|
197
|
-
* Fix `ActiveRecord` check on `Confirmable`. (by @tegon)
|
|
198
|
-
* Fix `signed_in?` docs without running auth hooks. by (@machty)
|
|
199
|
-
|
|
200
|
-
### 4.4.0 - 2017-12-29
|
|
201
|
-
|
|
202
|
-
* enhancements
|
|
203
|
-
* Add `frozen_string_literal` pragma comment to all Ruby files. (by @pat)
|
|
204
|
-
* Use `set_flash_method!` instead of `set_flash_method` in `Devise::OmniauthCallbacksController#failure`. (by @saichander17)
|
|
205
|
-
* Clarify how `store_location_for` modifies URIs. (by @olivierlacan)
|
|
206
|
-
* Move `failed_attempts` increment into its own function. by (@mobilutz)
|
|
207
|
-
* Add `autocomplete="email"` to email fields. by (@MikeRogers0)
|
|
208
|
-
* Add the ability to change the default migrations path introduced in Rails 5.0.3. (by @alexhifer)
|
|
209
|
-
* Delete unnecessary condition for helper method. (by @davydovanton)
|
|
210
|
-
* Support `id: :uuid` option for migrations. (by @filip373)
|
|
211
|
-
|
|
212
|
-
* bug fixes
|
|
213
|
-
* Fix syntax for MRI 2.5.0. (by @pat)
|
|
214
|
-
* Validations were being ignored on singup in the `Trackable#update_tracked_fields!` method. (by @AshleyFoster)
|
|
215
|
-
* Do not modify options for `#serializable_hash`. (by @guigs)
|
|
216
|
-
* Email confirmations were being sent on sign in/sign out for application using `mongoid` and `mongoid-paperclip` gems. This is because previously we were checking if a model is from Active Record by checking if the method `after_commit` was defined - since `mongoid` doesn' have one - but `mongoid-paperclip` gem does define one, which cause this issue. (by @fjg)
|
|
217
|
-
|
|
218
|
-
### 4.3.0 - 2017-05-14
|
|
219
|
-
|
|
220
|
-
* Enhancements
|
|
221
|
-
* Dependency support added for Rails 5.1.x.
|
|
222
|
-
|
|
223
|
-
### 4.2.1 - 2017-03-15
|
|
224
|
-
|
|
225
|
-
* removals
|
|
226
|
-
* `Devise::Mailer#scope_name` and `Devise::Mailer#resource` are now protected
|
|
227
|
-
methods instead of public.
|
|
228
|
-
* bug fixes
|
|
229
|
-
* Attempt to reset password without the password field in the request now results in a `:blank` validation error.
|
|
230
|
-
Before this change, Devise would accept the reset password request and log the user in, without validating/changing
|
|
231
|
-
the password. (by @victor-am)
|
|
232
|
-
* Confirmation links now expire based on UTC time, working properly when using different timezones. (by @jjuliano)
|
|
233
|
-
* enhancements
|
|
234
|
-
* Notify the original email when it is changed with a new `Devise.send_email_changed_notification` setting.
|
|
235
|
-
When using `reconfirmable`, the notification will be sent right away instead of when the unconfirmed email is confirmed.
|
|
236
|
-
(original change by @ethirajsrinivasan)
|
|
237
|
-
|
|
238
|
-
### 4.2.0 - 2016-07-01
|
|
239
|
-
|
|
240
|
-
* removals
|
|
241
|
-
* Remove the deprecated `Devise::ParameterSanitizer` API from Devise 3.
|
|
242
|
-
Please use the `#permit` and `#sanitize` methods over `#for`.
|
|
243
|
-
* Remove the deprecated OmniAuth URL helpers. Use the fully qualified helpers
|
|
244
|
-
(`user_facebook_omniauth_authorize_path`) over the scope based helpers
|
|
245
|
-
( `user_omniauth_authorize_path(:facebook)`).
|
|
246
|
-
* Remove the `Devise.bcrypt` method, use `Devise::Encryptor.digest` instead.
|
|
247
|
-
* Remove the `Devise::Models::Confirmable#confirm!` method, use `confirm` instead.
|
|
248
|
-
* Remove the `Devise::Models::Recoverable#reset_password!` method, use `reset_password` instead.
|
|
249
|
-
* Remove the `Devise::Models::Recoverable#after_password_reset` method.
|
|
250
|
-
* bug fixes
|
|
251
|
-
* Fix an `ActionDispatch::IllegalStateError` when testing controllers with Rails 5 rc 2(by @hamadata).
|
|
252
|
-
* Use `ActiveSupport.on_load` hooks to include Devise on `ActiveRecord` and `Mongoid`,
|
|
253
|
-
avoiding autoloading these constants too soon (by @lucasmazza, @rafaelfranca).
|
|
254
|
-
* enhancements
|
|
255
|
-
* Display the minimum password length on `registrations/edit` view (by @Yanchek99).
|
|
256
|
-
* You can disable Devise's routes reloading on boot by through the `reload_routes = false` config.
|
|
257
|
-
This can reduce the time taken to boot the application but it might trigger
|
|
258
|
-
some errors if you application (mostly your controllers) requires that
|
|
259
|
-
Devise mappings be loaded during boot time (by @sidonath).
|
|
260
|
-
* Added `Devise::Test::IntegrationHelpers` to bypass the sign in process using
|
|
261
|
-
Warden test API (by @lucasmazza).
|
|
262
|
-
* Define `inspect` in `Devise::Models::Authenticatable` to help ensure password hashes
|
|
263
|
-
aren't included in exceptions or otherwise accidentally serialized (by @tkrajcar).
|
|
264
|
-
* Add missing support of `Rails.application.config.action_controller.relative_url_root` (by @kosdiamantis).
|
|
265
|
-
* deprecations
|
|
266
|
-
* `Devise::TestHelpers` is deprecated in favor of `Devise::Test::ControllerHelpers`
|
|
267
|
-
(by @lucasmazza).
|
|
268
|
-
* The `sign_in` test helper has changed to use keyword arguments when passing
|
|
269
|
-
a scope. `sign_in :admin, users(:alice)` should be rewritten as
|
|
270
|
-
`sign_in users(:alice), scope: :admin` (by @lucasmazza).
|
|
271
|
-
* The option `bypass` of `Devise::Controllers::SignInOut#sign_in` method is
|
|
272
|
-
deprecated in favor of `Devise::Controllers::SignInOut#bypass_sign_in`
|
|
273
|
-
method (by @ulissesalmeida).
|
|
274
|
-
|
|
275
|
-
### 4.1.1 - 2016-05-15
|
|
276
|
-
|
|
277
|
-
* bug fixes
|
|
278
|
-
* Fix overwriting the remember_token when a valid one already exists (by @ralinchimev).
|
|
279
|
-
|
|
280
|
-
### 4.1.0
|
|
281
|
-
|
|
282
|
-
* bug fixes
|
|
283
|
-
* Fix race condition of sending the confirmation instructions e-mail using background jobs.
|
|
284
|
-
Using the previous `after_create` callback, the e-mail can be sent before
|
|
285
|
-
the record be committed on database, generating a `ActiveRecord::NotFound` error.
|
|
286
|
-
Now the confirmation e-mail will be only sent after the database commit,
|
|
287
|
-
using the `after_commit` callback.
|
|
288
|
-
It may break your test suite on Rails 4 if you are testing the sent e-mails
|
|
289
|
-
or enqueued jobs using transactional fixtures enabled or `DatabaseCleaner` with `transaction` strategy.
|
|
290
|
-
You can easily fix your test suite using the gem
|
|
291
|
-
[test_after_commit](https://github.com/grosser/test_after_commit). For example, put in your Gemfile:
|
|
292
|
-
|
|
293
|
-
```ruby
|
|
294
|
-
gem 'test_after_commit', :group => :test
|
|
16
|
+
```
|
|
17
|
+
app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base
|
|
295
18
|
```
|
|
296
19
|
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
*
|
|
300
|
-
|
|
301
|
-
*
|
|
302
|
-
* Humanize authentication keys in failure flash message (by @byzg)
|
|
303
|
-
When you are configuring the translations of `devise.failure.invalid`, the
|
|
304
|
-
`authentication_keys` is translated now.
|
|
305
|
-
* deprecations
|
|
306
|
-
* Remove code supporting old session serialization format (by @fphilipe).
|
|
307
|
-
* Now the `email_regexp` default uses a more permissive regex:
|
|
308
|
-
`/\A[^@\s]+@[^@\s]+\z/` (by @kimgb)
|
|
309
|
-
* Now the `strip_whitespace_keys` default is `[:email]` (by @ulissesalmeida)
|
|
310
|
-
* Now the `reconfirmable` default is `true` (by @ulissesalmeida)
|
|
311
|
-
* Now the `skip_session_storage` default is `[:http_auth]` (by @ulissesalmeida)
|
|
312
|
-
* Now the `sign_out_via` default is `:delete` (by @ulissesalmeida)
|
|
313
|
-
* improvements
|
|
314
|
-
* Avoids extra computation of friendly token for confirmation token (by @sbc100)
|
|
315
|
-
|
|
316
|
-
### 4.0.3 - 2016-05-15
|
|
317
|
-
|
|
318
|
-
* bug fixes
|
|
319
|
-
* Fix overwriting the remember_token when a valid one already exists (by @ralinchimev).
|
|
320
|
-
|
|
321
|
-
### 4.0.2 - 2016-05-02
|
|
322
|
-
|
|
323
|
-
* bug fixes
|
|
324
|
-
* Fix strategy checking in `Lockable#unlock_strategy_enabled?` for `:none`
|
|
325
|
-
and `:undefined` strategies. (by @f3ndot)
|
|
326
|
-
|
|
327
|
-
### 4.0.1 - 2016-04-25
|
|
328
|
-
|
|
329
|
-
* bug fixes
|
|
330
|
-
* Fix the e-mail confirmation instructions send when a user updates the email
|
|
331
|
-
address from nil. (by @lmduc)
|
|
332
|
-
* Remove unnecessary `attribute_will_change!` call. (by @cadejscroggins)
|
|
333
|
-
* Consistent `permit!` check. (by @ulissesalmeida)
|
|
334
|
-
|
|
335
|
-
### 4.0.0 - 2016-04-18
|
|
336
|
-
|
|
337
|
-
* bug fixes
|
|
338
|
-
* Fix the `extend_remember_period` configuration. When set to `false` it does
|
|
339
|
-
not update the cookie expiration anymore.(by @ulissesalmeida)
|
|
340
|
-
|
|
341
|
-
* deprecations
|
|
342
|
-
* Added a warning of default value change in Devise 4.1 for users that uses
|
|
343
|
-
the the default configuration of the following configurations: (by @ulissesalmeida)
|
|
344
|
-
* `strip_whitespace_keys` - The default will be `[:email]`.
|
|
345
|
-
* `skip_session_storage` - The default will be `[:http_auth]`.
|
|
346
|
-
* `sign_out_via` - The default will be `:delete`.
|
|
347
|
-
* `reconfirmable` - The default will be `true`.
|
|
348
|
-
* `email_regexp` - The default will be `/\A[^@\s]+@[^@\s]+\z/`.
|
|
349
|
-
* Removed deprecated argument of `Devise::Models::Rememberable#remember_me!` (by @ulissesalmeida)
|
|
350
|
-
* Removed deprecated private method Devise::Controllers::Helpers#expire_session_data_after_sign_in!
|
|
351
|
-
(by @bogdanvlviv)
|
|
20
|
+
Now, it always uses `application.secret_key_base`. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for `recoverable`, `lockable`, and `confirmable` will be invalid.
|
|
21
|
+
[#5645](https://github.com/heartcombo/devise/pull/5645)
|
|
22
|
+
* Change password instructions button label on devise view from `Send me reset password instructions` to `Send me password reset instructions` [#5515](https://github.com/heartcombo/devise/pull/5515)
|
|
23
|
+
* Change `<br>` tags separating form elements to wrapping them in `<p>` tags [#5494](https://github.com/heartcombo/devise/pull/5494)
|
|
24
|
+
* Replace `[data-turbo-cache=false]` with `[data-turbo-temporary]` on `devise/shared/error_messages` partial. This has been [deprecated by Turbo since v7.3.0 (released on Mar 1, 2023)](https://github.com/hotwired/turbo/releases/tag/v7.3.0).
|
|
352
25
|
|
|
353
|
-
|
|
26
|
+
If you are using an older version of Turbo and the default devise template, you'll need to copy it over to your app and change that back to `[data-turbo-cache=false]`.
|
|
354
27
|
|
|
355
28
|
* enhancements
|
|
356
|
-
*
|
|
357
|
-
|
|
358
|
-
*
|
|
359
|
-
(by @arjunsharma)
|
|
360
|
-
* Support to Rails 5 versioned migrations added.
|
|
361
|
-
|
|
362
|
-
* deprecations
|
|
363
|
-
* omniauth routes are no longer defined with a wildcard `:provider` parameter,
|
|
364
|
-
and provider specific routes are defined instead, so route helpers like `user_omniauth_authorize_path(:github)` are deprecated in favor of `user_github_omniauth_authorize_path`.
|
|
365
|
-
You can still use `omniauth_authorize_path(:user, :github)` if you need to
|
|
366
|
-
call the helpers dynamically.
|
|
367
|
-
|
|
368
|
-
### 4.0.0.rc1 - 2016-02-01
|
|
29
|
+
* Add Rails 8 support.
|
|
30
|
+
- Routes are lazy-loaded by default in test and development environments now so Devise loads them before `Devise.mappings` call. [#5728](https://github.com/heartcombo/devise/pull/5728)
|
|
31
|
+
* New apps using Rack 3.1+ will be generated using `config.responder.error_status = :unprocessable_content`, since [`:unprocessable_entity` has been deprecated by Rack](https://github.com/rack/rack/pull/2137).
|
|
369
32
|
|
|
370
|
-
|
|
371
|
-
*
|
|
372
|
-
*
|
|
33
|
+
Latest versions of [Rails transparently convert `:unprocessable_entity` -> `:unprocessable_content`](https://github.com/rails/rails/pull/53383), and Devise will use that in the failure app to avoid Rack deprecation warnings for apps that are configured with `:unprocessable_entity`. They can also simply change their `error_status` to `:unprocessable_content` in latest Rack versions to avoid the warning.
|
|
34
|
+
* Add Ruby 3.4 and 4.0 support.
|
|
35
|
+
* Reenable Mongoid test suite across all Rails 7+ versions, to ensure we continue supporting it. Changes to dirty tracking to support Mongoid 8.0+. [#5568](https://github.com/heartcombo/devise/pull/5568)
|
|
36
|
+
* Password length validator is changed from
|
|
373
37
|
|
|
374
|
-
|
|
375
|
-
|
|
376
|
-
The `for` method was deprecated in favor of `permit`:
|
|
377
|
-
|
|
378
|
-
```ruby
|
|
379
|
-
def configure_permitted_parameters
|
|
380
|
-
devise_parameter_sanitizer.for(:sign_up) << :subscribe_newsletter
|
|
381
|
-
# Should become the following.
|
|
382
|
-
devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
|
|
383
|
-
end
|
|
38
|
+
```
|
|
39
|
+
validates_length_of :password, within: password_length, allow_blank: true`
|
|
384
40
|
```
|
|
385
41
|
|
|
386
|
-
|
|
387
|
-
should be done through it's `initialize` method:
|
|
42
|
+
to
|
|
388
43
|
|
|
389
|
-
```
|
|
390
|
-
|
|
391
|
-
|
|
392
|
-
default_params.permit(:username, :email)
|
|
393
|
-
end
|
|
394
|
-
end
|
|
44
|
+
```
|
|
45
|
+
validates_length_of :password, minimum: proc { password_length.min }, maximum: proc { password_length.max }, allow_blank: true
|
|
46
|
+
```
|
|
395
47
|
|
|
396
|
-
|
|
48
|
+
so it's possible to override `password_length` at runtime. [#5734](https://github.com/heartcombo/devise/pull/5734)
|
|
397
49
|
|
|
398
|
-
|
|
399
|
-
|
|
400
|
-
|
|
401
|
-
|
|
402
|
-
|
|
403
|
-
|
|
404
|
-
|
|
50
|
+
* bug fixes
|
|
51
|
+
* Make `Devise` work without `ActionMailer` when `Zeitwerk` autoloader is used. [#5731](https://github.com/heartcombo/devise/pull/5731)
|
|
52
|
+
* Handle defaults `:from` and `:reply_to` as procs correctly by delegating to Rails [#5595](https://github.com/heartcombo/devise/pull/5595)
|
|
53
|
+
* Use `OmniAuth.config.allowed_request_methods` as routing verbs for the auth path [#5508](https://github.com/heartcombo/devise/pull/5508)
|
|
54
|
+
* Handle `on` and `ON` as true values to check params [#5514](https://github.com/heartcombo/devise/pull/5514)
|
|
55
|
+
* Fix passing `format` option to `devise_for` [#5732](https://github.com/heartcombo/devise/pull/5732)
|
|
56
|
+
* Use `ActiveRecord::SecurityUtils.secure_compare` in `Devise.secure_compare` to match two empty strings correctly. [#4829](https://github.com/heartcombo/devise/pull/4829)
|
|
57
|
+
* Respond with `401 Unauthorized` for non-navigational requests to destroy the session when there is no authenticated resource. [#4878](https://github.com/heartcombo/devise/pull/4878)
|
|
58
|
+
* Fix incorrect grammar of invalid authentication message with capitalized attributes, e.g.: "Invalid Email or password" => "Invalid email or password". (originally introduced by [#4014](https://github.com/heartcombo/devise/pull/4014), released on v4.1.0) [#4834](https://github.com/heartcombo/devise/pull/4834)
|
|
405
59
|
|
|
406
|
-
You can check more examples and explanations on the [README section](README.md#strong-parameters)
|
|
407
|
-
and on the [ParameterSanitizer docs](lib/devise/parameter_sanitizer.rb).
|
|
408
60
|
|
|
409
|
-
Please check [
|
|
61
|
+
Please check [4-stable](https://github.com/heartcombo/devise/blob/4-stable/CHANGELOG.md)
|
|
410
62
|
for previous changes.
|
data/MIT-LICENSE
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
Copyright 2020-
|
|
2
|
-
Copyright 2009-2019 Plataformatec
|
|
1
|
+
Copyright (c) 2020-2025 Rafael França, Carlos Antonio da Silva
|
|
2
|
+
Copyright (c) 2009-2019 Plataformatec
|
|
3
3
|
|
|
4
4
|
Permission is hereby granted, free of charge, to any person obtaining
|
|
5
5
|
a copy of this software and associated documentation files (the
|