devise 4.7.0 → 4.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 99f73a79ce1b893707bf43346c57fb609226ffdc
-  data.tar.gz: 0ab35ec0e647610f96a0a1357b93686237c3a419
+SHA256:
+  metadata.gz: 6dc5ab8b0dc2a902bcf6f66b156b87cdb5348a336f05fb8605b6db1d1f688bc5
+  data.tar.gz: 3be07eb3511c19857e9ddd2071b469833ac88d5c780c0a3c831c94523252663b
 SHA512:
-  metadata.gz: 385e26f7d0dcf2baed0879a24a445d0758682c5ff42b6b89fda4233b130b40f1eb64bb4fa0a860d4615d4966995504827cd384067b8544feab48958861c9d6be
-  data.tar.gz: 3696165b16b2f312d83a67036c4cb930e5ebd3be42103b6d60f5fb09504d3ff40e1d804758faf5a2606beb497ddfb8f62d4b293aa4648d458925deecf7cdd2b9
+  metadata.gz: 599ee2531bd66335b49e7282d2af71be9e02594fc36733ec3c8f96110a256ee918e45a56c88640558b16e943a599881435cdd0dbaa2029636d830364cfbcfeb4
+  data.tar.gz: e785db9c81e1275f283896d604124067b67685bced32267a75f0205f39d98a0985d68d40933859e31196cd773ccf260841cf1663a4ee9dcaab9c397af2f1c1b2

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 ### Unreleased
 
+### 4.7.1 - 2019-09-06
+
+* bug fixes
+  * Fix an edge case where records with a blank `confirmation_token` could be confirmed (by @tegon)
+  * Fix typo inside `update_needs_confirmation` i18n key (by @lslm)
+
 ### 4.7.0 - 2019-08-19
 
 * enhancements

data/config/locales/en.yml

@@ -42,7 +42,7 @@ en:
       signed_up_but_inactive: "You have signed up successfully. However, we could not sign you in because your account is not yet activated."
       signed_up_but_locked: "You have signed up successfully. However, we could not sign you in because your account is locked."
       signed_up_but_unconfirmed: "A message with a confirmation link has been sent to your email address. Please follow the link to activate your account."
-      update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and follow the confirm link to confirm your new email address."
+      update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and follow the confirmation link to confirm your new email address."
       updated: "Your account has been updated successfully."
       updated_but_not_signed_in: "Your account has been updated successfully, but since your password was changed, you need to sign in again"
     sessions:

data/lib/devise/models/confirmable.rb

@@ -348,7 +348,19 @@ module Devise
         # If the user is already confirmed, create an error for the user
         # Options must have the confirmation_token
         def confirm_by_token(confirmation_token)
+          # When the `confirmation_token` parameter is blank, if there are any users with a blank
+          # `confirmation_token` in the database, the first one would be confirmed here.
+          # The error is being manually added here to ensure no users are confirmed by mistake.
+          # This was done in the model for convenience, since validation errors are automatically
+          # displayed in the view.
+          if confirmation_token.blank?
+            confirmable = new
+            confirmable.errors.add(:confirmation_token, :blank)
+            return confirmable
+          end
+
           confirmable = find_first_by_auth_conditions(confirmation_token: confirmation_token)
+
           unless confirmable
             confirmation_digest = Devise.token_generator.digest(self, :confirmation_token, confirmation_token)
             confirmable = find_or_initialize_with_error_by(:confirmation_token, confirmation_digest)

data/lib/devise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Devise
-  VERSION = "4.7.0".freeze
+  VERSION = "4.7.1".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.7.1
 platform: ruby
 authors:
 - José Valim
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-08-19 00:00:00.000000000 Z
+date: 2019-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: warden
@@ -217,8 +217,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.13
+rubygems_version: 3.0.6
 signing_key: 
 specification_version: 4
 summary: Flexible authentication solution for Rails with Warden