devise_google_authenticator 0.3.14 → 0.3.15

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    YmRjYzlmZjk0NzUzMzM3ZjMyZGQwZTM2ZmVjNzQ0ODAwYWVlMWViMA==
+    ZDAxODk5NTQwOGNkZWRlZTk0YzdkOTY3YjFiYzcxNDkyY2RkYTJjZQ==
   data.tar.gz: !binary |-
-    ZDVkYzFlYTczZjNkNWQwZDNiNzJmZDM5YWJmOGZmOTM0YzI2NDE3MQ==
+    N2JmNTExODkzYTYxOWZjNjE0OWIwYzI5MDU5Y2M4ZjhmZWIxODNmMA==
 SHA512:
   metadata.gz: !binary |-
-    YjZjNGJjNTg4YzJkNDAxZDAzNTBmMDQ3ZWU4MjdjYzA1YWIxZWZkY2Q5YTI2
-    NDMyMTFlYWY4NDcwZDJjNDBhMjRhMDY4NmMzN2YzNmJkMWE3Y2I1NjlkMzQ5
-    M2Y4M2NlMzc4YWNmMWYyMWU1NjFkZDMwODc1ZWFmYjkyM2U4NmE=
+    YzAxZGFmMzBkZTliZGExZDAzMDViMWI1NDQ0MDZkZWI3NDkzYzBiMzU3N2Nl
+    MDFlNjlkNzU0NWQ3ODlmNWUxOTk4Y2M0MGI5ZjdhYWUzMjJmY2U5ZmFmYTQy
+    MmY3YWUzZWMxMTZiYTA1NzI1NjA5ZTdjZjJjYzJjNWE5MGNhODc=
   data.tar.gz: !binary |-
-    MDUxYWZhY2I3YTk0YzAxNmVjNzM5YWE3ZWE0NjI4MWZkZmNmNmFkY2QyZjkw
-    MjY4YjJkODZkNzVhYzNjMWQwNjM3ZDQ4YjA2ZjFmYWU2MGZiMmM2MTRmYmE2
-    NThkYjMwNjYwODg5MTE3ZGUyZjY0YjE0ZmIyOTU0MGQ2MDY0YjI=
+    NWUwMDJjN2I2MzkxMTk4NTAwOTgzZGRjYWVhNmRlOTI3OGU3YTA5NjlmNmU3
+    NzI5Yzk5MGEwMWRjZmExZWFkZmE5MDkxMWI1ZDczMmM5NGVkODI0YzdhMWMx
+    M2U1ODY2MjVkZGU2N2Y3ZGNlNjYzYjIxMWVlNTQ2NTc0YjFhYTM=

data/README.rdoc

@@ -7,7 +7,7 @@ This is a devise[https://github.com/plataformatec/devise] extension to allow you
 Add the gem to your Gemfile (don't forget devise too):
 
 * gem 'devise'
-* gem 'devise_google_authenticator', '0.3.14'
+* gem 'devise_google_authenticator', '0.3.15'
 
 Don't forget to "bundle install"
 
@@ -58,6 +58,8 @@ The install generator adds some options to the end of your Devise config file (c
 * config.ga_timeout - how long should the user be able to authenticate with their Google Authenticator token
 * config.ga_timedrift - a multiplier which provides for drift between a user's clock (and therefore their OTP) and the system clock. This should be fine at 3.
 * config.ga_remembertime - how long to remember the token for before requiring another. By default this is 1 month. To disable this setting change it to nil.
+* config.ga_appname - If you want to set a custom application name instead of using the name of the Rails app.
+* config.ga_bypass_signup - If you don't want to immediately forward newly registered or signed-up users to the Display QR page. If this is enabled, users will have to visit the /displayqr page to enable Google Authenticator.
 
 == Custom Views
 
@@ -69,7 +71,7 @@ If you want to customise your views (which you likely will want to, as they're p
 
 With this extension enabled, the following is expected behaviour:
 
-* When a user registers, they are forwarded onto the Display QR page. This allows them to add their new "token" to their mobile device, and enable, or disable, the functionality.
+* When a user registers, they are forwarded onto the Display QR page (unless ga_bypass_signup is set to true). This allows them to add their new "token" to their mobile device, and enable, or disable, the functionality. To enable/disable the functionality, the user has to enter the current token.
 * If users can't self-register, they're still able to visit this page by visiting /MODEL/displayqr (eg: /users/displayqr).
 * If the function is enabled (for that user), when they sign in, they'll be prompted for their password (as per normal), but then redirected into the Check QR page. They have to enter their token (from their device) to then successfully authenticate.
 * If configured (by default to 1 month), the user will only be prompted for the token every 1 month.
@@ -79,6 +81,7 @@ With this extension enabled, the following is expected behaviour:
 The install generator also installs an english copy of a Devise Google Authenticator i18n file. This can be modified (or used to create other language versions) and is located at: config/locales/devise.google_authenticator.en.yml
 
 == Changes
+* Version 0.3.15 - Can now configure whether the displayqr page is displayed during sign-up. Can customise the app's name (thanks Felipe Lima). Require the users to enter the token when enabling or disabling the token (thanks again Felipe Lima). Handle namespaced Devise models (thanks Mikkel Garcia). Ability to set an Issuer within the OTP generation (thanks Sylvain UTARD).
 * Version 0.3.14 - Users can now generate a new token if they wish. This is available from the displayqr page.
 * Version 0.3.13 - Merged a feature to allow a qualifier for the Google Authenticator token display. This allows you to specify in your view a qualifier for the name of the OTP when it's enrolled into the Google Authenticator app. Thanks Michael Guymon for the pull.
 * Version 0.3.12 - Re-introduced Warden's after_authentication callback. Thanks Sunny Ng for the pull.
@@ -108,6 +111,10 @@ This extension would not exist without the following other projects and associat
 * Ronald Arias https://github.com/ronald05arias
 * Sunny Ng https://github.com/blahblahblah-
 * Michael Guymon https://github.com/mguymon
+* Mikkel Garcia https://github.com/mikkel
+* Ricky Reusser https://github.com/rreusser
+* Felipe Lima https://github.com/felipecsl
+* Sylvain Utard https://github.com/redox
 
 
 == Contributing to devise_google_authenticator

data/app/controllers/devise/displayqr_controller.rb

@@ -9,13 +9,20 @@ class Devise::DisplayqrController < DeviseController
       sign_in scope, resource, :bypass => true
       redirect_to stored_location_for(scope) || :root
     else
+      @tmpid = resource.assign_tmp
       render :show
     end
   end
 
   def update
+    if resource.gauth_tmp != params[resource_name]['tmpid'] || !resource.validate_token(params[resource_name]['gauth_token'].to_i)
+      set_flash_message(:error, :invalid_token)
+      render :show
+      return
+    end
+
     if resource.set_gauth_enabled(resource_params)
-      set_flash_message :notice, :status
+      set_flash_message :notice, (resource.gauth_enabled? ? :enabled : :disabled)
       sign_in scope, resource, :bypass => true
       redirect_to stored_location_for(scope) || :root
     else

data/app/views/devise/displayqr/show.html.erb

@@ -11,7 +11,10 @@
 	<h3><%= I18n.t('nice_request', {:scope => 'devise.registration'}) %></h3>
 	<p><%= f.label :gauth_enabled, I18n.t('qrstatus', {:scope => 'devise.registration'}) %><br />
 	<%= f.check_box :gauth_enabled %></p>
-	
+	<%= f.hidden_field :tmpid, value: @tmpid %>
+	<p><%= f.label :gauth_token, I18n.t('enter_token', {:scope => 'devise.registration'}) %><br />
+	<%= f.number_field :gauth_token, :autocomplete => :off %>
+
 	<p><%= f.submit I18n.t('submit', {:scope => 'devise.registration'}) %></p>
 <% end %>
 

data/config/locales/en.yml

@@ -6,6 +6,7 @@ en:
       title: "Your QR Code:"
       nice_request: "Would you like to enable Google Authenticator?"
       qrstatus: "Google Authenticator Status:"
+      enter_token: "Please enter your token number to continue"
       submit: "Continue..."
       newtoken: "Generate new token"
     checkga:

data/lib/devise_google_authenticatable/controllers/helpers.rb

@@ -1,23 +1,24 @@
 module DeviseGoogleAuthenticator
   module Controllers # :nodoc:
     module Helpers # :nodoc:
-      def google_authenticator_qrcode(user,qualifier=nil)
+      def google_authenticator_qrcode(user, qualifier=nil, issuer=nil)
         username = username_from_email(user.email)
-        app = Rails.application.class.parent_name
+        app = user.class.ga_appname || Rails.application.class.parent_name
         data = "otpauth://totp/#{otpauth_user(username, app, qualifier)}?secret=#{user.gauth_secret}"
+        data << "&issuer=#{issuer}" if !issuer.nil?
         data = Rack::Utils.escape(data)
         url = "https://chart.googleapis.com/chart?chs=200x200&chld=M|0&cht=qr&chl=#{data}"
         return image_tag(url, :alt => 'Google Authenticator QRCode')
       end
-      
+
       def otpauth_user(username, app, qualifier=nil)
         "#{username}@#{app}#{qualifier}"
-      end 
+      end
 
       def username_from_email(email)
         (/^(.*)@/).match(email)[1]
       end
-      
+
     end
   end
 end

data/lib/devise_google_authenticatable/models/google_authenticatable.rb

@@ -88,7 +88,7 @@ module Devise # :nodoc:
         def find_by_gauth_tmp(gauth_tmp)
           where(gauth_tmp: gauth_tmp).first
         end
-        ::Devise::Models.config(self, :ga_timeout, :ga_timedrift, :ga_remembertime)
+        ::Devise::Models.config(self, :ga_timeout, :ga_timedrift, :ga_remembertime, :ga_appname, :ga_bypass_signup)
       end
     end
   end

data/lib/devise_google_authenticatable/patches/check_ga.rb

@@ -7,6 +7,12 @@ module DeviseGoogleAuthenticator::Patches
 
       alias_method :create_original, :create
 
+      define_method :checkga_resource_path_name do |resource, id|
+        name = resource.class.name.singularize.underscore
+        name = name.split('/').last
+        "#{name}_checkga_path(id:'#{id}')"
+      end
+
       define_method :create do
 
         resource = warden.authenticate!(:scope => resource_name, :recall => "#{controller_path}#new")
@@ -18,7 +24,7 @@ module DeviseGoogleAuthenticator::Patches
           #we head back into the checkga controller with the temporary id
           #Because the model used for google auth may not always be the same, and may be a sub-model, the eval will evaluate the appropriate path name
           #This change addresses https://github.com/AsteriskLabs/devise_google_authenticator/issues/7
-          respond_with resource, :location => eval("#{resource.class.name.singularize.underscore}_checkga_path(id:'#{tmpid}')")
+          respond_with resource, :location => eval(checkga_resource_path_name(resource, tmpid))
 
         else #It's not using, or not enabled for Google 2FA, OR is remembering token and therefore not asking for the moment - carry on, nothing to see here.
           set_flash_message(:notice, :signed_in) if is_flashing_format?

data/lib/devise_google_authenticatable/patches/display_qr.rb

@@ -16,7 +16,16 @@ module DeviseGoogleAuthenticator::Patches
             set_flash_message :notice, :signed_up if is_flashing_format?
             sign_in(resource_name, resource)
             
-            respond_with resource, :location => {:controller => 'displayqr', :action => 'show'}
+            if resource.respond_to? :gauth_enabled?
+              if resource.class.ga_bypass_signup
+                respond_with resource, location: after_sign_up_path_for(resource)
+              else
+                respond_with resource, :location => {:controller => 'displayqr', :action => 'show'}
+              end
+            else
+              respond_with resource, location: after_sign_up_path_for(resource)
+            end
+
           else
             set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_flashing_format?
             expire_data_after_sign_in!

data/lib/devise_google_authenticator.rb

@@ -14,6 +14,12 @@ module Devise # :nodoc:
 
 	mattr_accessor :ga_remembertime
 	@@ga_remembertime = 1.month
+
+	mattr_accessor :ga_appname
+	@@ga_appname = Rails.application.class.parent_name
+
+	mattr_accessor :ga_bypass_signup
+	@@ga_bypass_signup = false
 end
 
 # a security extension for devise

data/lib/generators/devise_google_authenticator/install_generator.rb

@@ -15,6 +15,12 @@ module DeviseGoogleAuthenticator
         "  # Change setting to how long to remember device before requiring another token. Change to nil to turn feature off.\n" +
         "  # To change the default, uncomment and change the below:\n" +
         "  # config.ga_remembertime = 1.month\n\n" +
+        "  # Change setting to assign the application name used by code generator. Defaults to Rails.application.class.parent_name.\n" +
+        "  # To change the default, uncomment and change the below:\n" +
+        "  # config.ga_appname = 'example.com'\n\n" +
+        "  # Change setting to bypass the Display QR page immediately after a user sign's up\n" +
+        "  # To change the default, uncomment and change the below. Defaults to false:\n" + 
+        "  # config.ga_bypass_signup = true\n\n" + 
         "\n", :before => /end[ |\n|]+\Z/
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_google_authenticator
 version: !ruby/object:Gem::Version
-  version: 0.3.14
+  version: 0.3.15
 platform: ruby
 authors:
 - Christian Frichot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-29 00:00:00.000000000 Z
+date: 2014-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -115,7 +115,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
-      version: 2.1.0
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.1.11