devise_pam_authenticatable2 8.0.1 → 8.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 482d5ad23ad00bffb983c333e6af0d99572fc0841ac1316e613f276ae1e7f0e8
-  data.tar.gz: 910ef5518bca33db2f0e718f7b42a7fa6f9abc44ef1cd5ad4d0ce3ab4a9bf9ef
+  metadata.gz: 98ebc063b9743d5b9be6b83c3efac4b12261ef60b9078709eb4f745d7c58621f
+  data.tar.gz: d1cefe9b39f534108b0e52af758522949baf22017c4f8a0e5c355d639d284874
 SHA512:
-  metadata.gz: 3d07fad015738e2649b9967d5a61dfce29b98542c650361804365d6a03d94b1c0570e4f9a8ec108c2b86e12acb75daa1c6c5925a5f84ab58d5e05a5955b404ec
-  data.tar.gz: 671923dc009bd24848a05ec6e8d1818b3b938e8c1a47e662d2c2e319a641cc9c739b60f21c823ec071378b1063c83df84f247bff1f4d3088e5a208a59466ef04
+  metadata.gz: a4cf642742de989f23211c18694f8e4319814162740acf38efbbcaef19a0609cb6f528032a2484609970e46bdfc2d60045d89c16aea1b3d1c5c5073047f3797a
+  data.tar.gz: 37ebe7f9a08eb7ef6e0ed87c266fbc5d6efced4c5036769f7c2f7bd2fc4dfe186d5b4df8212e2384b192ac885650c9c5d541eb864bc8cda9417ce0ce39f27334

data/README.md

@@ -3,11 +3,13 @@ Devise - PAM Authentication
 
 devise\_pam\_authenticatable is a Devise (http://github.com/plataformatec/devise)
 extension for authenticating using PAM (Pluggable Authentication Modulues)
-via the rpam gem.
+via the rpam2 gem.
 
 This allows you to authenticate against the local hosts authentication
 system including local account usernames and passwords.
 
+Or use LDAP and other PAM modules for LDAP authentication.
+
 There are obvious security risks with using PAM authentication via a
 web-based application. Make sure you at least use SSL to keep usernames and
 passwords encrypted via HTTPS.
@@ -29,7 +31,7 @@ Important changes
 Versions before 4.0.0 are limitted compatible with database_authenticatable.
 Some removed code may can clash in earlier versions.
 
-Version 7.0.0 (and 5, 6) change method names. Check if everything is correct.
+Version 5-8 change method names. Check if everything is correct. Sorry for the quick release cycle.
 
 Setup
 -----
@@ -41,16 +43,23 @@ In your Devise model, ensure the following is present:
 
     class User < ActiveRecord::Base
 
-      devise :pam_authenticatable, pam_service: "system-auth", pam_suffix: "foo"
+      devise :pam_authenticatable, pam_service: 'system-auth', pam_suffix: 'pamlogin'
+
+      # in case there is no password set by other devise modules:
+      attr_accessor :password
+      @password = nil
 
-      # Setup accessible (or protected) attributes for your model
-      attr_accessible :password, :<username or email field>
+      # in case other devise modules complain about missing password
+      # and the password is not mirrored
+      def password_required?
+        false
+      end
 
     end
 
-pam_service: "system-auth" is optional. By default the pam service specified in config.pam_default_service is used.
+pam_service: 'system-auth' is optional. By default the pam service specified in config.pam_default_service is used.
 
-pam_suffix: "foo" is optional. By default the pam email extraction suffix specified in config.pam_default_suffix is used.
+pam_suffix: 'pamlogin' is optional. By default the pam email extraction suffix specified in config.pam_default_suffix is used.
 
 Options:
 

data/VERSION

@@ -1 +1 @@
-8.0.1
+8.0.2

data/devise_pam_authenticatable2.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: devise_pam_authenticatable2 8.0.1 ruby lib
+# stub: devise_pam_authenticatable2 8.0.2 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "devise_pam_authenticatable2".freeze
-  s.version = "8.0.1"
+  s.version = "8.0.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib".freeze]
   s.authors = ["James Wilson".freeze, "Alexander Kaftan".freeze]
-  s.date = "2018-01-18"
+  s.date = "2018-01-23"
   s.description = "For authenticating against PAM (Pluggable Authentication Modules)".freeze
   s.email = "devkral@web.de".freeze
   s.extra_rdoc_files = [

data/lib/devise_pam_authenticatable/model.rb

@@ -17,9 +17,12 @@ module Devise
       def pam_get_name
         return self[::Devise.usernamefield] if ::Devise.usernamefield && self[::Devise.usernamefield]
         return nil unless ::Devise.emailfield && (suffix = find_pam_suffix)
+        # Regex is vulnerable to DOS attacks, use newline instead
         email = "#{self[::Devise.emailfield]}\n"
         pos = email.index("@#{suffix}\n")
-        return nil unless pos
+        # deceptive emailaddresses use newlines, so check this here
+        # and return nil in case another newline is found.
+        return nil if !pos || email.count('\n') > 1
         email.slice(0, pos)
       end
 
@@ -31,7 +34,7 @@ module Devise
       def pam_conflict?
         # detect a conflict
         # use blank password as discriminator between traditional login and pam login
-        respond_to?('password') && password.present? && is_pam_account?
+        respond_to?('encrypted_password') && encrypted_password.present? && is_pam_account?
       end
 
       def pam_conflict(_attributes)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise_pam_authenticatable2
 version: !ruby/object:Gem::Version
-  version: 8.0.1
+  version: 8.0.2
 platform: ruby
 authors:
 - James Wilson
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-01-18 00:00:00.000000000 Z
+date: 2018-01-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise