devise_security_extension 0.7.1 → 0.7.2

data/VERSION

@@ -1 +1 @@
-0.7.1
+0.7.2

data/devise_security_extension.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "devise_security_extension"
-  s.version = "0.7.1"
+  s.version = "0.7.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Marco Scholl", "Alexander Dreher"]
-  s.date = "2012-11-21"
+  s.date = "2012-11-22"
   s.description = "An enterprise security extension for devise, trying to meet industrial standard security demands for web applications."
   s.email = "team@phatworx.de"
   s.extra_rdoc_files = [

data/lib/devise_security_extension/hooks/session_limitable.rb

@@ -10,19 +10,17 @@ Warden::Manager.after_set_user :except => :fetch do |record, warden, options|
   end
 end
 
-# Each time a record is fetched from session we check if a new session from another 
-# browser was opened for the record or not, based on a unique session identifier. 
+# Each time a record is fetched from session we check if a new session from another
+# browser was opened for the record or not, based on a unique session identifier.
 # If so, the old account is logged out and redirected to the sign in page on the next request.
 Warden::Manager.after_set_user :only => :fetch do |record, warden, options|
   scope = options[:scope]
+  env   = warden.request.env
 
-  if warden.authenticated?(scope)
-    unless record.unique_session_id == warden.session(scope)['unique_session_id']
-      path_checker = Devise::PathChecker.new(warden.env, scope)
-      unless path_checker.signing_out?
-        warden.logout(scope)
-        throw :warden, :scope => scope, :message => :session_limited
-      end
+  if warden.authenticated?(scope) && options[:store] != false
+    if record.unique_session_id != warden.session(scope)['unique_session_id'] && !env['devise.skip_session_limitable']
+      warden.logout(scope)
+      throw :warden, :scope => scope, :message => :session_limited
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise_security_extension
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.7.2
   prerelease: 
 platform: ruby
 authors:
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-11-21 00:00:00.000000000 Z
+date: 2012-11-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -173,7 +173,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: -3892103877583342336
+      hash: 2180026344185734924
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: