has_editable_password 0.2.1 → 0.2.2

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    ZjYyMDNiNzRhNWQ2MjI0NGI3YWU1MGEwZWI3ZjZiZTg2MjkxNjFhNQ==
+    NDI0NmM3NWFjMTM5YzZiZjMyZTkxYzE5MmYxMWQyZDZkNTk0MzQ5OA==
   data.tar.gz: !binary |-
-    NTIzMmE0ODliNzM4YjBhMTc3MjY5ZjI0NjViY2FiNDNkZjg5YTI5Mw==
+    YmM2MjZiMjM5NTk1ODIxZDRlYjc2ZmM2NDc1ZmY5MzY3YjcxNjhiNg==
 SHA512:
   metadata.gz: !binary |-
-    Y2Y4ODU1OTUzY2RhOTU1NjJkNzE0NDYzMTU5NmIwNmI2OTUyMjQ3ZjE3M2Q1
-    M2MzMjIzZWUxOGIyOTU0NmQwNzVhNmNiNmIyMjFlMTJmYzdjOGI2YmUzN2I1
-    ODg2MDM1YmE3OGE5MDc5MTEyYzM5OTBiZTcyOWQ3YmQ0ZmMwMmE=
+    NmEyNjhiMGI5YzU4OGM0OWQyN2ZmMzI1MmMwZDJhYWM4Y2JjYTU5ZDI3NmRk
+    ZWRlMzYxYWQ0N2M2YWU1ZWM5MDEzODAzZTQ0NjhlN2E2MDRhNWM3OTM4OTUx
+    Y2E4YWQ0ZmZmZTE1NmYzYzczMTg3MGNlMjFkYjE4MGNjYjVhZmM=
   data.tar.gz: !binary |-
-    YzNhMzQ5YmQ2MTE5YWZiNGE2MzQzODMwZjEyMzc3YTNkNzg5NDNkZTJhM2Iz
-    NjBmMDFmNjI2ZjQ0YjczMmMzZWVjZmIyMDkwZjkzMDU4YmY3MjFhZWMzODZk
-    MzYxZmJmMDI4YzE5NjY4NWQ1ZDdhNjY3MzcxNWYzMTRkMzMwODg=
+    YWQwYzNkYWU2NTE2NjY0N2ZkOTUxMzlmMTY1MDMyZTI3MTllNmIyNmQ5MGNj
+    NTdhZjBlYTNjZGFkY2Y4YmMxNDM2NzZjMWE5OWUzODk3NWJmYzM1ZjNlMWQ0
+    OWViNzliNTg3M2Y4OTMzYTNkNmI5NDE5YjVmM2RlZmUzZGY0MjM=

data/lib/has_editable_password.rb

@@ -105,8 +105,13 @@ module HasEditablePassword
   ##
   # Validation called on :update when the password_digest is touched.
   # Sets an error on password unless the current_password or a valid recovery_token is set
+  # Also clears the password_recovery_token if it is verified, to preven token reuse.
   def password_change
-    errors[:password] << 'Unauthorized to change the password' unless allow_password_change?
+    if allow_password_change?
+      self.password_recovery_token = ''
+    else
+      errors[:password] << 'Unauthorized to change the password'
+    end
   end
 
   def changing_password

data/lib/version.rb

@@ -1 +1 @@
-VERSION = '0.2.1'
+VERSION = '0.2.2'

data/spec/has_editable_password_spec.rb

@@ -246,6 +246,13 @@ describe HasEditablePassword do
             user.recovery_token = token
             expect(user.valid?(:update)).to be_true
           end
+
+          it 'clears the stored token after use' do
+            user.recovery_token = token
+            user.password = 'new_secret'
+            user.valid?(:update)
+            expect(user.password_recovery_token).to be_empty
+          end
         end
 
         context 'an invalid valid token is set' do
@@ -258,6 +265,13 @@ describe HasEditablePassword do
             user.recovery_token = token
             expect(user.valid?(:update)).to be_false
           end
+
+          it 'does not clear the stored token' do
+            user.recovery_token = token
+            user.password = 'new_secret'
+            user.valid?(:update)
+            expect(user.password_recovery_token).to_not be_empty
+          end
         end
 
         context 'the current_password is valid' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: has_editable_password
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Francesco Boffa