oauth-plugin 0.4.0 → 0.4.1

data/CHANGELOG

@@ -1,3 +1,8 @@
+0.4.1
+  - Security fix for OAuth1 provider. Please upgrade if you're using any 0.4 version. Thanks to [tomhughes]
+  - Limit index size in ConsumerToken migration to deal with very large tokens [devainandor]
+  - Accept ancient OAuth2 Token token=asfavasd like tokens. Just for complete compatibility. [pelle]
+  - oauth2 errors should return http 400 [pelle]
 0.4.0
   - fix migrations to use expires_at instead of valid_to [pelle]
   - add force parameter for forcing token refresh [afeld]

data/generators/oauth_consumer/templates/migration.rb

@@ -9,7 +9,7 @@ class CreateOauthConsumerTokens < ActiveRecord::Migration
       t.timestamps
     end
 
-    add_index :consumer_tokens, :token, :unique => true
+    add_index :consumer_tokens, :token, :unique => true, :length => 100
 
   end
 

data/lib/generators/active_record/oauth_consumer_templates/migration.rb

@@ -9,7 +9,7 @@ class CreateOauthConsumerTokens < ActiveRecord::Migration
       t.timestamps
     end
 
-    add_index :consumer_tokens, :token, :unique => true
+    add_index :consumer_tokens, :token, :unique => true, :length => 100
 
   end
 

data/lib/oauth-plugin/version.rb

@@ -1,5 +1,5 @@
 module Oauth
   module Plugin
-    VERSION = "0.4.0"
+    VERSION = "0.4.1"
   end
 end

data/lib/oauth/controllers/provider_controller.rb

@@ -173,7 +173,7 @@ module OAuth
       end
 
       def oauth2_error(error="invalid_grant")
-        render :json=>{:error=>error}.to_json
+        render :json=>{:error=>error}.to_json, :status => 400
       end
 
     end

data/lib/oauth/rack/oauth_filter.rb

@@ -40,7 +40,7 @@ module OAuth
             oauth_token = nil
 
             if request_proxy.token
-              oauth_token = client_application.tokens.first(:conditions => { :token => request_proxy.token })
+              oauth_token = client_application.tokens.first(:conditions => ['invalidated_at IS NULL AND authorized_at IS NOT NULL and token = ?', request_proxy.token])
               if oauth_token.respond_to?(:provided_oauth_verifier=)
                 oauth_token.provided_oauth_verifier = request_proxy.oauth_verifier
               end
@@ -86,8 +86,8 @@ module OAuth
         request.params['bearer_token'] || request.params['access_token'] || (request.params["oauth_token"] && !request.params["oauth_signature"] ? request.params["oauth_token"] : nil )  ||
           request.env["HTTP_AUTHORIZATION"] &&
           !request.env["HTTP_AUTHORIZATION"][/(oauth_version="1.0")/] &&
-          request.env["HTTP_AUTHORIZATION"][/^(Bearer|OAuth|Token) ([^\s]*)$/, 2]
+          request.env["HTTP_AUTHORIZATION"][/^(Bearer|OAuth|Token) (token=)?([^\s]*)$/, 3]
       end
     end
   end
-end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oauth-plugin
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2011-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: opentransact
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006903220 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,15 +21,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006903220
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006901300 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -37,15 +32,10 @@ dependencies:
         version: 2.4.0
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: 2.4.0
+  version_requirements: *70232006901300
 - !ruby/object:Gem::Dependency
   name: fakeweb
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006899200 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -53,15 +43,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006899200
 - !ruby/object:Gem::Dependency
   name: fuubar
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006896860 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -69,15 +54,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006896860
 - !ruby/object:Gem::Dependency
   name: guard-rspec
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006896440 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -85,15 +65,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006896440
 - !ruby/object:Gem::Dependency
   name: growl
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006895980 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -101,15 +76,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006895980
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006895540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -117,15 +87,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006895540
 - !ruby/object:Gem::Dependency
   name: multi_json
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006895080 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -133,15 +98,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006895080
 - !ruby/object:Gem::Dependency
   name: oauth
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006894540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -149,15 +109,10 @@ dependencies:
         version: 0.4.4
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: 0.4.4
+  version_requirements: *70232006894540
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006894120 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -165,15 +120,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *70232006894120
 - !ruby/object:Gem::Dependency
   name: oauth2
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70232006893580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -181,12 +131,7 @@ dependencies:
         version: 0.5.0
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: 0.5.0
+  version_requirements: *70232006893580
 description: Rails plugin for implementing an OAuth Provider or Consumer
 email: oauth-ruby@googlegroups.com
 executables: []
@@ -379,7 +324,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.1
 requirements: []
 rubyforge_project: oauth
-rubygems_version: 1.8.18
+rubygems_version: 1.8.11
 signing_key: 
 specification_version: 3
 summary: Ruby on Rails Plugin for OAuth Provider and Consumer