omniauth-artsy 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +11 -1
  3. data/lib/omniauth-artsy/version.rb +1 -1
  4. data/lib/omniauth/strategies/artsy.rb +0 -6
  5. metadata +3 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 288c57c8e47b184a09c410179705501e5c09f4d0594f7278cef990d7842c12f3
4
- data.tar.gz: 0acc42b621eb30cc637da2a8a55d002c7739dbbe4ac9cd7d8d9a49b0d2290268
3
+ metadata.gz: 458657ceeb9a5b9bb402525b1d42cb4239f7ee1936a4a367b8934645e99721f0
4
+ data.tar.gz: d13523acde637c9d44313c2cea3dbca24b8173008ab8b9b4f06b85a0cd0d1afc
5
5
  SHA512:
6
- metadata.gz: 656a8269b399888fbbd912bad9527bd694c0fa14af85e93eecd0cc5cbca6b45b1a738d21e07ccd13239946ab45aa80878318c4aa02735101c8d47bbd06e9c370
7
- data.tar.gz: 759dee1cfa6c4c99e3bfc1129d7ac6cd6996756c86abf9fb5ebcb80bfcdfc04dad0aee3a1afd9933006eb61ea0c45c41c1a34726cb3e80f8c88d28431b6fae6c
6
+ metadata.gz: 9b75bead7e609985856455912ac9b1d667a623515e3c0969a8a41703b33d55e32d1be3cd7116042027c052884791c029624a488fc6dc44261ca311eecc07dd01
7
+ data.tar.gz: eca0ad11cb7e196d1a08946a026acaf456d1f9136aa4b117e67201e8196f89b995d048cc7428f06e6c1408f90adaca19d29e9082732280a881c0fa4869fb285b
data/CHANGELOG.md CHANGED
@@ -1,8 +1,18 @@
1
- 0.2.3 (Next)
1
+ 0.4.1 (Next)
2
2
  ===========
3
3
 
4
4
  * Your contribution here.
5
5
 
6
+ 0.4.0
7
+ ============
8
+
9
+ * [#16](https://github.com/artsy/omniauth-artsy/pull/16): Disallow GET requests for omniauth - [@starsirius](https://github.com/starsirius).
10
+
11
+ 0.3.0
12
+ ============
13
+
14
+ * [#14](https://github.com/artsy/omniauth-artsy/pull/14): Allow GET requests for omniauth - [@ansor4](https://github.com/ansor4).
15
+
6
16
  0.2.3
7
17
  ============
8
18
 
data/lib/omniauth-artsy/version.rb CHANGED
@@ -2,6 +2,6 @@
2
2
 
3
3
  module Omniauth
4
4
  module Artsy
5
- VERSION = '0.3.0'
5
+ VERSION = '0.4.0'
6
6
  end
7
7
  end
data/lib/omniauth/strategies/artsy.rb CHANGED
@@ -10,12 +10,6 @@ module OmniAuth
10
10
  site: OmniAuth::Artsy.config.artsy_api_url || ENV['ARTSY_API_URL'] || ENV['gravity_url'],
11
11
  authorize_url: '/oauth2/authorize?scope=offline_access&response_type=code',
12
12
  token_url: '/oauth2/access_token?scope=offline_access&response_type=code&grant_type=authorization_code'
13
- # TODO: Allow GET requests to redirect to /auth/artsy for now, which exposes us
14
- # to CSRF attacks. We'll want to change the auth redirect behavior to a POST
15
- # request at some point in the future.
16
- # https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
17
- OmniAuth.config.allowed_request_methods = %i[post get] if OmniAuth.config.respond_to?(:allowed_request_methods=)
18
- OmniAuth.config.silence_get_warning = true if OmniAuth.config.respond_to?(:silence_get_warning=)
19
13
  end
20
14
 
21
15
  configure
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: omniauth-artsy
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.3.0
4
+ version: 0.4.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Artsy
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-03-01 00:00:00.000000000 Z
11
+ date: 2021-07-29 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: omniauth-oauth2
@@ -110,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
110
110
  - !ruby/object:Gem::Version
111
111
  version: '0'
112
112
  requirements: []
113
- rubygems_version: 3.0.9
113
+ rubygems_version: 3.1.4
114
114
  signing_key:
115
115
  specification_version: 4
116
116
  summary: Omniauth plugin for Artsy authentication.