rails-auth 0.5.2 → 0.5.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 859d0073cd6debe3a360ae76e53e1776515fed4f
-  data.tar.gz: 94af3585ac7dec94d5f1c4abe30e71abadcb1a0c
+  metadata.gz: 342d0a06b03a2d2baf6208c62ca0640a76a863c5
+  data.tar.gz: c3f50f64a4897170496c74b2d9769dee3b1a53ff
 SHA512:
-  metadata.gz: 9e1524d42f7431b3bc348ca4f31cafc4adbd0ae21fc7cd10545449d7bc8b383ba7eadd84d53be205c7aa06683d3002a25de294699edd58d60326ca8cc550d758
-  data.tar.gz: 2272cf19faa31c19dfede2f602752e873c126d09a4dc31773e18a63ba963f0e3d2c42efe789e23d24a5ea5f7e6b7de0ce2abfbaa5fbd2b51b451d86afb80a119
+  metadata.gz: b77b9de690846b7aeb69d2a966df81679536a47ce743803397e4e4d644804493ac36a8cb5ef8530f48a4a6d51014b66bcb24dd7994baec8f60bf5b40a7797ab5
+  data.tar.gz: e9dbee7122a450b03a1a8a475534dbdd250ce6ff5560636ee551b8fd0a9dc5b334618c3189229c4a0bf5214c486576b173fa21ae9230bbb5a09f70aac01fd04e

data/CHANGES.md

@@ -1,3 +1,9 @@
+### 0.5.3 (2016-04-28)
+
+* [#22](https://github.com/square/rails-auth/pull/22)
+  Use explicit HTTP_METHODS whitelist when 'ALL' method is used.
+  ([@tarcieri])
+
 ### 0.5.2 (2016-04-27)
 
 * [#21](https://github.com/square/rails-auth/pull/21)

data/lib/rails/auth/acl/resource.rb

@@ -57,7 +57,7 @@ module Rails
         # @return [Boolean] method and path *only* match the given environment
         #
         def match!(env)
-          return false unless @http_methods.nil? || @http_methods.include?(env["REQUEST_METHOD".freeze])
+          return false unless @http_methods.include?(env["REQUEST_METHOD".freeze])
           return false unless @path =~ env["PATH_INFO".freeze]
           return false unless @host.nil? || @host =~ env["HTTP_HOST".freeze]
           true
@@ -68,7 +68,8 @@ module Rails
         def extract_methods(methods)
           methods = Array(methods)
 
-          return nil if methods.include?("ALL")
+          return HTTP_METHODS if methods == ["ALL"]
+          raise ParseError, "method 'ALL' cannot be used with other methods" if methods.include?("ALL")
 
           methods.each do |method|
             raise ParseError, "invalid HTTP method: #{method}" unless HTTP_METHODS.include?(method)

data/lib/rails/auth/version.rb

@@ -3,6 +3,6 @@
 module Rails
   # Pluggable authentication and authorization for Rack/Rails
   module Auth
-    VERSION = "0.5.2".freeze
+    VERSION = "0.5.3".freeze
   end
 end

data/spec/rails/auth/acl/resource_spec.rb

@@ -30,7 +30,7 @@ RSpec.describe Rails::Auth::ACL::Resource do
         {}
       )
 
-      expect(resource.http_methods).to eq nil
+      expect(resource.http_methods).to eq Rails::Auth::ACL::Resource::HTTP_METHODS
     end
 
     context "errors" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-auth
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.3
 platform: ruby
 authors:
 - Tony Arcieri
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-04-28 00:00:00.000000000 Z
+date: 2016-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack