rodauth 2.23.0 → 2.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 707e580a46dc470c4fffc91eca813495d0fb6330312131fd17b4b87db8415cc2
-  data.tar.gz: d73099f372d594438da78614ac974f1b9343aa4c9de93f162b9432a77f0e0ae6
+  metadata.gz: 3db9ca9b25c4acd3e2b16cfca4a9efbc95758242e5030cbb33502440df4dbc15
+  data.tar.gz: e77ffff24d840adc1a17d162e58f76f99b363f063c070229315f45766d71a96a
 SHA512:
-  metadata.gz: d0005518db3164d29e4be62b76035ccb98df3f8d0f7d129624a099032b5566f125041656d11c798d0fa14b3c2b40a19df18fe5fc1df6c38603ba4660baf9d7b1
-  data.tar.gz: 9b585c6e4f7338609b404cbd4e35fa96467d8f04d9a98089729d7f757b7920afbb1d99a9b028519aa211ad4bd16c7b96d4e3945647a4eaf81691abf6b1a64aae
+  metadata.gz: 46064d3008752765daec092f037dc3d3b2b85a6f2a9c9a9b6fe1b4abec1cc9764d7c157adc736844ccbdde68f78a7b303225da5fe6caa895f650a9102b2cf271
+  data.tar.gz: fadc40b635e868e0b59f61faa566447f294e4fc174b0620e06bac1766c4fb6c1ce0944548d413443bc699c128b7c59d9f5c6dc7175fb46c2f9c3d1404e698c8e

data/CHANGELOG

@@ -1,3 +1,13 @@
+=== 2.24.0 (2022-05-24)
+
+* Work around implicit null byte check added in bcrypt 3.1.18 by checking password requirements before other password checks (jeremyevans)
+
+* Fix invalid HTML on pages with OTP QR codes (jeremyevans)
+
+* Add recovery_codes_available? configuration method to the recovery_codes feature (janko) (#238)
+
+* Add otp_available? configuration method to the otp feature (janko) (#238)
+
 === 2.23.0 (2022-04-22)
 
 * Don't automatically set :httponly cookie option if :http_only option is set in remember feature (jeremyevans)

data/doc/otp.rdoc

@@ -70,6 +70,7 @@ before_otp_setup_route :: Run arbitrary code before handling an OTP authenticati
 otp :: The object used for verifying OTP authentication attempts.
 otp_add_key(secret) :: Add an OTP key for the current account with the given secret.
 otp_auth_view :: The HTML to use for the OTP authentication form.
+otp_available? :: Whether OTP authentication is ready for use.
 otp_disable_view :: The HTML to use for the OTP disable form.
 otp_exists? :: Whether the current account has setup OTP.
 otp_key :: The stored OTP secret for the account.

data/doc/recovery_codes.rdoc

@@ -57,4 +57,5 @@ new_recovery_code :: A new recovery code to insert into the recovery codes table
 recovery_auth_view :: The HTML to use for the form to authenticate via a recovery code.
 recovery_code_match?(code) :: Whether the given code matches any of the existing recovery_codes.
 recovery_codes :: An array containing all valid recovery codes for the current account.
+recovery_codes_available? :: Whether authentication via recovery codes is ready for use.
 recovery_codes_view :: The HTML to use for the form to view recovery codes.

data/doc/release_notes/2.24.0.txt

@@ -0,0 +1,15 @@
+= New Features
+
+* rodauth.otp_available? has been added for checking whether the
+  account is allowed to authenticate with OTP.  It returns true
+  when the account has setup OTP and OTP use is not locked out.
+
+* rodauth.recovery_codes_available? has been added for checking
+  whether the account is allowed to authenticate using a recovery
+  code.  It returns true when there are any available recovery
+  codes for the account to use.
+
+= Other Improvements
+
+* The otp feature no longer includes the <?xml> tag for svg images,
+  since that results in invalid HTML.

data/lib/rodauth/features/otp.rb

@@ -76,6 +76,7 @@ module Rodauth
     )
 
     auth_methods(
+      :otp_available?,
       :otp_exists?,
       :otp_last_use,
       :otp_locked_out?,
@@ -238,6 +239,10 @@ module Rodauth
       end
     end
 
+    def otp_available?
+      otp_exists? && !otp_locked_out?
+    end
+
     def otp_exists?
       !otp_key.nil?
     end
@@ -303,7 +308,8 @@ module Rodauth
     end
 
     def otp_qr_code
-      RQRCode::QRCode.new(otp_provisioning_uri).as_svg(:module_size=>8, :viewbox=>true, :use_path=>true)
+      svg = RQRCode::QRCode.new(otp_provisioning_uri).as_svg(:module_size=>8, :viewbox=>true, :use_path=>true)
+      svg.sub(/\A<\?xml version="1\.0" standalone="yes"\?>/, '')
     end
 
     def otp_user_key
@@ -328,7 +334,7 @@ module Rodauth
 
     def _two_factor_auth_links
       links = super
-      links << [20, otp_auth_path, otp_auth_link_text] if otp_exists? && !otp_locked_out?
+      links << [20, otp_auth_path, otp_auth_link_text] if otp_available?
       links
     end
 

data/lib/rodauth/features/recovery_codes.rb

@@ -57,6 +57,7 @@ module Rodauth
       :can_add_recovery_codes?,
       :new_recovery_code,
       :recovery_code_match?,
+      :recovery_codes_available?,
     )
 
     internal_request_method :recovery_codes
@@ -192,6 +193,10 @@ module Rodauth
       end
     end
 
+    def recovery_codes_available?
+      !recovery_codes_ds.empty?
+    end
+
     def possible_authentication_methods
       methods = super
       methods << 'recovery_code' unless recovery_codes_ds.empty?
@@ -202,7 +207,7 @@ module Rodauth
 
     def _two_factor_auth_links
       links = super
-      links << [40, recovery_auth_path, recovery_auth_link_text] unless recovery_codes_ds.empty?
+      links << [40, recovery_auth_path, recovery_auth_link_text] if recovery_codes_available?
       links
     end
 

data/lib/rodauth/features/reset_password.rb

@@ -130,6 +130,10 @@ module Rodauth
 
         password = param(password_param)
         catch_error do
+          unless password_meets_requirements?(password)
+            throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+          end
+
           if password_match?(password) 
             throw_error_reason(:same_as_existing_password, invalid_field_error_status, password_param, same_as_existing_password_message)
           end
@@ -138,10 +142,6 @@ module Rodauth
             throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
           end
 
-          unless password_meets_requirements?(password)
-            throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
-          end
-
           transaction do
             before_reset_password
             set_password(password)

data/lib/rodauth/features/sms_codes.rb

@@ -430,7 +430,7 @@ module Rodauth
     end
 
     def sms_available?
-      sms && !sms_needs_confirmation? && !sms_locked_out?
+      sms_setup? && !sms_locked_out?
     end
 
     def sms_locked_out?

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 23
+  MINOR = 24
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.23.0
+  version: 2.24.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-22 00:00:00.000000000 Z
+date: 2022-05-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -339,6 +339,7 @@ extra_rdoc_files:
 - doc/release_notes/2.21.0.txt
 - doc/release_notes/2.22.0.txt
 - doc/release_notes/2.23.0.txt
+- doc/release_notes/2.24.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -449,6 +450,7 @@ files:
 - doc/release_notes/2.21.0.txt
 - doc/release_notes/2.22.0.txt
 - doc/release_notes/2.23.0.txt
+- doc/release_notes/2.24.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -575,13 +577,13 @@ files:
 - templates/webauthn-auth.str
 - templates/webauthn-remove.str
 - templates/webauthn-setup.str
-homepage: https://github.com/jeremyevans/rodauth
+homepage: https://rodauth.jeremyevans.net
 licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/jeremyevans/rodauth/issues
-  changelog_uri: http://rodauth.jeremyevans.net/rdoc/files/CHANGELOG.html
-  documentation_uri: http://rodauth.jeremyevans.net/documentation.html
+  changelog_uri: https://rodauth.jeremyevans.net/rdoc/files/CHANGELOG.html
+  documentation_uri: https://rodauth.jeremyevans.net/documentation.html
   mailing_list_uri: https://github.com/jeremyevans/rodauth/discussions
   source_code_uri: https://github.com/jeremyevans/rodauth
 post_install_message: