rodauth 1.19.0 → 1.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6334a653be69dad1d434d2792e8b5eda787fa69e13cd45f83fbe23cd7ab7865
-  data.tar.gz: 5854eaa491e9887bfe5d934937bd249c5b063a621a24e3817aef51330b6bbe1f
+  metadata.gz: bad06774a2bc77b951a38d149fd641d16bf1034e379458b4e5fb49bbf4dfb0f3
+  data.tar.gz: c82fc51c1c7bc5c917e4ef59816db28fb4fd3df52a90262b215215b7f1732639
 SHA512:
-  metadata.gz: 0e293f83da80d612f95bbd04da5b58d20f5a3d92c4c24f6fab1b50c595f677862e4c06e3261a08c5063dcad4e491b4073f6e40942191aec8cbb6d32f94bd9cd8
-  data.tar.gz: 8ca62fd8ece8fbeef61e7f3c658e987d29cba79195aa8fff1dff3a0a99576fa557ce1ec19a22de7a09a7d850627532ab79083f24e61aa891460854fbd843d4e7
+  metadata.gz: c53d4e2757e9f2d6ceb0d7724b5d6f9d7090c3e1fa88471e570b4c72ffeb63aea71e0e1dc1d93e0d16463ba982e70cd0f0e00ef8a2ecb6fbf4acdb33420da3f4
+  data.tar.gz: 50269467b08e309416984b6831a8871e023edb1287a88306e072fc375e1a75e4bdb866cc4533cab3e468d3666f1892f71bf1cfd93cefe186941957617c91e1eb

data/CHANGELOG

@@ -1,3 +1,7 @@
+=== 1.19.1 (2018-11-16)
+
+* Support rotp 4 in the otp feature (jeremyevans)
+
 === 1.19.0 (2018-11-16)
 
 * Avoid unneeded database queries in the two factor authentication support (jeremyevans)

data/lib/rodauth/features/otp.rb

@@ -254,7 +254,11 @@ module Rodauth
       return false unless otp_exists?
       ot_pass = ot_pass.gsub(/\s+/, '')
       if drift = otp_drift
-        otp.verify_with_drift(ot_pass, drift)
+        if otp.respond_to?(:verify_with_drift)
+          otp.verify_with_drift(ot_pass, drift)
+        else
+          otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift)
+        end
       else
         otp.verify(ot_pass)
       end
@@ -316,7 +320,7 @@ module Rodauth
     end
 
     def otp_valid_key?(secret)
-      secret =~ /\A[a-z2-7]{16}\z/
+      secret =~ /\A([a-z2-7]{16}|[a-z2-7]{32})\z/
     end
 
     def otp_new_secret

data/lib/rodauth/version.rb

@@ -10,7 +10,7 @@ module Rodauth
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.
-  TINY = 0
+  TINY = 1
 
   # The full version of Rodauth as a string
   VERSION = "#{MAJOR}.#{MINOR}.#{TINY}".freeze

data/spec/two_factor_spec.rb

@@ -1,6 +1,10 @@
 require File.expand_path("spec_helper", File.dirname(__FILE__))
 
+require 'rotp'
+
 describe 'Rodauth OTP feature' do
+  secret_length = ROTP::Base32.random_base32.length
+
   def reset_otp_last_use
     DB[:account_otp_keys].update(:last_use=>Sequel.date_sub(Sequel::CURRENT_TIMESTAMP, :seconds=>600))
   end
@@ -40,7 +44,7 @@ describe 'Rodauth OTP feature' do
 
     page.title.must_equal 'Setup Two Factor Authentication'
     page.html.must_include '<svg' 
-    secret = page.html.match(/Secret: ([a-z2-7]{16})/)[1]
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
     totp = ROTP::TOTP.new(secret)
     fill_in 'Password', :with=>'asdf'
     click_button 'Setup Two Factor Authentication'
@@ -346,7 +350,7 @@ describe 'Rodauth OTP feature' do
 
     page.title.must_equal 'Setup Two Factor Authentication'
     page.html.must_include '<svg' 
-    secret = page.html.match(/Secret: ([a-z2-7]{16})/)[1]
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
     totp = ROTP::TOTP.new(secret, :digits=>8)
     fill_in 'Authentication Code', :with=>"asdf"
     click_button 'Setup Two Factor Authentication'
@@ -482,7 +486,7 @@ describe 'Rodauth OTP feature' do
     end
 
     visit '/otp-setup'
-    secret = page.html.match(/Secret: ([a-z2-7]{16})/)[1]
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
     totp = ROTP::TOTP.new(secret)
     fill_in 'Password', :with=>'0123456789'
     fill_in 'Authentication Code', :with=>totp.now
@@ -524,7 +528,7 @@ describe 'Rodauth OTP feature' do
     page.html.must_include('Without OTP')
 
     visit '/otp-auth'
-    secret = page.html.match(/Secret: ([a-z2-7]{16})/)[1]
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
     totp = ROTP::TOTP.new(secret, :interval=>interval)
     fill_in 'Password', :with=>'0123456789'
     fill_in 'Authentication Code', :with=>totp.now
@@ -567,7 +571,7 @@ describe 'Rodauth OTP feature' do
     visit '/otp-setup'
     page.title.must_equal 'Setup Two Factor Authentication'
     page.html.must_include '<svg' 
-    secret = page.html.match(/Secret: ([a-z2-7]{16})/)[1]
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
     totp = ROTP::TOTP.new(secret)
     fill_in 'Password', :with=>'0123456789'
     fill_in 'Authentication Code', :with=>totp.now
@@ -623,7 +627,7 @@ describe 'Rodauth OTP feature' do
     login
 
     visit '/otp-setup'
-    secret = page.html.match(/Secret: ([a-z2-7]{16})/)[1]
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
     totp = ROTP::TOTP.new(secret)
     fill_in 'Authentication Code', :with=>totp.now
     click_button 'Setup Two Factor Authentication'
@@ -1347,7 +1351,7 @@ describe 'Rodauth OTP feature' do
     before_called.must_equal false
     page.current_path.must_equal '/otp-setup'
 
-    secret = page.html.match(/Secret: ([a-z2-7]{16})/)[1]
+    secret = page.html.match(/Secret: ([a-z2-7]{#{secret_length}})/)[1]
     totp = ROTP::TOTP.new(secret)
     fill_in 'Password', :with=>'0123456789'
     fill_in 'Authentication Code', :with=>totp.now

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 1.19.0
+  version: 1.19.1
 platform: ruby
 authors:
 - Jeremy Evans