rodauth 2.21.0 → 2.22.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb1777533bb6a941212c0e6d5be00fc393b95c3d22e7af40542d616cdd68d139
-  data.tar.gz: de6a798803940fb94ff1d44bc2d148e45b1adc8e532cb44db4602b974a1b6b19
+  metadata.gz: f20339f12a4abc3d970bebd785c10d788ecb51c46f787beda3ff8a0d9a337706
+  data.tar.gz: 1a930e230aff9f64d7af359211fc9c568a93978372a5813612c964b673c8f6aa
 SHA512:
-  metadata.gz: 830b574f78cba6d5e103306f3709e2ae92e99af0cb0b02c8276699c048cd799cad58cf28d521980e43c0023aadc8934705ad45ff48819c316b3c6d3b5554f189
-  data.tar.gz: d4127705f604ac89b35f17d795c07bd54bed86b6c9c784e04578f047a3b1d2e34689c0320c35ffe9f7640e7870197c6563c4c57c0867ca5d2d257d23a143ce1a
+  metadata.gz: '030017944284769f16d83e1454d1b7c1bdf8ec6cd1c8201e7c7feba17f0809201b436f452ed660392f78253f196ca76d4062bc94dd64c1227a4f75937ef42f2c'
+  data.tar.gz: e05d2d37f2c32808bb482e7f2ddd332ad34fe6478dc8ea842b84ba45fdd1e9330c081e139235abc2b7a79c0827df92f36350d35ef4b108056b0ac1b8f8a991e0

data/CHANGELOG

@@ -1,3 +1,17 @@
+=== 2.22.0 (2022-03-22)
+
+* Ignore parameters where the value includes a null byte by default, add null_byte_parameter_value configuration method for customization (jeremyevans)
+
+* Handle sessions created before active_sessions feature was enabled during logout (jeremyevans) (#224)
+
+* Add reset_password_notify for emailing users after successful password resets (jeremyevans)
+
+* An email method can now be used in external features to DRY up email creation code (jeremyevans)
+
+* The change_password_notify feature now correctly handles template precompilation (jeremyevans)
+
+* Fix update_sms to update stored sms hash (bjeanes) (#222)
+
 === 2.21.0 (2022-02-23)
 
 * Avoid extra bcrypt hashing on account verification when using account_password_hash_column (janko) (#217)
@@ -326,446 +340,6 @@
 
 * Drop support for Ruby 1.8 (jeremyevans)
 
-=== 1.23.0 (2020-03-06)
-
-* Remove specs from the gem to reduce gem size by over 20% (jeremyevans) 
-
-* Make rodauth.authenticated? return true on OTP setup page (jeremyevans) (#68)
-
-* Display link to email auth request form when user has entered login and incorrect password if using email_auth feature (janko) (#65)
-
-* Add *_path and *_url methods for all *_route methods (janko) (#64)
-
-* Add send_email configuration method for configuring how email is sent (janko) (#63)
-
-=== 1.22.0 (2019-10-29)
-
-* Add jwt_cors feature to handle Cross-Origin Resource Sharing when using the jwt feature (jeremyevans)
-
-* Add space before newline after links in email, fixing issues with some webmail providers with broken autolinkers (jeremyevans)
-
-=== 1.21.0 (2019-07-24)
-
-* Support rotp 5.1 in the otp feature (jeremyevans)
-
-* Log user out when locking out OTP account if no fallback options available (jeremyevans)
-
-=== 1.20.0 (2019-06-07)
-
-* Support rotp 5 in the otp feature (jeremyevans)
-
-* Add jwt_refresh feature to allow shorter lived JWTs with a refresh token for creating new JWTs (allavena, jeremyevans) (#28)
-
-* Fix disallow_password_reuse feature when account_password_hash_column is not set and verify_account feature is not used (cptaffe) (#59)
-
-* Rename no_matching_email_auth_key_message to no_matching_email_auth_key_error_flash for consistency (jeremyevans)
-
-* Rename no_matching_verify_login_change_key_message to no_matching_verify_login_change_key_error_flash for consistency (jeremyevans)
-
-* Rename attempt_to_login_to_unverified_account_notice_message to attempt_to_login_to_unverified_account_error_flash for consistency (jeremyevans)
-
-* Rename attempt_to_create_unverified_account_notice_message to attempt_to_create_unverified_account_error_flash for consistency (jeremyevans)
-
-* Rename no_matching_verify_account_key_message to no_matching_verify_account_key_error_flash for consistency (jeremyevans)
-
-* Rename no_matching_unlock_account_key_message to no_matching_unlock_account_key_error_flash for consistency (jeremyevans)
-
-* Rename no_matching_reset_password_key_message to no_matching_reset_password_key_error_flash for consistency (jeremyevans)
-
-* Add otp_keys_use_hmac? and otp_setup_raw_param configuration methods to the otp feature for configuring use of HMACs with OTP authentication (jeremyevans)
-
-* Do not set a previous account password before password has been set when using disallow_password_reuse with verify_account_set_password? (jeremyevans)
-
-* Add allow_raw_single_session_key? to single_session feature to allow raw single single session tokens, for graceful transition (jeremyevans)
-
-* Add raw_remember_token_deadline to remember feature to allow raw remember tokens before given deadline, for graceful transition (jeremyevans)
-
-* Add allow_raw_email_token? configuration method to email_base feature to allow raw tokens when email_token_hmac_secret is set, for graceful transition (jeremyevans)
-
-* Add hmac_secret configuration method, used for additional security using HMACs (jeremyevans)
-
-* Use urlsafe base64 for new token keys on Ruby 1.8 (jeremyevans)
-
-* Add login_input_type configuration method for setting the input type for login inputs (jeremyevans)
-
-* Add formatted_field_error configuration method for formatting error messages (jeremyevans)
-
-* Add field_error_attributes configuration method for configuring attributes for fields with errors (jeremyevans)
-
-* Add field_attributes configuration method for configuring attributes for specific fields (jeremyevans)
-
-* Add default_field_attributes configuration method to set default attributes for all input fields (jeremyevans)
-
-* Make error handling accessible by default using aria-invalid and aria-describedby attributes (jeremyevans)
-
-* Add mark_input_fields_as_required? configuration method for whether inputs should use the required attribute (jeremyevans)
-
-* Add input_field_error_message_class configuration method for the CSS class used for error messages (jeremyevans)
-
-* Wrap all error messages in a span so they can be styled (jeremyevans)
-
-* Add input_field_error_class configuration method for customizing CSS class to use for inputs with errors (jeremyevans)
-
-* Add input_field_label_suffix configuration method for suffixing all input labels, useful for labeling fields as required (jeremyevans)
-
-* Add verify_account_resend_explanatory_text configuration method to verify_account feature for configuring text (jeremyevans)
-
-* Add unlock_account_explanatory_text and unlock_account_request_explanatory_text configuration methods to lockout feature for configuring text (jeremyevans)
-
-* Add reset_password_explanatory_text configuration method to reset_password feature for configuring text (jeremyevans)
-
-* Add otp_provisioning_uri_label and otp_secret_label configuration methods to otp feature for configuring labels displayed during OTP setup (jeremyevans)
-
-* Add add_recovery_codes_heading configuration method to recovery_codes feature for configuring heading text (jeremyevans)
-
-* Use define_method instead of instance_exec for route dispatching for better performance (jeremyevans)
-
-* Add already_an_account_with_this_login_message configuration method (1gor) (#54)
-
-=== 1.19.1 (2018-11-16)
-
-* Support rotp 4 in the otp feature (jeremyevans)
-
-=== 1.19.0 (2018-11-16)
-
-* Avoid unneeded database queries in the two factor authentication support (jeremyevans)
-
-* Add {before,after}_verify_login_change_email configuration methods, called around sending the verify login change email (jeremyevans)
-
-* Add after_account_lockout configuration method, called after locking out an account (jeremyevans)
-
-* Add default_post_email_redirect configuration method, setting default for all redirects after emailing when not logged in (jeremyevans)
-
-* Gracefully handle failure when new login is already taken in the verify_login_change feature (jeremyevans)
-
-* Support optional email rate limiting in the lockout, reset password, and verify account features (jeremyevans)
-
-* Make MySQL rodauth_get_salt function handle accounts without password hashes (jeremyevans)
-
-* Add email_auth feature, for authentication using links sent via email (jeremyevans)
-
-* Deprecate before_otp_authentication_route, users should switch to before_otp_auth_route (jeremyevans)
-
-* Add use_multi_phase_login? configuration method to login feature, separating login entry from password entry (jeremyevans)
-
-* Don't disable use of date_arithmetic extension on !MySQL when using lockout, remember, or reset password features (jeremyevans)
-
-=== 1.18.0 (2018-07-18)
-
-* Add confirm_password_redirect_session_key configuration method to confirm_password feature (jeremyevans)
-
-* Work with Roda sessions plugin, using string keys for session information if that is used (jeremyevans)
-
-* Add flash_error_key and flash_notice_key configuration for setting keys used in flash (jeremyevans)
-
-=== 1.17.0 (2018-06-11)
-
-* Support Roda route_csrf plugin for request-specific CSRF tokens (jeremyevans)
-
-=== 1.16.0 (2018-03-09)
-
-* Add disallow_common_passwords feature, for disallowing the usage of the most common passwords (jeremyevans)
-
-* Remove calling request [] method to get request param values, as it is deprecated in the current version of rack (jeremyevans)
-
-=== 1.15.0 (2018-01-29)
-
-* Add create_account_set_password? and verify_account_set_password? methods to delay setting password until account verification (jeremyevans)
-
-=== 1.14.0 (2017-12-19)
-
-* Don't allow unlocking expired accounts when using account_expiration and lockout features (jeremyevans)
-
-* Don't allow resetting passwords for expired accounts when using account_expiration and reset_password features (jeremyevans)
-
-* Add change_password_notify feature for emailing when user uses change password feature (jeremyevans)
-
-=== 1.13.0 (2017-11-21)
-
-* Add json_response_body(hash) configuration method to jwt feature (jeremyevans)
-
-* Support invalid_previous_password_message configuration method in change_password feature (jeremyevans)
-
-* Use custom error statuses if only_json? and json_response_custom_error_status? are true even if request isn't in json format (jeremyevans)
-
-* Add cache_templates configuration method for disabling caching of templates (adam12, jeremyevans) (#46)
-
-=== 1.12.0 (2017-10-03)
-
-* [SECURITY] Clear expired password reset key for account before retrieving password reset key (chanks, jeremyevans) (#43)
-
-* Update migrations to work with Sequel 5 (jeremyevans)
-
-* Add require_http_basic_auth configuration method to http_basic_auth feature (jeremyevans) (#41)
-
-* Support passing :search_path option to Rodauth.create_database_authentication_functions when using PostgreSQL (jeremyevans)
-
-* Support passing options to Rodauth.{create,drop}_database_previous_password_check_functions (jeremyevans)
-
-* Support passing options to Rodauth.drop_database_authentication_functions (jeremyevans)
-
-=== 1.11.0 (2017-04-24)
-
-* Add login_required_error_status, and use it in the jwt feature when custom error statuses are allowed (jeremyevans)
-
-* Deal better with time differences between the database and application servers in the password_expiration plugin (jeremyevans)
-
-* Add rodauth.valid_jwt? method for checking if a valid JWT was submitted with the request (jeremyevans)
-
-=== 1.10.0 (2017-03-23)
-
-* Add Internals Guide (jeremyevans)
-
-* Set FeatureConfiguration instances to constants, just like Feature instances (jeremyevans)
-
-* When reopening rodauth configuration in roda subclass, automatically subclass rodauth configuration so it doesn't modify superclass (jeremyevans)
-
-* Add verify_login_change feature as an alternative to verify_change_login, where the change doesn't take affect until after verification (jeremyevans) (#31)
-
-* Add login_failed_reset_password_request_form for customizing the HTML used for the request password request form on login failures (jeremyevans)
-
-* Make reset password request form available without requiring a login attempt, and provide a login field in that case (jeremyevans) (#30)
-
-* Make resending verify account email request form available without requiring a login/account creation attempt, and provide a login field in that case (jeremyevans) (#30)
-
-* Fix resending verify account email when attempting to create a new account with same login as unverified account when using verify_account_grace_period feature (jeremyevans) (#30)
-
-* Fix precompile_rodauth_templates usage with reset_password feature (jeremyevans)
-
-=== 1.9.0 (2017-02-22)
-
-* Make reset-password use existing password reset key if one is present (jeremyevans) (#26)
-
-* Add Roda.precompile_rodauth_templates method, useful to save memory when forking, or when chrooting (jeremyevans)
-
-=== 1.8.0 (2017-01-06)
-
-* Add json_response_custom_error_status? option to jwt feature to use specific 4xx statuses instead of 400 (jeremyevans)
-
-* Use 4xx error statuses for errors, instead of using a 200 success status (jeremyevans)
-
-=== 1.7.0 (2016-11-22)
-
-* Make reset password, unlock account, and verify account pages not leak keys to external servers via Referer header (jeremyevans)
-
-=== 1.6.0 (2016-10-24)
-
-* Add http_basic_auth feature (TiagoCardoso1983, jeremyevans) (#12)
-
-* Move login hooks from login feature to base, to be usable by other features (jeremyevans)
-
-* Make reset_password feature not attempt to render a template in json-only mode (jeremyevans) (#11)
-
-* Memoize jwt_payload in jwt feature, as it may be called more than once (mwpastore) (#10)
-
-* Add jwt_decode_opts configuration method to jwt feature, for specifying options to JWT.decode, allowing for JWT claim verification (mwpastore, jeremyevans) (#9)
-
-* Add jwt_session_hash configuration method to jwt feature, for modifying the session information stored in the JWT hash, allowing for setting JWT claims (mwpastore, jeremyevans) (#9)
-
-* Add jwt_session_key configuration method to jwt feature, for nesting the session under a key in the JWT, avoiding reserve claim names (mwpastore, jeremyevans) (#9)
-
-* Add jwt_symbolize_deeply? configuration method to jwt feature, for symbolizing nested keys in session hash when using JWT (mwpastore) (#9)
-
-=== 1.5.0 (2016-09-22)
-
-* Return error instead of raising exception in the jwt feature if an invalid jwt format is submitted in the Authorization header (jeremyevans)
-
-* Add jwt_authorization_remove configuration method to jwt feature, for regexp to remove from Authorization header before JWT processing (jeremyevans)
-
-* Add jwt_authorization_ignore configuration method to jwt feature, for regexp to skip processing of JWTs in Authorization header (jeremyevans)
-
-* Add json_accept_regexp configuration method to jwt feature, for the regexp used to match against the Accept header (jeremyevans)
-
-* Add use_jwt? configuration method to jwt feature, for whether to use the JWT token or rack session for authentication information (jeremyevans)
-
-* Add jwt_check_accept? configuration method to jwt feature, to return 406 error if Accept header is present and json is not accepted (jeremyevans)
-
-* Add json_response_content_type configuration method to jwt feature, for the content type to set for json responses, default to application/json (jeremyevans)
-
-* Add json_request_content_type_regexp configuration method to the jwt feature, for the regexp that recognize a request as a json request (jeremyevans)
-
-* Add session_jwt method to the jwt feature, which returns a string for the encoded JWT for the current session (jeremyevans)
-
-* If the only_json? setting is true, return a 400 error if the request content type to a rodauth endpoint is not json (jeremyevans)
-
-* The only_json? setting in the jwt feature is now only true by default if :json=>:only plugin option was used (jeremyevans)
-
-* Don't have jwt feature break if HTTP Basic/Digest authentication is used (jeremyevans)
-
-* Add template_opts configuration method, for overriding view/method options (jeremyevans)
-
-=== 1.4.0 (2016-08-18)
-
-* Add update_password_hash feature, for updating the password hash when the hash cost changes (jeremyevans)
-
-=== 1.3.0 (2016-07-19)
-
-* Add login_maximum_length, defaulting to 255 (jeremyevans)
-
-=== 1.2.0 (2016-06-15)
-
-* Add otp_drift configuration method to otp plugin, setting number of seconds of allowed drift (jeremyevans)
-
-* Don't allow setting passwords containing the ASCII NUL character, as bcrypt truncates at that point (jeremyevans) (#4)
-
-=== 1.1.0 (2016-05-13)
-
-* Support :csrf=>false and :flash=>false plugin options (jeremyevans)
-
-=== 1.0.0 (2016-04-15)
-
-* Remove invalid remember cookies to prevent unnecessary future database checks (jeremyevans)
-
-* Extend remember deadline in cookie in addition to database (jeremyevans)
-
-* Make tokens work with string account ids (jeremyevans)
-
-* Add verify_change_login feature for requiring account reverification on login changes (jeremyevans)
-
-* Set correct cookie expiration in the remember feature (jeremyevans)
-
-* Split confirm_password feature from remember feature (jeremyevans)
-
-* Add verify_account_grace_period feature, for allowing logins into unverified accounts for a certain period after creation (jeremyevans)
-
-* Move login/password requirements settings to login password requirements base feature (jeremyevans)
-
-* Add session_expiration feature, expiring sessions based on inactivity and max lifetime checks (jeremyevans)
-
-* Add password_grace_period feature, for not requiring password entry if password was recently entered (jeremyevans)
-
-* Make create/verify account autologin true by default (jeremyevans)
-
-* Optimize routing using a hash table, disallow per-request routes (jeremyevans)
-
-* Add ability to turn off login/password confirmations (jeremyevans)
-
-* Don't allow changing login to the same as the current login (jeremyevans)
-
-* Only allow requesting account unlocks if the account is current locked out (jeremyevans)
-
-* Use separate routes for unlock account/reset password/verify account requests (jeremyevans)
-
-* Use separate routes for confirming passwords and changing remember settings (jeremyevans)
-
-* Add JWT feature for JSON API support using JWT tokens (jeremyevans)
-
-* Add account_select configuration option for setting which columns to select from accounts_table (jeremyevans)
-
-* Execute get_block and post_block in the Rodauth::Auth instance scope (jeremyevans)
-
-* Store field errors in the rodauth object instead of instance variables in the Roda scope (jeremyevans)
-
-* Add rodauth.redirect to abstract redirection code (jeremyevans)
-
-* Only use flash notices for successful requests, other requests that redirect now use an error flash (jeremyevans)
-
-* The before_* configuration methods now run directly before making the related database changes (jeremyevans)
-
-* Before hooks run before routes now use before_*_route instead of before_* configuration methods (jeremyevans)
-
-* Add token_separator configuration method to replace the default of _ (jeremyevans)
-
-* Rename account_id_value to account_id (jeremyevans)
-
-* Rename account_id to account_id_column and account_session_id to account_session_column (jeremyevans)
-
-* Make skip_status_checks? default to true unless loading verify_account or close_account features (jeremyevans)
-
-* Replace account_model with accounts_table and db, removing use of Sequel models (jeremyevans)
-
-* Extract shared email-related code into email_base feature (jeremyevans)
-
-* Add auth_class_eval to configuration block for adding custom methods (jeremyevans)
-
-* Add configuration_eval to feature definitions for adding custom configuration methods (jeremyevans)
-
-* Allow close_account feature to optionally delete accounts (jeremyevans)
-
-* Make close_account feature work when skipping status checks or when using account_password_hash_column (jeremyevans)
-
-* Add sms_codes feature, for codes received via SMS that can be used if TOTP authentication is not available (jeremyevans)
-
-* Attempt to handle unique constraint violations raised in race conditions where possible (jeremyevans)
-
-* Add _before and _after internal methods, make ununderscored methods only for users (jeremyevans)
-
-* Add single_session feature, for only allowing a single active session per account (jeremyevans)
-
-* Add account_expiration feature, for disallowing access to accounts after an amount of time since last login/activity (jeremyevans)
-
-* Check account status in rodauth.load_memory in remember plugin (jeremyevans)
-
-* Use csrf plugin automatically, depend on Roda >=2.6.0 (jeremyevans)
-
-* Make bcrypt and mail development dependencies instead of runtime dependencies in the gem (jeremyevans)
-
-* Add password_expiration feature, requiring users to change their password after a given amount of time (jeremyevans)
-
-* Add disallow_password_reuse feature, checking that a new password doesn't match previous passwords (jeremyevans)
-
-* Add password_complexity feature, allowing more sophisticated password complexity checks (jeremyevans)
-
-* Add rodauth.remember_param and .remember_confirm_param for overriding parameter names (jeremyevans)
-
-* Check that new password is not the same as existing password in change password and reset password features (jeremyevans)
-
-* Add rodauth.login_meets_requirements? for checking if a login is valid, by default a valid email address (jeremyevans)
-
-* Allow unlock account to optionally require the user's current password (jeremyevans)
-
-* Add support for running on Microsoft SQL Server with database functions for authentication (jeremyevans)
-
-* Make change password, change login, and close account require the user's current password by default (jeremyevans)
-
-* Add rodauth.csrf_tag to make it easy to replace the CSRF tag implementation (jeremyevans)
-
-* Switch unlock_account_autologin? to be true by default (jeremyevans)
-
-* Add rodauth.authenticated? and .require_authentication (jeremyevans)
-
-* Add recovery_codes feature, for single use codes that can be used if TOTP authentication is not available (jeremyevans)
-
-* Add otp feature, for 2 factor authentication via TOTP (jeremyevans)
-
-* Add support for running on MySQL with database functions for authentication (jeremyevans)
-
-* Add *_interval and set_deadline_values? methods for setting deadline intervals on a per-request basis (jeremyevans)
-
-* Add remember_deadline_column method for overriding the column used for storing the deadline (jeremyevans)
-
-* Add rodauth/migrations file for DRYing up the database function creation (jeremyevans)
-
-* Add Rodauth.version for getting the version (jeremyevans)
-
-* External features should now be requirable via rodauth/features/feature_name instead of roda/plugins/rodauth/feature_name (jeremyevans)
-
-* Make Rodauth top level module instead of under Roda::RodaPlugins (jeremyevans)
-
-* Require mail at configure time instead of run time if using a feature that sends email, use require_mail? false to disable (jeremyevans)
-
-* Require bcrypt at configure time instead of run time, use require_bcrypt? false to disable (jeremyevans)
-
-* Always require securerandom (jeremyevans)
-
-* Make remember, password reset, and lockout features work on non-PostgreSQL databases (jeremyevans)
-
-* Support authentication without database functions when password hashes are stored in separate table (jeremyevans)
-
-* Remove overriding of route/get/post blocks (jeremyevans)
-
-* Make lockout feature work on databases not supporting UPDATE RETURNING (jeremyevans)
-
-* Add timing safe comparison of tokens (jeremyevans)
-
-=== 0.10.0 (2016-02-17)
-
-* Retrieve salt from database and compute hash client side, instead of computing hash on server (jeremyevans)
-
-=== 0.9.1 (2015-08-13)
-
-* Don't use csrf plugin automatically (jeremyevans)
-
-=== 0.9.0 (2015-08-12)
+=== Older
 
-* Initial public release
+See doc/CHANGELOG.old

data/README.rdoc

@@ -60,6 +60,7 @@ HTML and JSON API for all supported features.
 * Argon2
 * HTTP Basic Auth
 * Change Password Notify
+* Reset Password Notify
 * Internal Request
 * Path Class Methods
 
@@ -902,6 +903,7 @@ view the appropriate file in the doc directory.
 * {Recovery Codes}[rdoc-ref:doc/recovery_codes.rdoc]
 * {Remember}[rdoc-ref:doc/remember.rdoc]
 * {Reset Password}[rdoc-ref:doc/reset_password.rdoc]
+* {Reset Password Notify}[rdoc-ref:doc/reset_password_notify.rdoc]
 * {Session Expiration}[rdoc-ref:doc/session_expiration.rdoc]
 * {Single Session}[rdoc-ref:doc/single_session.rdoc]
 * {SMS Codes}[rdoc-ref:doc/sms_codes.rdoc]

data/doc/base.rdoc

@@ -99,6 +99,7 @@ csrf_tag(path=request.path) :: The HTML fragment containing the CSRF tag to use,
 function_name(name) :: The name of the database function to call.  It's passed either :rodauth_get_salt or :rodauth_valid_password_hash.
 logged_in? :: Whether the current session is logged in.
 login_required :: Action to take when a login is required to access the page and the user is not logged in.
+null_byte_parameter_value(key, value) :: The value to use for the parameter if the parameter includes an ASCII NUL byte ("\0"), nil by default to ignore the parameter.
 open_account? :: Whether the current account is an open account (not closed or unverified).
 password_match?(password) :: Check whether the given password matches the stored password hash.
 random_key :: A randomly generated string, used for creating tokens.

data/doc/guides/internals.rdoc

@@ -143,6 +143,17 @@ Here's a heavily commented example showing what is going on inside a Rodauth fea
       # templates.  This is necessary for precompilation of templates to work.
       loaded_templates ['foo']
 
+      # This defines the following methods related to sending email:
+      #
+      # * foo_email_subject: uses given subject
+      # * foo_email_body: renders foo-email template
+      # * create_foo_email: creates Mail::Message using subject and body
+      # * send_foo_email: sends created email
+      #
+      # The foo-email template should be included in the loaded_templates call to make sure
+      # template precompilation works.
+      email :foo, 'Foo Subject'
+
       # auth_value_method is a generic method that takes two arguments, a method to define
       # and a default value.  It is similar to the methods above, except that it allows
       # arbitrary method names.  The notice_flash, error_flash, button, and additional_form_tags

data/doc/guides/paths.rdoc

@@ -8,6 +8,9 @@ corresponding <tt>*_route</tt> method:
 
     # Change login route to "/signin"
     login_route "signin"
+    
+    # Change redirect when login is required to "/signin"
+    require_login_redirect { login_path }
 
     # Change create account route to "/register"
     create_account_route "register"

data/doc/login_password_requirements_base.rdoc

@@ -6,7 +6,7 @@ use a Rodauth feature that requires setting logins or passwords.
 == Auth Value Methods
 
 already_an_account_with_this_login_message :: The error message to display when there already exists an account with the same login.
-contains_null_byte_message :: The error message to display when the password contains a null byte.
+contains_null_byte_message :: The error message to display when the password contains a null byte (only used if parameters with null bytes are otherwise allowed).
 login_confirm_label :: The label to use for login confirmations.
 login_confirm_param :: The parameter name to use for login confirmations.
 login_does_not_meet_requirements_message :: The error message to display when the login does not meet the requirements you have set.

data/doc/release_notes/2.22.0.txt

@@ -0,0 +1,43 @@
+= New Features
+
+* Rodauth now ignores parameters containing ASCII NUL bytes ("\0") by
+  default.  You can customize this behavior using the
+  null_byte_parameter_value configuration method.
+
+* A reset_password_notify feature has been added for emailing users
+  after successful password resets.
+
+* External features can now use the email method inside their
+  feature definitions to DRY up the creation of email configuration
+  methods. The email method will setup the following configuration
+  methods for the feature:
+
+  * ${name}_email_subject
+  * ${name}_email_body
+  * create_${name}_email
+  * send_${name}_email
+
+= Other Improvements
+
+* The active_sessions feature now correctly handles logouts for
+  sessions that were created before the active_sessions feature was
+  added to the Rodauth configuration.
+
+* The change_password_notify feature now works correctly when using
+  template precompilation.
+
+* The update_sms method now updates the in-memory sms hash instead of
+  the in-memory account hash.  This only has an effect if you are
+  using the sms_codes feature and customizing Rodauth to access one
+  of these hashes after a call to update_sms.
+
+= Backwards Compatibility
+
+* If your application requires the ability to submit values containing
+  ASCII NUL bytes ("\0") as Rodauth parameters, you should use the
+  new null_byte_parameter_value configuration method to pass the
+  value through unchanged:
+
+    null_byte_parameter_value do |_, v|
+      v
+    end

data/doc/reset_password.rdoc

@@ -14,12 +14,12 @@ reset_password_autologin? :: Whether to autologin the user after successfully re
 reset_password_button :: The text to use for the reset password button.
 reset_password_deadline_column :: The column name in the +reset_password_table+ storing the deadline after which the token will be ignored.
 reset_password_deadline_interval :: The amount of time for which to allow users to reset their passwords, 1 day by default. Only used if +set_deadline_values?+ is true.
-reset_password_email_last_sent_column :: The email last sent column in the +reset_password_table+. Set to nil to always send a reset password email when requested.
-reset_password_email_recently_sent_error_flash :: The flash error to show if not sending reset password email because one has been sent recently.
-reset_password_email_recently_sent_redirect :: Where to redirect if not sending reset password email because one has been sent recently.
-reset_password_email_sent_notice_flash :: The flash notice to show after a reset password email has been sent.
-reset_password_email_sent_redirect :: Where to redirect after sending a reset password email.
-reset_password_email_subject :: The subject to use for reset password emails.
+reset_password_email_last_sent_column :: The email last sent column in the +reset_password_table+. Set to nil to always send a reset password request email when requested.
+reset_password_email_recently_sent_error_flash :: The flash error to show if not sending reset password request email because one has been sent recently.
+reset_password_email_recently_sent_redirect :: Where to redirect if not sending reset password request email because one has been sent recently.
+reset_password_email_sent_notice_flash :: The flash notice to show after a reset password request email has been sent.
+reset_password_email_sent_redirect :: Where to redirect after sending a reset password request email.
+reset_password_email_subject :: The subject to use for the reset password request email.
 reset_password_error_flash :: The flash error to show after resetting a password.
 reset_password_explanatory_text :: The text to display above the button to request a password reset.
 reset_password_id_column :: The id column in the +reset_password_table+, should be a foreign key referencing the accounts table.
@@ -30,35 +30,35 @@ reset_password_page_title :: The page title to use on the reset password form.
 reset_password_redirect :: Where to redirect after resetting a password.
 reset_password_request_additional_form_tags :: HTML fragment containing additional form tags to use on the reset password request form.
 reset_password_request_button :: The text to use for the reset password request button.
-reset_password_request_error_flash :: The flash error to show if not able to send a reset password email.
+reset_password_request_error_flash :: The flash error to show if not able to send a reset password request email.
 reset_password_request_link_text :: The text to use for a link to the page to request a password reset.
 reset_password_request_page_title :: The page title to use on the reset password request form.
 reset_password_request_route :: The route to the reset password request action.  Defaults to +reset-password-request+.
 reset_password_route :: The route to the reset password action. Defaults to +reset-password+.
 reset_password_session_key :: The key in the session to hold the reset password key temporarily.
-reset_password_skip_resend_email_within :: The number of seconds before sending another reset password email, if +reset_password_email_last_sent_column+ is set.
+reset_password_skip_resend_email_within :: The number of seconds before sending another reset password request email, if +reset_password_email_last_sent_column+ is set.
 reset_password_table :: The name of the reset password keys table.
 
 == Auth Methods
 
 account_from_reset_password_key(key) :: Retrieve the account using the given reset password key, or return nil if no account matches.
 after_reset_password :: Run arbitrary code after successfully resetting a password.
-after_reset_password_request :: Run arbitrary code after sending the reset password email.
+after_reset_password_request :: Run arbitrary code after sending the reset password request email.
 before_reset_password :: Run arbitrary code before resetting a password.
-before_reset_password_request :: Run arbitrary code before sending the reset password email.
+before_reset_password_request :: Run arbitrary code before sending the reset password request email.
 before_reset_password_request_route :: Run arbitrary code before handling a reset password request route.
 before_reset_password_route :: Run arbitrary code before handling a reset password route.
-create_reset_password_email :: A Mail::Message for the reset password email.
+create_reset_password_email :: A Mail::Message for the reset password request email.
 create_reset_password_key :: Add the reset password key data to the database.
-get_reset_password_email_last_sent :: Get the last time a reset password email is sent, or nil if there is no last sent time.
+get_reset_password_email_last_sent :: Get the last time a reset password request email is sent, or nil if there is no last sent time.
 get_reset_password_key(id) :: Get the password reset key for the given account id from the database.
 login_failed_reset_password_request_form :: The HTML to use for a form to request a password reset, shown on the login page after the user tries to login with an invalid password.
 remove_reset_password_key :: Remove the reset password key for the current account, run after successful password reset.
-reset_password_email_body :: The body to use for the reset password email.
-reset_password_email_link :: The link to the reset password form in the reset password email.
+reset_password_email_body :: The body to use for the reset password request email.
+reset_password_email_link :: The link to the reset password form in the reset password request email.
 reset_password_key_insert_hash :: The hash to insert into the +reset_password_table+.
 reset_password_key_value :: The reset password key for the current account.
 reset_password_request_view :: The HTML to use for the reset password request form.
 reset_password_view :: The HTML to use for the reset password form.
-send_reset_password_email :: Send the reset password email.
-set_reset_password_email_last_sent :: Set the last time a reset password email is sent.
+send_reset_password_email :: Send the reset password request email.
+set_reset_password_email_last_sent :: Set the last time a reset password request email is sent.

data/doc/reset_password_notify.rdoc

@@ -0,0 +1,17 @@
+= Documentation for Reset Password Notify Feature
+
+The reset password notify feature emails the user after the user has
+reset their password. The user has already been sent a reset password
+email by this point, so they know a password reset was requested, but
+this feature allows for confirming that the password reset process
+was completed. Depends on the reset_password feature.
+
+== Auth Value Methods
+
+reset_password_notify_email_subject :: The subject to use for the reset password notify email.
+reset_password_notify_email_body :: The body to use for the reset password notify email.
+
+== Auth Methods
+
+create_reset_password_notify_email :: A Mail::Message for the reset password notify email.
+send_reset_password_notify_email :: Send the reset password notify email.

data/lib/rodauth/features/active_sessions.rb

@@ -81,7 +81,9 @@ module Rodauth
     end
 
     def remove_current_session
-      active_sessions_ds.where(active_sessions_session_id_column=>compute_hmac(session[session_id_session_key])).delete
+      if session_id = session[session_id_session_key]
+        active_sessions_ds.where(active_sessions_session_id_column=>compute_hmac(session_id)).delete
+      end
     end
 
     def remove_all_active_sessions

data/lib/rodauth/features/base.rb

@@ -91,6 +91,7 @@ module Rodauth
       :inputmode_for_field?,
       :logged_in?,
       :login_required,
+      :null_byte_parameter_value,
       :open_account?,
       :password_match?,
       :random_key,
@@ -446,7 +447,16 @@ module Rodauth
     # parameter with that name.
     def param_or_nil(key)
       value = raw_param(key)
-      value.to_s unless value.nil?
+      unless value.nil?
+        value = value.to_s
+        value = null_byte_parameter_value(key, value) if value.include?("\0")
+      end
+      value
+    end
+
+    # Return nil by default for values with null bytes
+    def null_byte_parameter_value(key, value)
+      nil
     end
 
     def raw_param(key)
@@ -756,7 +766,7 @@ module Rodauth
       num = ds.update(values)
       if num == 1
         values.each do |k, v|
-          account[k] = Sequel::CURRENT_TIMESTAMP == v ? Time.now : v
+          hash[k] = Sequel::CURRENT_TIMESTAMP == v ? Time.now : v
         end
       end
       num

data/lib/rodauth/features/change_password_notify.rb

@@ -3,31 +3,11 @@
 module Rodauth
   Feature.define(:change_password_notify, :ChangePasswordNotify) do
     depends :change_password, :email_base
-
-    translatable_method :password_changed_email_subject, 'Password Changed'
-
-    auth_value_methods(
-      :password_changed_email_body
-    )
-    auth_methods(
-      :create_password_changed_email,
-      :send_password_changed_email
-    )
+    loaded_templates %w'password-changed-email'
+    email :password_changed, 'Password Changed', :translatable=>true
 
     private
 
-    def send_password_changed_email
-      send_email(create_password_changed_email)
-    end
-
-    def create_password_changed_email
-      create_email(password_changed_email_subject, password_changed_email_body)
-    end
-
-    def password_changed_email_body
-      render('password-changed-email')
-    end
-
     def after_change_password
       super
       send_password_changed_email

data/lib/rodauth/features/email_auth.rb

@@ -19,10 +19,10 @@ module Rodauth
     button 'Send Login Link Via Email', 'email_auth_request'
     redirect(:email_auth_email_sent){default_post_email_redirect}
     redirect(:email_auth_email_recently_sent){default_post_email_redirect}
+    email :email_auth, 'Login Link'
     
     auth_value_method :email_auth_deadline_column, :deadline
     auth_value_method :email_auth_deadline_interval, {:days=>1}.freeze
-    translatable_method :email_auth_email_subject, 'Login Link'
     auth_value_method :email_auth_id_column, :id
     auth_value_method :email_auth_key_column, :key
     auth_value_method :email_auth_key_param, 'key'
@@ -33,9 +33,7 @@ module Rodauth
     session_key :email_auth_session_key, :email_auth_key
     
     auth_methods(
-      :create_email_auth_email,
       :create_email_auth_key,
-      :email_auth_email_body,
       :email_auth_email_link,
       :email_auth_key_insert_hash,
       :email_auth_key_value,
@@ -43,7 +41,6 @@ module Rodauth
       :get_email_auth_key,
       :get_email_auth_email_last_sent,
       :remove_email_auth_key,
-      :send_email_auth_email,
       :set_email_auth_email_last_sent
     )
 
@@ -137,10 +134,6 @@ module Rodauth
       @account = _account_from_email_auth_key(key)
     end
 
-    def send_email_auth_email
-      send_email(create_email_auth_email)
-    end
-
     def email_auth_email_link
       token_link(email_auth_route, email_auth_key_param, email_auth_key_value)
     end
@@ -233,14 +226,6 @@ module Rodauth
       @email_auth_key_value = random_key
     end
 
-    def create_email_auth_email
-      create_email(email_auth_email_subject, email_auth_email_body)
-    end
-
-    def email_auth_email_body
-      render('email-auth-email')
-    end
-
     def use_date_arithmetic?
       super || db.database_type == :mysql
     end

data/lib/rodauth/features/lockout.rb

@@ -25,6 +25,7 @@ module Rodauth
     redirect :unlock_account
     redirect(:unlock_account_request){default_post_email_redirect}
     redirect(:unlock_account_email_recently_sent){default_post_email_redirect}
+    email :unlock_account, 'Unlock Account'
       
     auth_value_method :unlock_account_autologin?, true
     auth_value_method :max_invalid_logins, 100
@@ -37,7 +38,6 @@ module Rodauth
     auth_value_method :account_lockouts_email_last_sent_column, :email_last_sent
     auth_value_method :account_lockouts_deadline_column, :deadline
     auth_value_method :account_lockouts_deadline_interval, {:days=>1}.freeze
-    translatable_method :unlock_account_email_subject, 'Unlock Account'
     translatable_method :unlock_account_explanatory_text, '<p>This account is currently locked out.  You can unlock the account:</p>'
     translatable_method :unlock_account_request_explanatory_text, '<p>This account is currently locked out.  You can request that the account be unlocked:</p>'
     auth_value_method :unlock_account_key_param, 'key'
@@ -47,15 +47,12 @@ module Rodauth
 
     auth_methods(
       :clear_invalid_login_attempts,
-      :create_unlock_account_email,
       :generate_unlock_account_key,
       :get_unlock_account_key,
       :get_unlock_account_email_last_sent,
       :invalid_login_attempted,
       :locked_out?,
-      :send_unlock_account_email,
       :set_unlock_account_email_last_sent,
-      :unlock_account_email_body,
       :unlock_account_email_link,
       :unlock_account,
       :unlock_account_key
@@ -226,10 +223,6 @@ module Rodauth
       @account = _account_from_unlock_key(key)
     end
 
-    def send_unlock_account_email
-      send_email(create_unlock_account_email)
-    end
-
     def unlock_account_email_link
       token_link(unlock_account_route, unlock_account_key_param, unlock_account_key_value)
     end
@@ -288,14 +281,6 @@ module Rodauth
       request.halt
     end
 
-    def create_unlock_account_email
-      create_email(unlock_account_email_subject, unlock_account_email_body)
-    end
-
-    def unlock_account_email_body
-      render('unlock-account-email')
-    end
-
     def unlock_account_email_recently_sent?
       (email_last_sent = get_unlock_account_email_last_sent) && (Time.now - email_last_sent < unlock_account_skip_resend_email_within)
     end

data/lib/rodauth/features/reset_password.rb

@@ -24,10 +24,10 @@ module Rodauth
     redirect
     redirect(:reset_password_email_sent){default_post_email_redirect}
     redirect(:reset_password_email_recently_sent){default_post_email_redirect}
+    email :reset_password, 'Reset Password'
     
     auth_value_method :reset_password_deadline_column, :deadline
     auth_value_method :reset_password_deadline_interval, {:days=>1}.freeze
-    translatable_method :reset_password_email_subject, 'Reset Password'
     auth_value_method :reset_password_key_param, 'key'
     auth_value_method :reset_password_autologin?, false
     auth_value_method :reset_password_table, :account_password_reset_keys
@@ -41,16 +41,13 @@ module Rodauth
 
     auth_methods(
       :create_reset_password_key,
-      :create_reset_password_email,
       :get_reset_password_key,
       :get_reset_password_email_last_sent,
       :login_failed_reset_password_request_form,
       :remove_reset_password_key,
-      :reset_password_email_body,
       :reset_password_email_link,
       :reset_password_key_insert_hash,
       :reset_password_key_value,
-      :send_reset_password_email,
       :set_reset_password_email_last_sent
     )
     auth_private_methods(
@@ -187,10 +184,6 @@ module Rodauth
       @account = _account_from_reset_password_key(key)
     end
 
-    def send_reset_password_email
-      send_email(create_reset_password_email)
-    end
-
     def reset_password_email_link
       token_link(reset_password_route, reset_password_key_param, reset_password_key_value)
     end
@@ -241,18 +234,10 @@ module Rodauth
       @reset_password_key_value = random_key
     end
 
-    def create_reset_password_email
-      create_email(reset_password_email_subject, reset_password_email_body)
-    end
-
     def login_failed_reset_password_request_form
       render("reset-password-request")
     end
 
-    def reset_password_email_body
-      render('reset-password-email')
-    end
-
     def use_date_arithmetic?
       super || db.database_type == :mysql
     end

data/lib/rodauth/features/reset_password_notify.rb

@@ -0,0 +1,16 @@
+# frozen-string-literal: true
+
+module Rodauth
+  Feature.define(:reset_password_notify, :ResetPasswordNotify) do
+    depends :reset_password
+    loaded_templates %w'reset-password-notify-email'
+    email :reset_password_notify, 'Password Reset Completed', :translatable=>true
+
+    private
+
+    def after_reset_password
+      super
+      send_reset_password_notify_email
+    end
+  end
+end

data/lib/rodauth/features/verify_account.rb

@@ -26,8 +26,8 @@ module Rodauth
     redirect
     redirect(:verify_account_email_sent){default_post_email_redirect}
     redirect(:verify_account_email_recently_sent){default_post_email_redirect}
+    email :verify_account, 'Verify Account'
 
-    translatable_method :verify_account_email_subject, 'Verify Account'
     auth_value_method :verify_account_key_param, 'key'
     auth_value_method :verify_account_autologin?, true
     auth_value_method :verify_account_table, :account_verification_keys
@@ -43,14 +43,11 @@ module Rodauth
     auth_methods(
       :allow_resending_verify_account_email?,
       :create_verify_account_key,
-      :create_verify_account_email,
       :get_verify_account_key,
       :get_verify_account_email_last_sent,
       :remove_verify_account_key,
-      :send_verify_account_email,
       :set_verify_account_email_last_sent,
       :verify_account,
-      :verify_account_email_body,
       :verify_account_email_link,
       :verify_account_key_insert_hash,
       :verify_account_key_value
@@ -212,10 +209,6 @@ module Rodauth
       account_unverified_status_value
     end
 
-    def send_verify_account_email
-      send_email(create_verify_account_email)
-    end
-
     def verify_account_email_link
       token_link(verify_account_route, verify_account_key_param, verify_account_key_value)
     end
@@ -311,14 +304,6 @@ module Rodauth
       {verify_account_id_column=>account_id, verify_account_key_column=>verify_account_key_value}
     end
 
-    def create_verify_account_email
-      create_email(verify_account_email_subject, verify_account_email_body)
-    end
-
-    def verify_account_email_body
-      render('verify-account-email')
-    end
-
     def verify_account_ds(id=account_id)
       db[verify_account_table].where(verify_account_id_column=>id)
     end

data/lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 21
+  MINOR = 22
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.

data/lib/rodauth.rb

@@ -233,6 +233,33 @@ module Rodauth
       end
     end
 
+    def email(type, subject, opts = {})
+      subject_method = :"#{type}_email_subject"
+      body_method = :"#{type}_email_body"
+      create_method = :"create_#{type}_email"
+      send_method = :"send_#{type}_email"
+
+      translatable_method subject_method, subject
+      auth_methods create_method, send_method
+
+      body_template = "#{type.to_s.tr('_', '-')}-email"
+      if opts[:translatable]
+        auth_value_methods body_method
+        define_method(body_method){translate(body_method, render(body_template))}
+      else
+        auth_methods body_method
+        define_method(body_method){render(body_template)}
+      end
+
+      define_method(create_method) do
+        create_email(send(subject_method), send(body_method))
+      end
+
+      define_method(send_method) do
+        send_email(send(create_method))
+      end
+    end
+
     def additional_form_tags(name=feature_name)
       auth_value_method(:"#{name}_additional_form_tags", nil)
     end

data/templates/reset-password-notify-email.str

@@ -0,0 +1,2 @@
+Someone (hopefully you) has reset the password for the account
+associated to this email address.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth
 version: !ruby/object:Gem::Version
-  version: 2.21.0
+  version: 2.22.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-23 00:00:00.000000000 Z
+date: 2022-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sequel
@@ -286,6 +286,7 @@ extra_rdoc_files:
 - doc/recovery_codes.rdoc
 - doc/remember.rdoc
 - doc/reset_password.rdoc
+- doc/reset_password_notify.rdoc
 - doc/session_expiration.rdoc
 - doc/single_session.rdoc
 - doc/sms_codes.rdoc
@@ -336,6 +337,7 @@ extra_rdoc_files:
 - doc/release_notes/2.2.0.txt
 - doc/release_notes/2.20.0.txt
 - doc/release_notes/2.21.0.txt
+- doc/release_notes/2.22.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -444,6 +446,7 @@ files:
 - doc/release_notes/2.2.0.txt
 - doc/release_notes/2.20.0.txt
 - doc/release_notes/2.21.0.txt
+- doc/release_notes/2.22.0.txt
 - doc/release_notes/2.3.0.txt
 - doc/release_notes/2.4.0.txt
 - doc/release_notes/2.5.0.txt
@@ -453,6 +456,7 @@ files:
 - doc/release_notes/2.9.0.txt
 - doc/remember.rdoc
 - doc/reset_password.rdoc
+- doc/reset_password_notify.rdoc
 - doc/session_expiration.rdoc
 - doc/single_session.rdoc
 - doc/sms_codes.rdoc
@@ -502,6 +506,7 @@ files:
 - lib/rodauth/features/recovery_codes.rb
 - lib/rodauth/features/remember.rb
 - lib/rodauth/features/reset_password.rb
+- lib/rodauth/features/reset_password_notify.rb
 - lib/rodauth/features/session_expiration.rb
 - lib/rodauth/features/single_session.rb
 - lib/rodauth/features/sms_codes.rb
@@ -545,6 +550,7 @@ files:
 - templates/recovery-codes.str
 - templates/remember.str
 - templates/reset-password-email.str
+- templates/reset-password-notify-email.str
 - templates/reset-password-request.str
 - templates/reset-password.str
 - templates/sms-auth.str