rucaptcha 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0b8fc53f553af82a9e3c1ea5ff203058d1c94220
-  data.tar.gz: 675808db49191ce5c2396fa390fd764084557de6
+  metadata.gz: 4eeac0b904fbb23ad981f2a15be405045dd3ab36
+  data.tar.gz: 509df17c96e7b4c5e9a16d780a0140a57496c342
 SHA512:
-  metadata.gz: 579416c175a280721232673ac4cc619fa76c9dd77b39d39cf4e0c203f31866b8476afe5ab00e3e53d711b0195b0c7e2080b77b6051aaa8bddb1efd5708a5080d
-  data.tar.gz: 5c8f783af7b9ef4909bf5fab282e35727d2c879c48021a2d5ec7cf3cae5bfd67edc1e72dc619f8f61cfbf24c0e6487aedb6157a3f88286f9586039ec2cfa3730
+  metadata.gz: ee75335b1a9494f3180976808f7f6bf15722c4d3fac3bf1ccccc58f519f81fac797cc3460a034ae58dc8c0dd5a825a4b86346c1f1802407a031ecd6187d201f4
+  data.tar.gz: 01dc3cf718968f2823f168f368bff69e2df8c056d5de7d285de44bd7284f449d191c98582425c9e550d8837cc3b58b53b9e1b7a6dc088659b65c1a1f8883c36e

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+1.0.1
+-----
+
+## Security Notes
+
+- Fix Session replay secure issue that when Rails application use CookieStore.
+
 1.0.0
 -----
 

data/README.md

@@ -34,7 +34,7 @@ Idea by: https://ruby-china.org/topics/20558#reply4
 #### Ubuntu
 
 ```
-sudo apt-get install imagemagick
+sudo apt-get install imagemagick ghostscript
 ```
 
 #### Mac OS X

data/lib/rucaptcha/configuration.rb

@@ -11,7 +11,7 @@ module RuCaptcha
     attr_accessor :cache_limit
     # Color style, default: :colorful, allows: [:colorful, :black_white]
     attr_accessor :style
-    # session[:_rucaptcha] expire time, default 2 minutes
+    # rucaptcha expire time, default 2 minutes
     attr_accessor :expires_in
   end
 end

data/lib/rucaptcha/controller_helpers.rb

@@ -6,28 +6,55 @@ module RuCaptcha
       helper_method :verify_rucaptcha?
     end
 
+    def rucaptcha_sesion_key_key
+      ['rucaptcha-session', session.id].join(':')
+    end
+
     def generate_rucaptcha
-      session[:_rucaptcha]    = RuCaptcha::Captcha.random_chars
-      session[:_rucaptcha_at] = Time.now.to_i
+      code = RuCaptcha::Captcha.random_chars
+      Rails.cache.write(rucaptcha_sesion_key_key, {
+        code: code,
+        time: Time.now.to_i
+      })
 
-      RuCaptcha::Captcha.create(session[:_rucaptcha])
+      RuCaptcha::Captcha.create(code)
     end
 
     def verify_rucaptcha?(resource = nil)
-      rucaptcha_at = session[:_rucaptcha_at].to_i
-      captcha = (params[:_rucaptcha] || '').downcase.strip
+      store_info = Rails.cache.read(rucaptcha_sesion_key_key)
+      # make sure move used key
+      Rails.cache.delete(rucaptcha_sesion_key_key)
+
+      # Make sure session exist
+      if store_info.blank?
+        return add_rucaptcha_validation_error
+      end
+
+      # Make sure not expire
+      if (Time.now.to_i - store_info[:time]) > RuCaptcha.config.expires_in
+        return add_rucaptcha_validation_error
+      end
 
-      # Captcha chars in Session expire in 2 minutes
-      valid = false
-      if (Time.now.to_i - rucaptcha_at) <= RuCaptcha.config.expires_in
-        valid = captcha.present? && captcha == session.delete(:_rucaptcha)
+      # Make sure parama have captcha
+      captcha = (params[:_rucaptcha] || '').downcase.strip
+      if captcha.blank?
+        return add_rucaptcha_validation_error
       end
 
-      if resource && resource.respond_to?(:errors)
-        resource.errors.add(:base, t('rucaptcha.invalid')) unless valid
+      if captcha != store_info[:code]
+        return add_rucaptcha_validation_error
       end
 
-      valid
+      true
+    end
+
+    private
+
+    def add_rucaptcha_validation_error
+      if defined?(resource) && resource && resource.respond_to?(:errors)
+        resource.errors.add(:base, t('rucaptcha.invalid'))
+      end
+      false
     end
   end
 end

data/lib/rucaptcha/version.rb

@@ -1,3 +1,3 @@
 module RuCaptcha
-  VERSION = '1.0.0'
+  VERSION = '1.0.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rucaptcha
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Jason Lee
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-09-01 00:00:00.000000000 Z
+date: 2016-10-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties