standard_id 0.58.0 → 0.58.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +10 -0
- data/app/views/standard_id/web/auth/callback/providers/mobile_callback.html.erb +1 -1
- data/app/views/standard_id/web/login/show.html.erb +1 -1
- data/app/views/standard_id/web/login_verify/show.html.erb +1 -1
- data/lib/standard_id/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: a54cd12c3c45d8f8dac8a342250327c073ba479ba7fa4568483bf8a9d06fb22e
|
|
4
|
+
data.tar.gz: 8886b09be9316a38f55d2d5a16680457bd6c579b5dbf660137a4b457645bc30b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: f2cdd0a002610a2891adf548dde939b392d83f9848b14106458ecd61757f06c0eba90e8c00a5a5bc1846f602430f698ef5352af3caf9b928532c775a22c43e0f
|
|
7
|
+
data.tar.gz: 9fae127fd3c4a0defbfe189437f38327c6b870e987e4f32d46343b5e263cd64e8895111aeed61d264890309d5b8464d72e7c7de4db18b7f2c006f2008464cd4d
|
data/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [0.58.1] - 2026-10-30
|
|
11
|
+
|
|
12
|
+
### Fixed
|
|
13
|
+
|
|
14
|
+
- **Inline scripts in the engine's web views now carry the CSP nonce.** The mobile callback
|
|
15
|
+
bounce, the login page and the login-verify page each ran an un-nonced inline `<script>`, which a
|
|
16
|
+
host enforcing a nonce-based `script-src` (no `'unsafe-inline'`) blocks. On the mobile callback
|
|
17
|
+
that strands the user on "Returning to your app…" instead of returning them to the app. Hosts
|
|
18
|
+
without a nonce generator render an empty `nonce` attribute, which changes nothing.
|
|
19
|
+
|
|
10
20
|
## [0.58.0] - 2026-10-28
|
|
11
21
|
|
|
12
22
|
### Security
|
|
@@ -32,7 +32,7 @@
|
|
|
32
32
|
color: #555;
|
|
33
33
|
}
|
|
34
34
|
</style>
|
|
35
|
-
<script>
|
|
35
|
+
<script nonce="<%= content_security_policy_nonce %>">
|
|
36
36
|
document.addEventListener("DOMContentLoaded", function () {
|
|
37
37
|
<%# to_json, not j(): ERB HTML-escapes the j() output, so every "&" in the
|
|
38
38
|
query became "&" and each key after the first arrived as "amp;<key>".
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
(non-AJAX) submit by then, so the request still goes through. Vanilla JS
|
|
39
39
|
only; the gem ships no JS framework.
|
|
40
40
|
%>
|
|
41
|
-
<script>
|
|
41
|
+
<script nonce="<%= content_security_policy_nonce %>">
|
|
42
42
|
(function () {
|
|
43
43
|
var form = document.getElementById("passwordless-login-form");
|
|
44
44
|
if (!form) return;
|
|
@@ -56,7 +56,7 @@
|
|
|
56
56
|
Client-side resend cooldown. Progressive enhancement: with JS off the button is
|
|
57
57
|
always active and the server's retry_delay guard is the backstop. Vanilla JS only.
|
|
58
58
|
%>
|
|
59
|
-
<script>
|
|
59
|
+
<script nonce="<%= content_security_policy_nonce %>">
|
|
60
60
|
(function () {
|
|
61
61
|
var btn = document.getElementById("resend-otp-button");
|
|
62
62
|
if (!btn) return;
|
data/lib/standard_id/version.rb
CHANGED