ucb_rails_user 8.0.0 → 8.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3a52f47b67f3941ef82192caf5fd352e71e9d85074d366da8a6a44897fbafd82
-  data.tar.gz: 64fa7bda12ce85ba806ebc4000131d700a8317ef5d95e2f49079f099d1f33ea9
+  metadata.gz: '09287b7395b9051f836da163e113b19e79b97f2ca1a4244ac647fb01de4ef398'
+  data.tar.gz: 91ed2a6b9f2d2aa7a1a8d41c16bca50d179e17eeaec497fce684d606eef3d9ce
 SHA512:
-  metadata.gz: 4c0288fd05fee9438c59fd518bbb143721b43c8109aec25248ba162f8a8e3ce2abd70ab96b228caa37dbdc111288d9be1c3ccb804deb191afce17e683bb07de3
-  data.tar.gz: ee2fb735c92576d9cd596721ed3c6f3d4f30e2899725ce522c99121c3c05d3e77385d4b32b1c2aef80a13d27a5901ec3192de3b6990e751c4f7d77d4f09ed5c3
+  metadata.gz: 14686fd6c41309f33ae5d16d427c7d6270f6a0f1601d2f2ded8d22562c4cfd124e92f2ca3e3d59a5079309cc1413514c1448c1ce6583b3c51e005c02d5799cb7
+  data.tar.gz: 5273939befe8db63989e4e4f6940ec23e93f9cecaf1a7aeb20c7acbcad60cd415154b0e4b87b25391bb7dc3a05f3e80c04759d64e7fcc5ce335d6e17a0bc9ff1

data/app/controllers/concerns/ucb_rails_user/sessions_controller_concerns.rb

@@ -5,12 +5,12 @@ module UcbRailsUser::SessionsControllerConcerns
     skip_before_action :ensure_authenticated_user, :log_request, raise: false
   end
 
-  # Redirects to authentication provider
+  # Renders login form for authentication provider
   #
   # @return [nil]
   def new
-    provider = UcbRailsUser[:omniauth_provider] || :cas
-    redirect_to "/auth/#{provider}"
+    @provider = UcbRailsUser[:omniauth_provider] || :cas
+    render 'ucb_rails_user/sessions/new'
   end
 
   # Login user after authentication by provider
@@ -42,7 +42,7 @@ module UcbRailsUser::SessionsControllerConcerns
   #
   # @return [nil]
   def not_authorized
-    render(:text => "Not Authorized", :status => 401)
+    render(plain: "Not Authorized", status: 401)
   end
 
   # Handler for authentication failure.
@@ -50,7 +50,7 @@ module UcbRailsUser::SessionsControllerConcerns
   # @return [nil]
   def failure
     Rails.logger.debug("Authentication Failed for: #{request.env['omniauth.auth']}")
-    render(:text => "Not Authorized", :status => 401)
+    render(plain: "Not Authorized", status: 401)
   end
 
   private

data/app/views/ucb_rails_user/sessions/new.html.erb

@@ -0,0 +1,21 @@
+<div style="display: flex; justify-content: center; align-items: center; min-height: 100vh; background-color: #f5f5f5;">
+  <div style="background: white; padding: 2rem; border-radius: 8px; box-shadow: 0 2px 10px rgba(0,0,0,0.1); text-align: center; max-width: 400px; width: 100%;">
+    <h1 style="margin-bottom: 1.5rem; color: #333;">Sign In Required</h1>
+    
+    <p style="margin-bottom: 2rem; color: #666;">Please sign in to continue</p>
+    
+    <%= button_to "/auth/#{@provider}", 
+                  method: :post,
+                  data: { turbo: false },
+                  style: "background-color: #003262; color: white; padding: 12px 24px; font-size: 16px; border: none; border-radius: 4px; cursor: pointer; width: 100%; font-weight: 500;" do %>
+      Sign in with CalNet
+    <% end %>
+    
+    <% if Rails.env.development? %>
+      <p style="margin-top: 2rem; font-size: 12px; color: #999;">
+        Environment: Development<br>
+        Provider: <%= @provider %>
+      </p>
+    <% end %>
+  </div>
+</div>

data/config/routes.rb

@@ -5,8 +5,8 @@ Rails.application.routes.draw do
   match "/logout", to: UcbRailsUser::SessionsController.action(:destroy),
     as: "logout", via: [:all]
   match "/auth/:omniauth_provider/callback", to: UcbRailsUser::SessionsController.action(:create),
-    via: [:get]
-  match "/auth/failure", to: UcbRailsUser::SessionsController.action(:failure), via: [:get]
+    via: [:get, :post]
+  match "/auth/failure", to: UcbRailsUser::SessionsController.action(:failure), via: [:get, :post]
   match "/not_authorized", to: UcbRailsUser::SessionsController.action(:not_authorized),
     as: "not_authorized", via: [:get]
 

data/lib/ucb_rails_user/configuration/cas.rb

@@ -15,6 +15,15 @@ module UcbRailsUser
 
       def configure_omniauth
         host_name = host
+        
+        # Configure OmniAuth to only accept POST requests for security (CVE-2015-9284)
+        OmniAuth.config.allowed_request_methods = [:post]
+        OmniAuth.config.silence_get_warning = true
+        
+        # Disable CSRF protection for OmniAuth - we handle security through POST-only
+        # This is safe because we're only allowing POST requests and CAS provides its own security
+        OmniAuth.config.request_validation_phase = nil
+        
         Rails.application.config.middleware.use OmniAuth::Builder do
 
           unless Rails.env.production?

data/lib/ucb_rails_user/spec_helpers.rb

@@ -13,6 +13,7 @@ module UcbRailsUser
       OmniAuth.config.test_mode = true
       auth_mock(user.ldap_uid)
       visit login_path()
+      click_on "Sign in with CalNet"
     end
 
     def auth_mock(uid)

data/lib/ucb_rails_user/version.rb

@@ -1,3 +1,3 @@
 module UcbRailsUser
-  VERSION = '8.0.0'
+  VERSION = '8.1.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ucb_rails_user
 version: !ruby/object:Gem::Version
-  version: 8.0.0
+  version: 8.1.0
 platform: ruby
 authors:
 - Steve Downey
@@ -13,7 +13,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-04 00:00:00.000000000 Z
+date: 2025-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -146,7 +146,7 @@ dependencies:
         version: '1.8'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -156,21 +156,21 @@ dependencies:
         version: '1.8'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: omniauth-cas
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: ucb_ldap
   requirement: !ruby/object:Gem::Requirement
@@ -189,16 +189,16 @@ dependencies:
   name: faraday
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.12.1
+        version: '2.12'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.12.1
+        version: '2.12'
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement
@@ -390,6 +390,7 @@ files:
 - app/views/ucb_rails_user/lps/_modal.html.erb
 - app/views/ucb_rails_user/lps/_results.html.erb
 - app/views/ucb_rails_user/lps/search.js.erb
+- app/views/ucb_rails_user/sessions/new.html.erb
 - app/views/ucb_rails_user/users/_form.html.erb
 - app/views/ucb_rails_user/users/_search_results.html.erb
 - app/views/ucb_rails_user/users/_user.html.erb