Merge pull request #5043 from maestrano/increment-failed-attempts-concurency

Backport CVE-2019-5421 fix to 3.x
Make #increment_failed_attempts concurrency safe
2026-01-11 00:27:55 -05:00 · 2019-03-26 11:33:35 -03:00 · 2019-03-15 09:54:25 +11:00 · 2018-01-09 13:07:35 -05:00 · 2017-12-28 10:56:17 -08:00 · 2016-05-17 10:06:18 -03:00
22 changed files with 507 additions and 246 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,15 +1,37 @@
-### 3.5.6 - 2016-01-02
+### 3.5.10 - 2016-05-15
+
+* bug fixes
+  * Fix overwriting the remember_token when a valid one already exists (by @ralinchimev).
+
+### 3.5.9 - 2016-05-02
+
+* bug fixes
+  * Fix strategy checking in `Lockable#unlock_strategy_enabled?` for `:none`
+  and `:undefined` strategies. (by @f3ndot)
+
+### 3.5.8 - 2016-04-25
+
+* bug fixes
+  * Fix the e-mail confirmation instructions send when a user updates the email address from nil
+
+### 3.5.7 - 2016-04-18
+
+* bug fixes
+  * Fix the `extend_remember_period` configuration. When set to `false` it does
+    not update the cookie expiration anymore.(by @ulissesalmeida)
+
+### 3.5.6 - 2016-02-01

 * bug fixes
  * Fix type coercion of the rememberable timestamp stored on cookies.

-### 3.5.5 - 2016-22-01
+### 3.5.5 - 2016-01-22

 * bug fixes
  * Bring back remember_expired? implementation
  * Ensure timeouts are not triggered if remember me is being used

-### 3.5.4 - 2016-18-01
+### 3.5.4 - 2016-01-18

 * bug fixes
  * Store creation timestamps on remember cookies
--- a/1
+++ b/1
@@ -6,6 +6,7 @@ gem "rails", "4.2.2"
 gem "omniauth", "~> 1.2.0"
 gem "omniauth-oauth2", "~> 1.1.0"
 gem "rdoc"
+gem "mime-types", "~> 2.99"

 group :test do
  gem "omniauth-facebook"
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 PATH
  remote: .
  specs:
-    devise (3.5.6)
+    devise (3.5.10)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 3.2.6, < 5)
@@ -47,28 +47,29 @@ GEM
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    arel (6.0.0)
-    bcrypt (3.1.10)
-    bson (3.1.2)
+    arel (6.0.3)
+    bcrypt (3.1.11)
+    bson (3.2.6)
    builder (3.2.2)
+    concurrent-ruby (1.0.1)
    connection_pool (2.2.0)
    erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    globalid (0.3.5)
+    globalid (0.3.6)
      activesupport (>= 4.1.0)
-    hashie (3.4.0)
+    hashie (3.4.3)
    i18n (0.7.0)
    json (1.8.3)
-    jwt (1.4.1)
-    loofah (2.0.2)
+    jwt (1.5.4)
+    loofah (2.0.3)
      nokogiri (>= 1.5.9)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
    metaclass (0.0.4)
-    mime-types (2.6.1)
-    mini_portile (0.6.2)
-    minitest (5.7.0)
+    mime-types (2.99.1)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -76,15 +77,15 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.6)
+    moped (2.0.7)
      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.1)
+    multi_json (1.11.3)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
    oauth2 (0.9.4)
      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
@@ -105,9 +106,9 @@ GEM
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.1.1)
+    origin (2.2.0)
    orm_adapter (0.5.0)
-    rack (1.6.2)
+    rack (1.6.4)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
@@ -126,29 +127,31 @@ GEM
      sprockets-rails
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.6)
+    rails-dom-testing (1.0.7)
      activesupport (>= 4.2.0.beta, < 5.0)
      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.2)
+    rails-html-sanitizer (1.0.3)
      loofah (~> 2.0)
    railties (4.2.2)
      actionpack (= 4.2.2)
      activesupport (= 4.2.2)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    responders (2.1.1)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    responders (2.2.0)
      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (3.2.0)
-      rack (~> 1.0)
-    sprockets-rails (2.3.1)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sprockets (3.6.0)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.0.4)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
    tzinfo (1.2.2)
@@ -168,6 +171,7 @@ DEPENDENCIES
  activerecord-jdbcsqlite3-adapter
  devise!
  jruby-openssl
+  mime-types (~> 2.99)
  mocha (~> 1.1)
  mongoid (~> 4.0)
  omniauth (~> 1.2.0)
@@ -180,4 +184,4 @@ DEPENDENCIES
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.11.2
+   1.12.3
--- a/app/controllers/devise/sessions_controller.rb
+++ b/app/controllers/devise/sessions_controller.rb
@@ -2,7 +2,7 @@ class Devise::SessionsController < DeviseController
  prepend_before_filter :require_no_authentication, only: [:new, :create]
  prepend_before_filter :allow_params_authentication!, only: :create
  prepend_before_filter :verify_signed_out_user, only: :destroy
-  prepend_before_filter only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }
+  prepend_before_filter(only: [:create, :destroy]) { request.env["devise.skip_timeout"] = true }

  # GET /resource/sign_in
  def new
--- a/gemfiles/Gemfile.rails-3.2-stable.lock
+++ b/gemfiles/Gemfile.rails-3.2-stable.lock
@@ -1,14 +1,14 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: b344986bc3d94ca7821fc5e0eef1874882ac6cbb
+  revision: f85bbed4cdc1bdfd1e0dbd97bce9db81e44cbd11
  branch: 3-2-stable
  specs:
-    actionmailer (3.2.21)
-      actionpack (= 3.2.21)
+    actionmailer (3.2.22.2)
+      actionpack (= 3.2.22.2)
      mail (~> 2.5.4)
-    actionpack (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
+    actionpack (3.2.22.2)
+      activemodel (= 3.2.22.2)
+      activesupport (= 3.2.22.2)
      builder (~> 3.0.0)
      erubis (~> 2.7.0)
      journey (~> 1.0.4)
@@ -16,31 +16,31 @@ GIT
      rack-cache (~> 1.2)
      rack-test (~> 0.6.1)
      sprockets (~> 2.2.1)
-    activemodel (3.2.21)
-      activesupport (= 3.2.21)
+    activemodel (3.2.22.2)
+      activesupport (= 3.2.22.2)
      builder (~> 3.0.0)
-    activerecord (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
+    activerecord (3.2.22.2)
+      activemodel (= 3.2.22.2)
+      activesupport (= 3.2.22.2)
      arel (~> 3.0.2)
      tzinfo (~> 0.3.29)
-    activeresource (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
-    activesupport (3.2.21)
+    activeresource (3.2.22.2)
+      activemodel (= 3.2.22.2)
+      activesupport (= 3.2.22.2)
+    activesupport (3.2.22.2)
      i18n (~> 0.6, >= 0.6.4)
      multi_json (~> 1.0)
-    rails (3.2.21)
-      actionmailer (= 3.2.21)
-      actionpack (= 3.2.21)
-      activerecord (= 3.2.21)
-      activeresource (= 3.2.21)
-      activesupport (= 3.2.21)
+    rails (3.2.22.2)
+      actionmailer (= 3.2.22.2)
+      actionpack (= 3.2.22.2)
+      activerecord (= 3.2.22.2)
+      activeresource (= 3.2.22.2)
+      activesupport (= 3.2.22.2)
      bundler (~> 1.0)
-      railties (= 3.2.21)
-    railties (3.2.21)
-      actionpack (= 3.2.21)
-      activesupport (= 3.2.21)
+      railties (= 3.2.22.2)
+    railties (3.2.22.2)
+      actionpack (= 3.2.22.2)
+      activesupport (= 3.2.22.2)
      rack-ssl (~> 1.3.2)
      rake (>= 0.8.7)
      rdoc (~> 3.4)
@@ -49,7 +49,7 @@ GIT
 PATH
  remote: ..
  specs:
-    devise (3.5.6)
+    devise (3.5.8)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 3.2.6, < 5)
@@ -61,36 +61,36 @@ GEM
  remote: https://rubygems.org/
  specs:
    arel (3.0.3)
-    bcrypt (3.1.10)
+    bcrypt (3.1.11)
    builder (3.0.4)
    erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
+    hashie (3.4.3)
    hike (1.2.3)
    i18n (0.7.0)
    journey (1.0.4)
-    json (1.8.2)
-    jwt (1.4.1)
+    json (1.8.3)
+    jwt (1.5.4)
    mail (2.5.4)
      mime-types (~> 1.16)
      treetop (~> 1.4.8)
    metaclass (0.0.4)
    mime-types (1.25.1)
-    mini_portile (0.6.2)
+    mini_portile2 (2.0.0)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
-    mongoid (3.1.6)
+    mongoid (3.1.7)
      activemodel (~> 3.2)
      moped (~> 1.4)
      origin (~> 1.0)
      tzinfo (~> 0.3.29)
-    moped (1.5.2)
-    multi_json (1.11.0)
+    moped (1.5.3)
+    multi_json (1.11.3)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
    oauth2 (0.9.4)
      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
@@ -113,8 +113,8 @@ GEM
    origin (1.1.0)
    orm_adapter (0.5.0)
    polyglot (0.3.5)
-    rack (1.4.5)
-    rack-cache (1.2)
+    rack (1.4.7)
+    rack-cache (1.6.1)
      rack (>= 0.4)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
@@ -123,7 +123,7 @@ GEM
      rack
    rack-test (0.6.3)
      rack (>= 1.0)
-    rake (10.4.2)
+    rake (11.1.2)
    rdoc (3.12.2)
      json (~> 1.4)
    responders (1.1.2)
@@ -134,14 +134,14 @@ GEM
      multi_json (~> 1.0)
      rack (~> 1.0)
      tilt (~> 1.1, != 1.3.0)
-    sqlite3 (1.3.10)
+    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
    tilt (1.4.1)
    treetop (1.4.15)
      polyglot
      polyglot (>= 0.3.1)
-    tzinfo (0.3.43)
+    tzinfo (0.3.49)
    warden (1.2.6)
      rack (>= 1.0)
    webrat (0.7.3)
--- a/gemfiles/Gemfile.rails-4.0-stable
+++ b/gemfiles/Gemfile.rails-4.0-stable
@@ -6,6 +6,7 @@ gem "rails", github: 'rails/rails', branch: '4-0-stable'
 gem "omniauth", "~> 1.2.0"
 gem "omniauth-oauth2", "~> 1.1.0"
 gem "rdoc"
+gem "mime-types", "~> 2.99"

 group :test do
  gem "omniauth-facebook"
--- a/gemfiles/Gemfile.rails-4.0-stable.lock
+++ b/gemfiles/Gemfile.rails-4.0-stable.lock
@@ -43,7 +43,7 @@ GIT
 PATH
  remote: ..
  specs:
-    devise (3.5.6)
+    devise (3.5.8)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 3.2.6, < 5)
@@ -56,21 +56,22 @@ GEM
  specs:
    activerecord-deprecated_finders (1.0.4)
    arel (4.0.2)
-    bcrypt (3.1.10)
+    bcrypt (3.1.11)
    bson (3.2.6)
    builder (3.1.4)
-    concurrent-ruby (1.0.0)
+    concurrent-ruby (1.0.1)
    connection_pool (2.2.0)
    erubis (2.7.0)
    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
    hashie (3.4.3)
    i18n (0.7.0)
-    jwt (1.5.2)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    json (1.8.3)
+    jwt (1.5.4)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
    metaclass (0.0.4)
-    mime-types (2.99)
+    mime-types (2.99.1)
    mini_portile2 (2.0.0)
    minitest (4.7.5)
    mocha (1.1.0)
@@ -84,7 +85,7 @@ GEM
      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.11.3)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
    nokogiri (1.6.7.2)
@@ -117,12 +118,13 @@ GEM
      ruby-openid (>= 2.1.8)
    rack-test (0.6.3)
      rack (>= 1.0)
-    rake (10.5.0)
-    rdoc (4.2.1)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
    responders (1.1.2)
      railties (>= 3.2, < 4.2)
    ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
    sprockets-rails (2.3.3)
@@ -132,7 +134,7 @@ GEM
    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
-    tzinfo (0.3.46)
+    tzinfo (0.3.49)
    warden (1.2.6)
      rack (>= 1.0)
    webrat (0.7.3)
@@ -148,6 +150,7 @@ DEPENDENCIES
  activerecord-jdbcsqlite3-adapter
  devise!
  jruby-openssl
+  mime-types (~> 2.99)
  mocha (~> 1.1)
  mongoid (~> 4.0.0)
  omniauth (~> 1.2.0)
--- a/gemfiles/Gemfile.rails-4.1-stable
+++ b/gemfiles/Gemfile.rails-4.1-stable
@@ -6,6 +6,7 @@ gem "rails", github: 'rails/rails', branch: '4-1-stable'
 gem "omniauth", "~> 1.2.0"
 gem "omniauth-oauth2", "~> 1.1.0"
 gem "rdoc"
+gem "mime-types", "~> 2.99"

 group :test do
  gem "omniauth-facebook"
--- a/gemfiles/Gemfile.rails-4.1-stable.lock
+++ b/gemfiles/Gemfile.rails-4.1-stable.lock
@@ -1,54 +1,54 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: bf32ec7b8611e6b4c7e9398f7d297a1f0221e9b9
+  revision: 41b4d81b4fd14cbf43060c223bea0f461256d099
  branch: 4-1-stable
  specs:
-    actionmailer (4.1.10)
-      actionpack (= 4.1.10)
-      actionview (= 4.1.10)
+    actionmailer (4.1.15)
+      actionpack (= 4.1.15)
+      actionview (= 4.1.15)
      mail (~> 2.5, >= 2.5.4)
-    actionpack (4.1.10)
-      actionview (= 4.1.10)
-      activesupport (= 4.1.10)
+    actionpack (4.1.15)
+      actionview (= 4.1.15)
+      activesupport (= 4.1.15)
      rack (~> 1.5.2)
      rack-test (~> 0.6.2)
-    actionview (4.1.10)
-      activesupport (= 4.1.10)
+    actionview (4.1.15)
+      activesupport (= 4.1.15)
      builder (~> 3.1)
      erubis (~> 2.7.0)
-    activemodel (4.1.10)
-      activesupport (= 4.1.10)
+    activemodel (4.1.15)
+      activesupport (= 4.1.15)
      builder (~> 3.1)
-    activerecord (4.1.10)
-      activemodel (= 4.1.10)
-      activesupport (= 4.1.10)
+    activerecord (4.1.15)
+      activemodel (= 4.1.15)
+      activesupport (= 4.1.15)
      arel (~> 5.0.0)
-    activesupport (4.1.10)
+    activesupport (4.1.15)
      i18n (~> 0.6, >= 0.6.9)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.1)
      tzinfo (~> 1.1)
-    rails (4.1.10)
-      actionmailer (= 4.1.10)
-      actionpack (= 4.1.10)
-      actionview (= 4.1.10)
-      activemodel (= 4.1.10)
-      activerecord (= 4.1.10)
-      activesupport (= 4.1.10)
+    rails (4.1.15)
+      actionmailer (= 4.1.15)
+      actionpack (= 4.1.15)
+      actionview (= 4.1.15)
+      activemodel (= 4.1.15)
+      activerecord (= 4.1.15)
+      activesupport (= 4.1.15)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.10)
+      railties (= 4.1.15)
      sprockets-rails (~> 2.0)
-    railties (4.1.10)
-      actionpack (= 4.1.10)
-      activesupport (= 4.1.10)
+    railties (4.1.15)
+      actionpack (= 4.1.15)
+      activesupport (= 4.1.15)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 PATH
  remote: ..
  specs:
-    devise (3.5.6)
+    devise (3.5.8)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 3.2.6, < 5)
@@ -60,24 +60,24 @@ GEM
  remote: https://rubygems.org/
  specs:
    arel (5.0.1.20140414130214)
-    bcrypt (3.1.10)
-    bson (2.3.0)
+    bcrypt (3.1.11)
+    bson (3.2.6)
    builder (3.2.2)
-    connection_pool (2.1.3)
+    concurrent-ruby (1.0.1)
+    connection_pool (2.2.0)
    erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
-    hike (1.2.3)
+    hashie (3.4.3)
    i18n (0.7.0)
-    json (1.8.2)
-    jwt (1.4.1)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    json (1.8.3)
+    jwt (1.5.4)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
    metaclass (0.0.4)
-    mime-types (2.4.3)
-    mini_portile (0.6.2)
-    minitest (5.5.1)
+    mime-types (2.99.1)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -85,15 +85,15 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
+    moped (2.0.7)
+      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.0)
+    multi_json (1.11.3)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
    oauth2 (0.9.4)
      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
@@ -114,32 +114,30 @@ GEM
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.1.1)
+    origin (2.2.0)
    orm_adapter (0.5.0)
-    rack (1.5.2)
+    rack (1.5.5)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
    rack-test (0.6.3)
      rack (>= 1.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
    responders (1.1.2)
      railties (>= 3.2, < 4.2)
    ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
+    sprockets (3.6.0)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (2.3.3)
      actionpack (>= 3.0)
      activesupport (>= 3.0)
      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
-    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
    warden (1.2.6)
@@ -157,6 +155,7 @@ DEPENDENCIES
  activerecord-jdbcsqlite3-adapter
  devise!
  jruby-openssl
+  mime-types (~> 2.99)
  mocha (~> 1.1)
  mongoid (~> 4.0.0)
  omniauth (~> 1.2.0)
--- a/gemfiles/Gemfile.rails-4.2-stable
+++ b/gemfiles/Gemfile.rails-4.2-stable
@@ -6,6 +6,7 @@ gem "rails", github: 'rails/rails', branch: '4-2-stable'
 gem "omniauth", "~> 1.2.2"
 gem "omniauth-oauth2", "~> 1.2.0"
 gem "rdoc"
+gem "mime-types", "~> 2.99"

 group :test do
  gem "omniauth-facebook"
--- a/gemfiles/Gemfile.rails-4.2-stable.lock
+++ b/gemfiles/Gemfile.rails-4.2-stable.lock
@@ -1,64 +1,64 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: f12ff8ddab7b199707ec36d72bd72f206f142c8b
+  revision: 2a1b655bb7db42ed0dbadab5bb129a8515e86a40
  branch: 4-2-stable
  specs:
-    actionmailer (4.2.1)
-      actionpack (= 4.2.1)
-      actionview (= 4.2.1)
-      activejob (= 4.2.1)
+    actionmailer (4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.1)
-      actionview (= 4.2.1)
-      activesupport (= 4.2.1)
+    actionpack (4.2.6)
+      actionview (= 4.2.6)
+      activesupport (= 4.2.6)
      rack (~> 1.6)
      rack-test (~> 0.6.2)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.1)
-      activesupport (= 4.2.1)
+    actionview (4.2.6)
+      activesupport (= 4.2.6)
      builder (~> 3.1)
      erubis (~> 2.7.0)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.1)
-      activesupport (= 4.2.1)
+    activejob (4.2.6)
+      activesupport (= 4.2.6)
      globalid (>= 0.3.0)
-    activemodel (4.2.1)
-      activesupport (= 4.2.1)
+    activemodel (4.2.6)
+      activesupport (= 4.2.6)
      builder (~> 3.1)
-    activerecord (4.2.1)
-      activemodel (= 4.2.1)
-      activesupport (= 4.2.1)
+    activerecord (4.2.6)
+      activemodel (= 4.2.6)
+      activesupport (= 4.2.6)
      arel (~> 6.0)
-    activesupport (4.2.1)
+    activesupport (4.2.6)
      i18n (~> 0.7)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    rails (4.2.1)
-      actionmailer (= 4.2.1)
-      actionpack (= 4.2.1)
-      actionview (= 4.2.1)
-      activejob (= 4.2.1)
-      activemodel (= 4.2.1)
-      activerecord (= 4.2.1)
-      activesupport (= 4.2.1)
+    rails (4.2.6)
+      actionmailer (= 4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
+      activemodel (= 4.2.6)
+      activerecord (= 4.2.6)
+      activesupport (= 4.2.6)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.1)
+      railties (= 4.2.6)
      sprockets-rails
-    railties (4.2.1)
-      actionpack (= 4.2.1)
-      activesupport (= 4.2.1)
+    railties (4.2.6)
+      actionpack (= 4.2.6)
+      activesupport (= 4.2.6)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 PATH
  remote: ..
  specs:
-    devise (3.5.6)
+    devise (3.5.8)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 3.2.6, < 5)
@@ -69,29 +69,29 @@ PATH
 GEM
  remote: https://rubygems.org/
  specs:
-    arel (6.0.0)
-    bcrypt (3.1.10)
-    bson (2.3.0)
+    arel (6.0.3)
+    bcrypt (3.1.11)
+    bson (3.2.6)
    builder (3.2.2)
-    connection_pool (2.1.3)
+    concurrent-ruby (1.0.1)
+    connection_pool (2.2.0)
    erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    globalid (0.3.3)
+    globalid (0.3.6)
      activesupport (>= 4.1.0)
-    hashie (3.4.0)
-    hike (1.2.3)
+    hashie (3.4.3)
    i18n (0.7.0)
-    json (1.8.2)
-    jwt (1.4.1)
-    loofah (2.0.1)
+    json (1.8.3)
+    jwt (1.5.1)
+    loofah (2.0.3)
      nokogiri (>= 1.5.9)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
    metaclass (0.0.4)
-    mime-types (2.4.3)
-    mini_portile (0.6.2)
-    minitest (5.5.1)
+    mime-types (2.99.1)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -99,25 +99,25 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
+    moped (2.0.7)
+      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.0)
+    multi_json (1.11.3)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
-    oauth2 (1.0.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
+    oauth2 (1.1.0)
      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
+      jwt (~> 1.0, < 1.5.2)
      multi_json (~> 1.3)
      multi_xml (~> 0.5)
-      rack (~> 1.2)
+      rack (>= 1.2, < 3)
    omniauth (1.2.2)
      hashie (>= 1.2, < 4)
      rack (~> 1.0)
-    omniauth-facebook (2.0.1)
+    omniauth-facebook (3.0.0)
      omniauth-oauth2 (~> 1.2)
    omniauth-oauth2 (1.2.0)
      faraday (>= 0.8, < 0.10)
@@ -128,9 +128,9 @@ GEM
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.1.1)
+    origin (2.2.0)
    orm_adapter (0.5.0)
-    rack (1.6.0)
+    rack (1.6.4)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
@@ -138,30 +138,28 @@ GEM
      rack (>= 1.0)
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.6)
+    rails-dom-testing (1.0.7)
      activesupport (>= 4.2.0.beta, < 5.0)
      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.2)
+    rails-html-sanitizer (1.0.3)
      loofah (~> 2.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    responders (2.1.1)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    responders (2.1.2)
      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sprockets (3.6.0)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.0.4)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
-    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
    warden (1.2.6)
@@ -179,6 +177,7 @@ DEPENDENCIES
  activerecord-jdbcsqlite3-adapter
  devise!
  jruby-openssl
+  mime-types (~> 2.99)
  mocha (~> 1.1)
  mongoid (~> 4.0.0)
  omniauth (~> 1.2.2)
--- a/lib/devise.rb
+++ b/lib/devise.rb
@@ -116,7 +116,6 @@ module Devise
  mattr_accessor :remember_for
  @@remember_for = 2.weeks

-  # TODO: extend_remember_period is no longer used
  # If true, extends the user's remember period when remembered via cookie.
  mattr_accessor :extend_remember_period
  @@extend_remember_period = false
--- a/lib/devise/models/confirmable.rb
+++ b/lib/devise/models/confirmable.rb
@@ -170,6 +170,7 @@ module Devise
        # in models to map to a nice sign up e-mail.
        def send_on_create_confirmation_instructions
          send_confirmation_instructions
+          skip_reconfirmation!
        end

        # Callback to overwrite if confirmation is required or not.
@@ -254,13 +255,13 @@ module Devise
        end

        def postpone_email_change?
-          postpone = self.class.reconfirmable && email_changed? && email_was.present? && !@bypass_confirmation_postpone && self.email.present?
+          postpone = self.class.reconfirmable && email_changed? && !@bypass_confirmation_postpone && self.email.present?
          @bypass_confirmation_postpone = false
          postpone
        end

        def reconfirmation_required?
-          self.class.reconfirmable && @reconfirmation_required && self.email.present?
+          self.class.reconfirmable && @reconfirmation_required && (self.email.present? || self.unconfirmed_email.present?)
        end

        def send_confirmation_notification?
--- a/lib/devise/models/lockable.rb
+++ b/lib/devise/models/lockable.rb
@@ -99,8 +99,8 @@ module Devise
        if super && !access_locked?
          true
        else
-          self.failed_attempts ||= 0
-          self.failed_attempts += 1
+          self.class.increment_counter(:failed_attempts, id)
+          reload
          if attempts_exceeded?
            lock_access! unless access_locked?
          else
@@ -155,6 +155,9 @@ module Devise
        end

      module ClassMethods
+        # List of strategies that are enabled/supported if :both is used.
+        BOTH_STRATEGIES = [:time, :email]
+
        # Attempt to find a user by its unlock keys. If a record is found, send new
        # unlock instructions to it. If not user is found, returns a new user
        # with an email not found error.
@@ -181,7 +184,8 @@ module Devise

        # Is the unlock enabled for the given unlock strategy?
        def unlock_strategy_enabled?(strategy)
-          [:both, strategy].include?(self.unlock_strategy)
+          self.unlock_strategy == strategy ||
+            (self.unlock_strategy == :both && BOTH_STRATEGIES.include?(strategy))
        end

        # Is the lock enabled for the given lock strategy?
--- a/lib/devise/models/rememberable.rb
+++ b/lib/devise/models/rememberable.rb
@@ -39,7 +39,7 @@ module Devise
    module Rememberable
      extend ActiveSupport::Concern

-      attr_accessor :remember_me, :extend_remember_period
+      attr_accessor :remember_me

      def self.required_fields(klass)
        [:remember_created_at]
@@ -48,7 +48,7 @@ module Devise
      # TODO: We were used to receive a extend period argument but we no longer do.
      # Remove this for Devise 4.0.
      def remember_me!(*)
-        self.remember_token = self.class.remember_token if respond_to?(:remember_token)
+        self.remember_token ||= self.class.remember_token if respond_to?(:remember_token)
        self.remember_created_at ||= Time.now.utc
        save(validate: false) if self.changed?
      end
@@ -71,6 +71,10 @@ module Devise
        self.class.remember_for.from_now
      end

+      def extend_remember_period
+        self.class.extend_remember_period
+      end
+
      def rememberable_value
        if respond_to?(:remember_token)
          remember_token
@@ -152,9 +156,6 @@ module Devise
          end
        end

-        private
-
-        # TODO: extend_remember_period is no longer used
        Devise::Models.config(self, :remember_for, :extend_remember_period, :rememberable_options, :expire_all_remember_me_on_sign_out)
      end
    end
--- a/lib/devise/strategies/rememberable.rb
+++ b/lib/devise/strategies/rememberable.rb
@@ -25,8 +25,7 @@ module Devise
        end

        if validate(resource)
-          remember_me(resource)
-          extend_remember_me_period(resource)
+          remember_me(resource) if extend_remember_me?(resource)
          resource.after_remembered
          success!(resource)
        end
@@ -43,10 +42,8 @@ module Devise

    private

-      def extend_remember_me_period(resource)
-        if resource.respond_to?(:extend_remember_period=)
-          resource.extend_remember_period = mapping.to.extend_remember_period
-        end
+      def extend_remember_me?(resource)
+        resource.respond_to?(:extend_remember_period) && resource.extend_remember_period
      end

      def remember_me?
--- a/lib/devise/version.rb
+++ b/lib/devise/version.rb
@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "3.5.6".freeze
+  VERSION = "3.5.10".freeze
 end
--- a/test/integration/rememberable_test.rb
+++ b/test/integration/rememberable_test.rb
@@ -1,6 +1,11 @@
 require 'test_helper'

 class RememberMeTest < ActionDispatch::IntegrationTest
+  if (Rails::VERSION::MAJOR < 4) || (Rails::VERSION::MAJOR >= 4 && Rails::VERSION::MINOR < 1)
+    require 'time_helpers'
+    include ActiveSupport::Testing::TimeHelpers
+  end
+
  def create_user_and_remember(add_to_token='')
    user = create_user
    user.remember_me!
@@ -92,7 +97,6 @@ class RememberMeTest < ActionDispatch::IntegrationTest
    assert_response :success
    assert warden.authenticated?(:user)
    assert warden.user(:user) == user
-    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
  end

  test 'remember the user before sign up and redirect them to their home' do
@@ -118,6 +122,40 @@ class RememberMeTest < ActionDispatch::IntegrationTest
    end
  end

+  test 'extends remember period when extend remember period config is true' do
+    swap Devise, extend_remember_period: true, remember_for: 1.year do
+      user = create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      refute_equal old_remember_token, current_remember_token
+    end
+  end
+
+  test 'does not extend remember period when extend period config is false' do
+    swap Devise, extend_remember_period: false, remember_for: 1.year do
+      user = create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      assert_equal old_remember_token, current_remember_token
+    end
+  end
+
  test 'do not remember other scopes' do
    create_user_and_remember
    get root_path
--- a/test/models/confirmable_test.rb
+++ b/test/models/confirmable_test.rb
@@ -114,7 +114,7 @@ class ConfirmableTest < ActiveSupport::TestCase

    assert_email_not_sent do
      user.save!
-      assert !user.confirmed?
+      assert_not user.confirmed?
    end
  end

@@ -401,6 +401,14 @@ class ReconfirmableTest < ActiveSupport::TestCase
    assert_match "new_test@example.com", ActionMailer::Base.deliveries.last.body.encoded
  end

+  test 'should send confirmation instructions by email after changing email from nil' do
+    admin = create_admin(email: nil)
+    assert_email_sent "new_test@example.com" do
+      assert admin.update_attributes(email: 'new_test@example.com')
+    end
+    assert_match "new_test@example.com", ActionMailer::Base.deliveries.last.body.encoded
+  end
+
  test 'should not send confirmation by email after changing password' do
    admin = create_admin
    assert admin.confirm
@@ -488,8 +496,8 @@ class ReconfirmableTest < ActiveSupport::TestCase
  end

  test 'should not require reconfirmation after creating a record' do
-    user = create_admin
-    assert !user.pending_reconfirmation?
+    admin = create_admin
+    assert !admin.pending_reconfirmation?
  end

  test 'should not require reconfirmation after creating a record with #save called in callback' do
@@ -497,7 +505,7 @@ class ReconfirmableTest < ActiveSupport::TestCase
      after_create :save
    end

-    user = Admin::WithSaveInCallback.create(valid_attributes.except(:username))
-    assert !user.pending_reconfirmation?
+    admin = Admin::WithSaveInCallback.create(valid_attributes.except(:username))
+    assert !admin.pending_reconfirmation?
  end
 end
--- a/test/models/lockable_test.rb
+++ b/test/models/lockable_test.rb
@@ -37,6 +37,17 @@ class LockableTest < ActiveSupport::TestCase
    end
  end

+  test "should read failed_attempts from database when incrementing" do
+    user = create_user
+    initial_failed_attempts = user.failed_attempts
+    same_user = User.find(user.id)
+
+    user.valid_for_authentication?{ false }
+    same_user.valid_for_authentication?{ false }
+
+    assert_equal initial_failed_attempts + 2, user.reload.failed_attempts
+  end
+
  test 'should be valid for authentication with a unlocked user' do
    user = create_user
    user.lock_access!
@@ -325,4 +336,26 @@ class LockableTest < ActiveSupport::TestCase
    user.lock_access!
    assert_equal :locked, user.unauthenticated_message
  end
+
+  test 'unlock_strategy_enabled? should return true for both, email, and time strategies if :both is used' do
+    swap Devise, unlock_strategy: :both do
+      user = create_user
+      assert_equal true, user.unlock_strategy_enabled?(:both)
+      assert_equal true, user.unlock_strategy_enabled?(:time)
+      assert_equal true, user.unlock_strategy_enabled?(:email)
+      assert_equal false, user.unlock_strategy_enabled?(:none)
+      assert_equal false, user.unlock_strategy_enabled?(:an_undefined_strategy)
+    end
+  end
+
+  test 'unlock_strategy_enabled? should return true only for the configured strategy' do
+    swap Devise, unlock_strategy: :email do
+      user = create_user
+      assert_equal false, user.unlock_strategy_enabled?(:both)
+      assert_equal false, user.unlock_strategy_enabled?(:time)
+      assert_equal true, user.unlock_strategy_enabled?(:email)
+      assert_equal false, user.unlock_strategy_enabled?(:none)
+      assert_equal false, user.unlock_strategy_enabled?(:an_undefined_strategy)
+    end
+  end
 end
--- a/test/models/rememberable_test.rb
+++ b/test/models/rememberable_test.rb
@@ -16,6 +16,18 @@ class RememberableTest < ActiveSupport::TestCase
    assert user.remember_created_at
  end

+  test 'remember_me should not generate a new token if valid token exists' do
+    user = create_user
+    user.singleton_class.send(:attr_accessor, :remember_token)
+    User.to_adapter.expects(:find_first).returns(nil)
+
+    user.remember_me!
+    existing_token = user.remember_token
+
+    user.remember_me!
+    assert_equal existing_token, user.remember_token
+  end
+
  test 'forget_me should not clear remember token if using salt' do
    user = create_user
    user.remember_me!
--- a/test/time_helpers.rb
+++ b/test/time_helpers.rb
@@ -0,0 +1,137 @@
+# A copy of Rails time helpers. With this file we can support the `travel_to`
+# helper for Rails versions prior 4.1.
+# File origin: https://github.com/rails/rails/blob/52ce6ece8c8f74064bb64e0a0b1ddd83092718e1/activesupport/lib/active_support/testing/time_helpers.rb
+module ActiveSupport
+  module Testing
+    class SimpleStubs # :nodoc:
+      Stub = Struct.new(:object, :method_name, :original_method)
+
+      def initialize
+        @stubs = {}
+      end
+
+      def stub_object(object, method_name, return_value)
+        key = [object.object_id, method_name]
+
+        if stub = @stubs[key]
+          unstub_object(stub)
+        end
+
+        new_name = "__simple_stub__#{method_name}"
+
+        @stubs[key] = Stub.new(object, method_name, new_name)
+
+        object.singleton_class.send :alias_method, new_name, method_name
+        object.define_singleton_method(method_name) { return_value }
+      end
+
+      def unstub_all!
+        @stubs.each_value do |stub|
+          unstub_object(stub)
+        end
+        @stubs = {}
+      end
+
+      private
+
+        def unstub_object(stub)
+          singleton_class = stub.object.singleton_class
+          singleton_class.send :undef_method, stub.method_name
+          singleton_class.send :alias_method, stub.method_name, stub.original_method
+          singleton_class.send :undef_method, stub.original_method
+        end
+    end
+
+    # Contains helpers that help you test passage of time.
+    module TimeHelpers
+      # Changes current time to the time in the future or in the past by a given time difference by
+      # stubbing +Time.now+, +Date.today+, and +DateTime.now+.
+      #
+      #   Time.current     # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      #   travel 1.day
+      #   Time.current     # => Sun, 10 Nov 2013 15:34:49 EST -05:00
+      #   Date.current     # => Sun, 10 Nov 2013
+      #   DateTime.current # => Sun, 10 Nov 2013 15:34:49 -0500
+      #
+      # This method also accepts a block, which will return the current time back to its original
+      # state at the end of the block:
+      #
+      #   Time.current # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      #   travel 1.day do
+      #     User.create.created_at # => Sun, 10 Nov 2013 15:34:49 EST -05:00
+      #   end
+      #   Time.current # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      def travel(duration, &block)
+        travel_to Time.now + duration, &block
+      end
+
+      # Changes current time to the given time by stubbing +Time.now+,
+      # +Date.today+, and +DateTime.now+ to return the time or date passed into this method.
+      #
+      #   Time.current     # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      #   travel_to Time.new(2004, 11, 24, 01, 04, 44)
+      #   Time.current     # => Wed, 24 Nov 2004 01:04:44 EST -05:00
+      #   Date.current     # => Wed, 24 Nov 2004
+      #   DateTime.current # => Wed, 24 Nov 2004 01:04:44 -0500
+      #
+      # Dates are taken as their timestamp at the beginning of the day in the
+      # application time zone. <tt>Time.current</tt> returns said timestamp,
+      # and <tt>Time.now</tt> its equivalent in the system time zone. Similarly,
+      # <tt>Date.current</tt> returns a date equal to the argument, and
+      # <tt>Date.today</tt> the date according to <tt>Time.now</tt>, which may
+      # be different. (Note that you rarely want to deal with <tt>Time.now</tt>,
+      # or <tt>Date.today</tt>, in order to honor the application time zone
+      # please always use <tt>Time.current</tt> and <tt>Date.current</tt>.)
+      #
+      # Note that the usec for the time passed will be set to 0 to prevent rounding
+      # errors with external services, like MySQL (which will round instead of floor,
+      # leading to off-by-one-second errors).
+      #
+      # This method also accepts a block, which will return the current time back to its original
+      # state at the end of the block:
+      #
+      #   Time.current # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      #   travel_to Time.new(2004, 11, 24, 01, 04, 44) do
+      #     Time.current # => Wed, 24 Nov 2004 01:04:44 EST -05:00
+      #   end
+      #   Time.current # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      def travel_to(date_or_time)
+        if date_or_time.is_a?(Date) && !date_or_time.is_a?(DateTime)
+          now = date_or_time.midnight.to_time
+        else
+          now = date_or_time.to_time.change(usec: 0)
+        end
+
+        simple_stubs.stub_object(Time, :now, now)
+        simple_stubs.stub_object(Date, :today, now.to_date)
+        simple_stubs.stub_object(DateTime, :now, now.to_datetime)
+
+        if block_given?
+          begin
+            yield
+          ensure
+            travel_back
+          end
+        end
+      end
+
+      # Returns the current time back to its original state, by removing the stubs added by
+      # `travel` and `travel_to`.
+      #
+      #   Time.current # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      #   travel_to Time.new(2004, 11, 24, 01, 04, 44)
+      #   Time.current # => Wed, 24 Nov 2004 01:04:44 EST -05:00
+      #   travel_back
+      #   Time.current # => Sat, 09 Nov 2013 15:34:49 EST -05:00
+      def travel_back
+        simple_stubs.unstub_all!
+      end
+
+      private
+
+        def simple_stubs
+          @simple_stubs ||= SimpleStubs.new
+        end
+    end
+  end
+end
Author	SHA1	Message	Date
Leonardo Tegon	fb48336709	Merge pull request #5043 from maestrano/increment-failed-attempts-concurency Backport CVE-2019-5421 fix to 3.x	2019-03-26 11:33:35 -03:00
Olivier Brisse	36690f33a4	Make `#increment_failed_attempts` concurrency safe Backported from https://github.com/plataformatec/devise/pull/4996	2019-03-15 09:54:25 +11:00
Rafael França	bddf051bfb	Merge pull request #4749 from chrisb/3-stable-ruby-2.5 Backport Ruby 2.5.0 syntax fixes to 3-stable	2018-01-09 13:07:35 -05:00
Pat Allan	53957d921b	Fix syntax for MRI 2.5.0-preview1.	2017-12-28 10:56:17 -08:00
Lucas Mazza	a0af72edfd	Merge pull request #4117 from kamipo/patch-1 Fix release date in 3-stable CHANGELOG.md	2016-05-17 10:06:18 -03:00
Ryuta Kamizono	05b87096bd	Fix release date in 3-stable CHANGELOG.md	2016-05-17 21:58:54 +09:00
Ulisses Almeida	321fe1d13b	Release 3.5.10	2016-05-15 12:14:04 -03:00
Ralin Chimev	a7dcf98f7e	Fix overwriting the remember_token when a valid one already exists (#4101 ) The remember_token should not get overwritten when a user is signing in and a valid token already exists. Fixes #3950.	2016-05-15 12:12:48 -03:00
Ulisses Almeida	7e658a2abf	Release 3.5.9	2016-05-02 23:47:19 -03:00
Justin Bull	0252f0e4a8	Extract list of both strategies into class constant	2016-05-02 23:46:18 -03:00
Justin Bull	07e907ec26	🪲 Fix strategy checking in #unlock_strategy_enabled? for :none and undefined strategies A bug that if the unlock strategy was set to `:both`, it would return true for all & any inputs See #4072	2016-05-02 23:46:08 -03:00
Ulisses Almeida	e9ed3e2cb4	Support for older rails versions.	2016-04-25 18:44:11 -03:00
Ulisses Almeida	2fa6735462	Lock mime-types to ~> 2.99 If we update mime-types to 3 or greater, it does not works with ruby 1.9.3.	2016-04-25 18:14:12 -03:00
Ulisses Almeida	b8cddc3cf3	Release 3.5.8	2016-04-25 16:57:28 -03:00
MatBi	1d57169c7b	Send confirmation instructions when a user updates the email address from nil	2016-04-25 16:51:40 -03:00
Ulisses Almeida	812c1de8e8	Release 3.5.7 version.	2016-04-18 11:57:22 -03:00
Ulisses Almeida	a0f266c584	📝 Update CHANGELOG	2016-04-18 11:48:18 -03:00
Ulisses Almeida	ad99bfe6ef	Fix remember me always extending the period Now the config `extend_remember_period` is used to: `true` - Every time the user authentication is validated, the cookie expiration is updated. `false` - Does not updates the cookie expiration. Closes #3994	2016-04-18 11:47:56 -03:00