Commit Graph

3399 Commits

Author SHA1 Message Date
José Valim
2992b411a2 Update authenticatable.rb 2015-02-14 11:02:13 +01:00
José Valim
d2658c6e35 Merge pull request #2882 from hauleth/fix-mongoid-10068
Devise + Mongoid store wrong data in session
2015-02-14 11:00:48 +01:00
José Valim
893a0222ef Update new.html.erb 2015-02-14 10:59:01 +01:00
José Valim
fbb7a21abc Merge pull request #3468 from redbar0n/patch-2
Fix potential security leak in email reconfirmation flow
2015-02-14 10:58:25 +01:00
redbar0n
ee8c13435f Fix potential security leak in email reconfirmation flow
Ref. bug/issue: https://github.com/plataformatec/devise/issues/3457
2015-02-13 21:43:06 +01:00
José Valim
c19f1f27ce Merge pull request #3467 from borski/feature/recoverable_autologin_option
Added an option to not automatically sign in a user after a password res...
2015-02-13 13:32:35 +01:00
Michael Borohovski
f0992e4a96 Added an option to not automatically sign in a user after a password reset. This is useful for cases where additional strategies might be needed (such as two-factor authentication, e.g.), or generally if it is considered a security risk to automatically log in a user after a password is reset. 2015-02-13 02:29:11 -08:00
José Valim
baef67cee7 Merge pull request #3452 from jaume-prat/master
workaround for mountable Engines with Rails 4.2
2015-02-13 09:50:30 +01:00
José Valim
00dc3932c6 Merge pull request #3465 from mattbrictson/logging-leaks-readme
Add warning about logged tokens to the README
2015-02-13 09:20:59 +01:00
Matt Brictson
7acc7a6659 Add warning about logged tokens to the README 2015-02-12 16:05:58 -08:00
José Valim
fea2b95c5f Merge pull request #3463 from LunarLogic/master
Extracted route to separate method to be able to override in child class
2015-02-12 13:13:26 +01:00
Ania Slimak
8461234483 Extracted route to separate method to be able to override in child class 2015-02-12 13:07:57 +01:00
Jaume Prat
af8d38e45b do not set :script_name option with nil 2015-02-05 14:33:09 +01:00
Lucas Mazza
a2e0e9c187 Merge pull request #3449 from gaganawhad/patch-1
Add comments re: secret_key on Rails 4+ apps
2015-02-04 19:39:48 -02:00
Gagan Awhad
90f1d4d37a Add helpful comments re: 'secret_key' in devise initializer template
Adding a couple comments that explain that Devise will use
'secret_key_base' on Rails 4+ applications as its 'secret_key' by default.
2015-02-04 14:48:25 -06:00
Lucas Mazza
51c621ef51 Merge pull request #3447 from nitis-intelligence/warning/rails5
removing deprecation warning from rails 5
2015-02-03 19:03:37 -02:00
Luciano Sousa
9177bd70cf removing optional commas 2015-02-02 23:02:52 -03:00
Luciano Sousa
252a57d9b3 removing deprecation warning from rails 5 2015-02-02 22:54:46 -03:00
Lucas Mazza
394d69d958 Merge pull request #3407 from rosenfeld/inherited-controllers-translations
Use Devise translations when inheriting from core controllers
2015-01-26 20:03:11 -02:00
José Valim
65700b22ba Merge pull request #3440 from davestevens/pepper-password
Only add pepper if needed
2015-01-26 19:46:32 +01:00
Dave Stevens
8d48bcd594 Only add pepper if needed
Due to bug in Ruby 2.2.0; The bug has been acknowledged and fixed in trunk.

When password comes in FormEncoded the result of `gsub` breaks when
peppered with `nil`.
This only adds pepper if defined on the model and works around this
bug.

See: 622f3f14b6
2015-01-26 18:06:11 +00:00
José Valim
6dd4444582 Merge pull request #3432 from ronalchn/remember.used.tokens
Keep used confirmation tokens for more user friendly error message (issue #3429)
2015-01-19 13:04:30 +01:00
Ronald Chan
3f95ac8fec Keep used confirmation tokens for more user friendly error message (fixes #3429) 2015-01-19 22:30:13 +13:00
José Valim
c9fb1ebbfe Merge pull request #3428 from erdostom/master
updating copyrights to 2015
2015-01-18 22:38:29 +01:00
Tamas Erdos
bf2b37a39c updating copyrights to 2015 2015-01-18 16:21:59 -05:00
José Valim
8d3e0fddd3 Merge pull request #3425 from kbullaughey/master
get rid of config.serve_static_assets deprecation warning from production.rb
2015-01-16 21:31:38 +01:00
Kevin Bullaughey
1118762ce7 apply the same change to production.rb that was put into test.rb to get rid of the depracation warning related to the config.serve_static_assets -> config.serve_static_files in Rails 4.2.0 2015-01-16 15:29:08 -05:00
Rodrigo Rosenfeld Rosas
7e5d0ac736 Add tests for translation scope being preserved when inheriting a controller
issue #3367
2015-01-12 17:28:02 -02:00
Rodrigo Rosenfeld Rosas
c2fb80d4d9 Use Devise translations when inheriting from core controllers
closes #3367
2015-01-12 17:24:17 -02:00
José Valim
5eb9f18743 Merge pull request #3414 from georgemillo/patch-1
Remove unnecessary local variable from RegistrationsController
2015-01-11 16:35:48 +01:00
George Millo
5bb479052c Remove local variable from RegistrationsController 2015-01-11 15:10:44 +00:00
José Valim
8523801459 Merge pull request #3411 from nviennot/master
Revert "Better error message in case a trackable module can't be saved."
2015-01-10 16:18:30 +01:00
Nicolas Viennot
620478cc5f Revert "Better error message in case a trackable module can't be saved."
This reverts commit 43d0715238.

save() returns false only when validations failed. In this case, validations are
not performed. Therefore save() may never return a falsy value.
If save() fails, the appropriate exception is raised.

With certain ORMs, such as NoBrainer, save() never returns true/false, but
always raise an exception. This commit lift the incompatiblity.
2015-01-10 09:38:43 -05:00
José Valim
710efe557d Merge pull request #3405 from Dinuz/master
Update find_message to accept scope
2015-01-07 23:39:00 +01:00
Massimiliano
6c5323c574 Update devise_controller.rb 2015-01-07 14:46:02 -05:00
Massimiliano
c92ef26b94 Update find_message to accept scope
This should still keep the devise lookup in the case that a customed scope is not passed as option, but if instead the custom scope is passed, then the find_message method will use it.

This is kind of useful, if i don't want overwrite the devise locale, and use different locale files, but keeping still the fallback of my devise locale.
2015-01-06 21:06:09 -05:00
Carlos Antonio da Silva
d6972ab264 Tidy up
* Fix test class name
* No need for line breaks
2015-01-06 14:23:06 -02:00
José Valim
5dc0f8dab9 Merge pull request #3404 from vimutter/rails-initializers-order
Added devise.omniauth initializer explicit position requirements.
2015-01-06 17:15:39 +01:00
Mark Guk
b223ddeb35 Added devise.omniauth initializer explicit position requirements.
It is obvious that this initializer should be executed before Rails build_middleware_stack as Omniauth is build on middleware.
Also it is obvious that we need that initializer to be executed after all config/initializers/* files (that is where devise.rb usually is).
2015-01-06 18:05:38 +03:00
José Valim
1094ba65aa Merge pull request #3400 from eugeneius/test_helper_memoize_warden_per_request
Allow warden proxy to change with request in tests
2015-01-05 09:27:21 +01:00
Eugene Kenny
8d9dd50e4a Allow warden proxy to change with request in tests
The warden method in the Devise::TestHelpers module adds a Warden proxy
object to the request environment hash under the 'warden' key. Including
this module in your test case registers that method as a callback, which
runs before every test:
https://github.com/plataformatec/devise/blob/v3.4.1/lib/devise/test_helpers.rb#L12

The request object itself is created in a callback added by Rails:
https://github.com/rails/rails/blob/v4.2.0/actionpack/lib/action_controller/test_case.rb#L687

So before each test runs, the Rails callback creates the request object,
and then the Devise callback adds a Warden proxy object to it.

I was using the rspec-retry gem (https://github.com/y310/rspec-retry),
and noticed that my controller specs would always fail whenever they
were retried with this error:

NoMethodError: undefined method `authenticate!' for nil:NilClass

When rspec-retry re-runs a failed test, it runs the setup callbacks
again. The Rails callback creates a new request object, but because of
the memoization that was here before, the Devise callback wouldn't add a
Warden proxy to it, which was causing the error.

With this change, the Warden setup code will still only run once as long
as the request object stays the same, but if it changes a new Warden
proxy will be added to the new request object.
2015-01-05 00:34:54 +00:00
José Valim
7946f681a9 Merge pull request #3394 from JuanitoFatas/patch/fix-warning
Suppress test.rb configuration warning for Rails 4.2.
2014-12-31 09:52:21 +01:00
Juanito Fatas
b2a66732cf Suppress test.rb config warning for Rails 4.2. 2014-12-31 11:35:18 +08:00
Carlos Antonio da Silva
71861ab0bf Merge pull request #3389 from JuanitoFatas/patch/travis-ruby-2-2
Test against Ruby 2.2 on Travis.
2014-12-29 09:00:36 -02:00
Juanito Fatas
bb05314c8f Test against Ruby 2.2 on Travis.
* Add 4.2 stable to matrix.
* Exclude test against Ruby 2.2 for Rails 3.2.
2014-12-29 01:03:07 +08:00
Carlos Antonio da Silva
bebf0ecbbe Simplify the logic to display the minimum password length hint
There's no real need to pass 2 variables to the view to figure that out,
we can simply display the message relying on whether or not the
`@minimum_password_length` variable is present.
2014-12-27 11:22:40 -02:00
Carlos Antonio da Silva
5c5200b5d9 Update dependencies with the released 4.2.0 2014-12-27 11:15:08 -02:00
José Valim
5badce5e8e Merge pull request #3372 from Katee/show-min-password-length-on-edit-password
Show minimum password length on edit password
2014-12-17 21:18:48 +01:00
Katee
d0a30d485d Moves minimum_password_length to DeviseController. 2014-12-16 16:14:32 -05:00
Lucas Mazza
2c8e242000 Use Rails 4.2.0.rc3. 2014-12-16 11:03:26 -02:00