diff --git a/Gemfile b/Gemfile index e7231d499..d91681a24 100644 --- a/Gemfile +++ b/Gemfile @@ -2,7 +2,7 @@ source 'https://rubygems.org' ruby '2.0.0' gem 'rails', '~> 3.2.17' -gem 'devise', '~> 3.0.0' +gem 'devise', '~> 3.2.0' gem 'thin' gem 'jquery-rails' gem 'nested_form' diff --git a/Gemfile.lock b/Gemfile.lock index dbc609d72..bc2a7a50a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -43,8 +43,6 @@ GEM jquery-rails railties bcrypt (3.1.7) - bcrypt-ruby (3.1.5) - bcrypt (>= 3.1.3) bootstrap-sass-rails (2.3.2.1) railties (>= 3.1.0) sass-rails (>= 3.1.0) @@ -58,7 +56,7 @@ GEM rack (>= 1.0.0) rack-test (>= 0.5.4) xpath (~> 2.0) - capybara-screenshot (0.3.17) + capybara-screenshot (0.3.19) capybara (>= 1.0, < 3) launchy celluloid (0.15.2) @@ -86,10 +84,11 @@ GEM crack (0.4.2) safe_yaml (~> 1.0.0) daemons (1.1.9) - devise (3.0.4) - bcrypt-ruby (~> 3.0) + devise (3.2.4) + bcrypt (~> 3.0) orm_adapter (~> 0.1) railties (>= 3.2.6, < 5) + thread_safe (~> 0.1) warden (~> 1.2.3) diff-lcs (1.2.5) eco (1.0.0) @@ -133,7 +132,7 @@ GEM multi_json sprockets (>= 2.0.3) tilt - hashie (2.0.5) + hashie (2.1.0) heroku-api (0.3.18) excon (~> 0.27) multi_json (~> 1.8) @@ -282,10 +281,10 @@ GEM rspec-core (~> 2.14.0) rspec-expectations (~> 2.14.0) rspec-mocks (~> 2.14.0) - safe_yaml (1.0.1) + safe_yaml (1.0.2) sanitize (2.1.0) nokogiri (>= 1.4.4) - sass (3.2.18) + sass (3.2.19) sass-rails (3.2.6) railties (~> 3.2.0) sass (>= 3.1.10) @@ -316,6 +315,7 @@ GEM eventmachine (>= 1.0.0) rack (>= 1.0.0) thor (0.19.1) + thread_safe (0.3.2) tilt (1.4.1) timers (1.1.0) treetop (1.4.15) @@ -352,7 +352,7 @@ DEPENDENCIES capybara-screenshot coffee-rails compass-rails - devise (~> 3.0.0) + devise (~> 3.2.0) factory_girl_rails faker font-awesome-rails diff --git a/app/models/user.rb b/app/models/user.rb index 9473e4475..9fc2849cf 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -3,7 +3,7 @@ class User < ActiveRecord::Base devise :database_authenticatable, :registerable, :omniauthable, :recoverable, :rememberable, :trackable, :validatable, - :token_authenticatable, :confirmable, :timeoutable + :confirmable, :timeoutable has_many :authentications, inverse_of: :user, dependent: :destroy has_many :rsvps, conditions: { user_type: 'User' }, dependent: :destroy diff --git a/app/views/devise/mailer/confirmation_instructions.html.erb b/app/views/devise/mailer/confirmation_instructions.html.erb index 4f5b72d9e..d64c4b9d9 100644 --- a/app/views/devise/mailer/confirmation_instructions.html.erb +++ b/app/views/devise/mailer/confirmation_instructions.html.erb @@ -4,7 +4,7 @@

Click the link below to begin a magical journey to a RailsBridge workshop.

- <%= link_to confirmation_url(@resource, :confirmation_token => @resource.confirmation_token) do %> + <%= link_to confirmation_url(@resource, confirmation_token: @token) do %> Confirm your account! <% end %>

diff --git a/app/views/devise/mailer/reset_password_instructions.html.erb b/app/views/devise/mailer/reset_password_instructions.html.erb index ae9e888ab..7913e88be 100644 --- a/app/views/devise/mailer/reset_password_instructions.html.erb +++ b/app/views/devise/mailer/reset_password_instructions.html.erb @@ -2,7 +2,7 @@

Someone has requested a link to change your password, and you can do this through the link below.

-

<%= link_to 'Change my password', edit_password_url(@resource, :reset_password_token => @resource.reset_password_token) %>

+

<%= link_to 'Change my password', edit_password_url(@resource, reset_password_token: @token) %>

If you didn't request this, please ignore this email.

Your password won't change until you access the link above and create a new one.

diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index de4814119..ce2c4a85d 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -1,13 +1,19 @@ # Use this hook to configure devise mailer, warden hooks and so forth. # Many of these configuration options can be set straight in your model. Devise.setup do |config| + # The secret key used by Devise. Devise uses this key to generate + # random tokens. Changing this key will render invalid all existing + # confirmation, reset password and unlock tokens in the database. + config.secret_key = ENV['DEVISE_SECRET_KEY'] || ('x' * 30) + # ==> Mailer Configuration # Configure the e-mail address which will be shown in Devise::Mailer, - # note that it will be overwritten if you use your own mailer class with default "from" parameter. + # note that it will be overwritten if you use your own mailer class + # with default "from" parameter. config.mailer_sender = "Bridge Troll " # Configure the class responsible to send e-mails. - # config.mailer = "Devise::Mailer" + # config.mailer = 'Devise::Mailer' # ==> ORM configuration # Load and configure the ORM. Supports :active_record (default) and @@ -43,22 +49,42 @@ config.strip_whitespace_keys = [ :email ] # Tell if authentication through request.params is enabled. True by default. + # It can be set to an array that will enable params authentication only for the + # given strategies, for example, `config.params_authenticatable = [:database]` will + # enable it only for database (email + password) authentication. # config.params_authenticatable = true - # Tell if authentication through HTTP Basic Auth is enabled. False by default. + # Tell if authentication through HTTP Auth is enabled. False by default. + # It can be set to an array that will enable http authentication only for the + # given strategies, for example, `config.http_authenticatable = [:database]` will + # enable it only for database authentication. The supported strategies are: + # :database = Support basic authentication with authentication key + password # config.http_authenticatable = false # If http headers should be returned for AJAX requests. True by default. # config.http_authenticatable_on_xhr = true - # The realm used in Http Basic Authentication. "Application" by default. - # config.http_authentication_realm = "Application" + # The realm used in Http Basic Authentication. 'Application' by default. + # config.http_authentication_realm = 'Application' # It will change confirmation, password recovery and other workflows # to behave the same regardless if the e-mail provided was right or wrong. # Does not affect registerable. config.paranoid = true + # By default Devise will store the user in session. You can skip storage for + # particular strategies by setting this option. + # Notice that if you are skipping storage for all authentication paths, you + # may want to disable generating routes to Devise's sessions controller by + # passing :skip => :sessions to `devise_for` in your config/routes.rb + config.skip_session_storage = [:http_auth] + + # By default, Devise cleans up the CSRF token on authentication to + # avoid CSRF token fixation attacks. This means that, when using AJAX + # requests for sign in and sign up, you need to get a new CSRF token + # from the server. You can disable this option at your own risk. + # config.clean_up_csrf_token_on_authentication = true + # ==> Configuration for :database_authenticatable # For bcrypt, this is the cost for hashing the password and defaults to 10. If # using other encryptors, it sets how many times you want the password re-encrypted. @@ -77,7 +103,21 @@ # able to access the website for two days without confirming his account, # access will be blocked just in the third day. Default is 0.days, meaning # the user cannot access the website without confirming his account. - # config.confirm_within = 2.days + # config.allow_unconfirmed_access_for = 2.days + + # A period that the user is allowed to confirm their account before their + # token becomes invalid. For example, if set to 3.days, the user can confirm + # their account within 3 days after the mail was sent, but on the fourth day + # their account can't be confirmed with the token any more. + # Default is nil, meaning there is no restriction on how long a user can take + # before confirming their account. + # config.confirm_within = 3.days + + # If true, requires any email changes to be confirmed (exactly the same way as + # initial account confirmation) to be applied. Requires additional unconfirmed_email + # db field (see migrations). Until confirmed new email is stored in + # unconfirmed email column, and copied to email column on successful confirmation. + # config.reconfirmable = true # Defines which key will be used when confirming an account # config.confirmation_keys = [ :email ] @@ -86,22 +126,19 @@ # The time the user will be remembered without asking for credentials again. # config.remember_for = 2.weeks - # If true, a valid remember token can be re-used between multiple browsers. - # config.remember_across_browsers = true - # If true, extends the user's remember period when remembered via cookie. # config.extend_remember_period = false # Options to be passed to the created cookie. For instance, you can set # :secure => true in order to force SSL only cookies. - # config.cookie_options = {} + # config.rememberable_options = {} # ==> Configuration for :validatable - # Range for password length. Default is 6..128. - # config.password_length = 6..128 + # Range for password length. Default is 8..128. + # config.password_length = 8..128 # Email regex used to validate email formats. It simply asserts that - # an one (and only one) @ exists in the given string. This is mainly + # one (and only one) @ exists in the given string. This is mainly # to give user feedback and not to assert the e-mail validity. # config.email_regexp = /\A[^@]+@[^@]+\z/ @@ -111,6 +148,9 @@ config.timeout_in = 2.weeks # Lillie wanted 'forever' but we compromised at '2 weeks' + # If true, expires auth token on session timeout. + # config.expire_auth_token_on_timeout = false + # ==> Configuration for :lockable # Defines which strategy will be used to lock an account. # :failed_attempts = Locks an account after a number of failed attempts to sign in. @@ -134,6 +174,9 @@ # Time interval to unlock the account if :time is enabled as unlock_strategy. # config.unlock_in = 1.hour + # Warn on the last attempt before the account is locked. + # config.last_attempt_warning = false + # ==> Configuration for :recoverable # # Defines which key will be used when recovering the password for an account @@ -149,17 +192,11 @@ # :sha1, :sha512 or encryptors from others authentication tools as :clearance_sha1, # :authlogic_sha512 (then you should set stretches above to 20 for default behavior) # and :restful_authentication_sha1 (then you should set stretches to 10, and copy - # REST_AUTH_SITE_KEY to pepper) + # REST_AUTH_SITE_KEY to pepper). + # + # Require the `devise-encryptable` gem when using anything other than bcrypt # config.encryptor = :sha512 - # ==> Configuration for :token_authenticatable - # Defines name of the authentication token params key - # config.token_authentication_key = :auth_token - - # If true, authentication through token does not store user in session and needs - # to be supplied on each request. Useful if you are using the token as API token. - # config.stateless_token = false - # ==> Scopes configuration # Turn scoped views on. Before rendering "sessions/new", it will first check for # "users/sessions/new". It's turned off by default because it's slower if you @@ -170,9 +207,8 @@ # devise role declared in your routes (usually :user). # config.default_scope = :user - # Configure sign_out behavior. - # Sign_out action can be scoped (i.e. /users/sign_out affects only :user scope). - # The default is true, which means any logout action will sign out all active scopes. + # Set this configuration to false if you want /users/sign_out to sign out + # only the current scope. By default, Devise signs out all scopes. # config.sign_out_all_scopes = true # ==> Navigation configuration @@ -183,9 +219,8 @@ # If you have any extra navigational formats, like :iphone or :mobile, you # should add them to the navigational formats lists. # - # The :"*/*" and "*/*" formats below is required to match Internet - # Explorer requests. - # config.navigational_formats = [:"*/*", "*/*", :html] + # The "*/*" below is required to match Internet Explorer requests. + # config.navigational_formats = ['*/*', :html] # The default HTTP method used to sign out a resource. Default is :delete. config.sign_out_via = :delete @@ -195,6 +230,11 @@ # up on your models and hooks. # config.omniauth :github, 'APP_ID', 'APP_SECRET', :scope => 'user,public_repo' + config.omniauth :facebook, ENV['FACEBOOK_OAUTH_KEY'], ENV['FACEBOOK_OAUTH_SECRET'], {scope: 'email'} + config.omniauth :twitter, ENV['TWITTER_OAUTH_KEY'], ENV['TWITTER_OAUTH_SECRET'] + config.omniauth :github, ENV['GITHUB_OAUTH_KEY'], ENV['GITHUB_OAUTH_SECRET'] + config.omniauth :meetup, ENV['MEETUP_OAUTH_KEY'], ENV['MEETUP_OAUTH_SECRET'] + # ==> Warden configuration # If you want to use other strategies, that are not supported by Devise, or # change the failure app, you can configure them inside the config.warden block. @@ -204,8 +244,17 @@ # manager.default_strategies(:scope => :user).unshift :some_external_strategy # end - config.omniauth :facebook, ENV['FACEBOOK_OAUTH_KEY'], ENV['FACEBOOK_OAUTH_SECRET'], {scope: 'email'} - config.omniauth :twitter, ENV['TWITTER_OAUTH_KEY'], ENV['TWITTER_OAUTH_SECRET'] - config.omniauth :github, ENV['GITHUB_OAUTH_KEY'], ENV['GITHUB_OAUTH_SECRET'] - config.omniauth :meetup, ENV['MEETUP_OAUTH_KEY'], ENV['MEETUP_OAUTH_SECRET'] + # ==> Mountable engine configurations + # When using Devise inside an engine, let's call it `MyEngine`, and this engine + # is mountable, there are some extra configurations to be taken into account. + # The following options are available, assuming the engine is mounted as: + # + # mount MyEngine, at: '/my_engine' + # + # The router that invoked `devise_for`, in the example above, would be: + # config.router_name = :my_engine + # + # When using omniauth, Devise cannot automatically set Omniauth path, + # so you need to do it manually. For the users scope, it would be: + # config.omniauth_path_prefix = '/my_engine/users/auth' end