Merge remote-tracking branch 'upstream/master'

1 files changed, 9 insertions, 2 deletions

diff --git a/activemodel/lib/active_model/secure_password.rb b/activemodel/lib/active_model/secure_password.rb
index 63380d6ffd..db78864c67 100644
--- a/activemodel/lib/active_model/secure_password.rb
+++ b/activemodel/lib/active_model/secure_password.rb
@@ -1,5 +1,3 @@
-require 'bcrypt'
-
 module ActiveModel
   module SecurePassword
     extend ActiveSupport::Concern
@@ -12,6 +10,10 @@ module ActiveModel
       # a "password_confirmation" attribute) are automatically added.
       # You can add more validations by hand if need be.
       #
+      # You need to add bcrypt-ruby (~> 3.0.0) to Gemfile to use has_secure_password:
+      #
+      #   gem 'bcrypt-ruby', '~> 3.0.0'
+      #
       # Example using Active Record (which automatically includes ActiveModel::SecurePassword):
       #
       #   # Schema: User(name:string, password_digest:string)
@@ -30,6 +32,11 @@ module ActiveModel
       #   User.find_by_name("david").try(:authenticate, "notright")      # => nil
       #   User.find_by_name("david").try(:authenticate, "mUc3m00RsqyRe") # => user
       def has_secure_password
+        # Load bcrypt-ruby only when has_secure_password is used.
+        # This is to avoid ActiveModel (and by extension the entire framework) being dependent on a binary library.
+        gem 'bcrypt-ruby', '~> 3.0.0'
+        require 'bcrypt'
+
         attr_reader :password
 
         validates_confirmation_of :password