diff options
Diffstat (limited to 'activemodel')
| -rw-r--r-- | activemodel/CHANGELOG.md | 7 | ||||
| -rw-r--r-- | activemodel/lib/active_model/model.rb | 6 | ||||
| -rw-r--r-- | activemodel/lib/active_model/secure_password.rb | 26 | ||||
| -rw-r--r-- | activemodel/lib/active_model/serialization.rb | 16 | ||||
| -rw-r--r-- | activemodel/test/cases/secure_password_test.rb | 56 | ||||
| -rw-r--r-- | activemodel/test/cases/validations/absence_validation_test.rb | 7 |
6 files changed, 80 insertions, 38 deletions
diff --git a/activemodel/CHANGELOG.md b/activemodel/CHANGELOG.md index 29cd4cf934..4d9186017f 100644 --- a/activemodel/CHANGELOG.md +++ b/activemodel/CHANGELOG.md @@ -1,3 +1,10 @@ +* `has_secure_password` now verifies that the given password is less than 72 + characters if validations are enabled. + + Fixes #14591. + + *Akshay Vishnoi* + * Remove deprecated `Validator#setup` without replacement. See #10716. diff --git a/activemodel/lib/active_model/model.rb b/activemodel/lib/active_model/model.rb index 63716eebb1..640024eaa1 100644 --- a/activemodel/lib/active_model/model.rb +++ b/activemodel/lib/active_model/model.rb @@ -16,8 +16,8 @@ module ActiveModel # end # # person = Person.new(name: 'bob', age: '18') - # person.name # => 'bob' - # person.age # => 18 + # person.name # => "bob" + # person.age # => "18" # # Note that, by default, <tt>ActiveModel::Model</tt> implements <tt>persisted?</tt> # to return +false+, which is the most common case. You may want to override @@ -74,7 +74,7 @@ module ActiveModel # # person = Person.new(name: 'bob', age: '18') # person.name # => "bob" - # person.age # => 18 + # person.age # => "18" def initialize(params={}) params.each do |attr, value| self.public_send("#{attr}=", value) diff --git a/activemodel/lib/active_model/secure_password.rb b/activemodel/lib/active_model/secure_password.rb index 4033eb5808..fdfd8cb147 100644 --- a/activemodel/lib/active_model/secure_password.rb +++ b/activemodel/lib/active_model/secure_password.rb @@ -2,6 +2,11 @@ module ActiveModel module SecurePassword extend ActiveSupport::Concern + # BCrypt hash function can handle maximum 72 characters, and if we pass + # password of length more than 72 characters it ignores extra characters. + # Hence need to put a restriction on password length. + MAX_PASSWORD_LENGTH_ALLOWED = 72 + class << self attr_accessor :min_cost # :nodoc: end @@ -11,16 +16,20 @@ module ActiveModel # Adds methods to set and authenticate against a BCrypt password. # This mechanism requires you to have a +password_digest+ attribute. # - # Validations for presence of password on create, confirmation of password - # (using a +password_confirmation+ attribute) are automatically added. If - # you wish to turn off validations, pass <tt>validations: false</tt> as an - # argument. You can add more validations by hand if need be. + # The following validations are added automatically: + # * Password must be present on creation + # * Password length should be less than or equal to 72 characters + # * Confirmation of password (using a +password_confirmation+ attribute) + # + # If password confirmation validation is not needed, simply leave out the + # value for +password_confirmation+ (i.e. don't provide a form field for + # it). When this attribute has a +nil+ value, the validation will not be + # triggered. # - # If you don't need the confirmation validation, just don't set any - # value to the password_confirmation attribute and the validation - # will not be triggered. + # For further customizability, it is possible to supress the default + # validations by passing <tt>validations: false</tt> as an argument. # - # You need to add bcrypt (~> 3.1.7) to Gemfile to use #has_secure_password: + # Add bcrypt (~> 3.1.7) to Gemfile to use #has_secure_password: # # gem 'bcrypt', '~> 3.1.7' # @@ -63,6 +72,7 @@ module ActiveModel record.errors.add(:password, :blank) unless record.password_digest.present? end + validates_length_of :password, maximum: ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWED validates_confirmation_of :password, if: ->{ password.present? } end diff --git a/activemodel/lib/active_model/serialization.rb b/activemodel/lib/active_model/serialization.rb index 36a6c00290..976f50b13e 100644 --- a/activemodel/lib/active_model/serialization.rb +++ b/activemodel/lib/active_model/serialization.rb @@ -4,7 +4,7 @@ require 'active_support/core_ext/hash/slice' module ActiveModel # == Active \Model \Serialization # - # Provides a basic serialization to a serializable_hash for your object. + # Provides a basic serialization to a serializable_hash for your objects. # # A minimal implementation could be: # @@ -25,14 +25,14 @@ module ActiveModel # person.name = "Bob" # person.serializable_hash # => {"name"=>"Bob"} # - # You need to declare an attributes hash which contains the attributes you - # want to serialize. Attributes must be strings, not symbols. When called, - # serializable hash will use instance methods that match the name of the - # attributes hash's keys. In order to override this behavior, take a look at - # the private method +read_attribute_for_serialization+. + # An +attributes+ hash must be defined and should contain any attributes you + # need to be serialized. Attributes must be strings, not symbols. + # When called, serializable hash will use instance methods that match the name + # of the attributes hash's keys. In order to override this behavior, take a look + # at the private method +read_attribute_for_serialization+. # - # Most of the time though, you will want to include the JSON or XML - # serializations. Both of these modules automatically include the + # Most of the time though, either the JSON or XML serializations are needed. + # Both of these modules automatically include the # <tt>ActiveModel::Serialization</tt> module, so there is no need to # explicitly include it. # diff --git a/activemodel/test/cases/secure_password_test.rb b/activemodel/test/cases/secure_password_test.rb index bcd1e04a0f..e59f00c8c5 100644 --- a/activemodel/test/cases/secure_password_test.rb +++ b/activemodel/test/cases/secure_password_test.rb @@ -20,7 +20,7 @@ class SecurePasswordTest < ActiveModel::TestCase ActiveModel::SecurePassword.min_cost = @original_min_cost end - test "create and updating without validations" do + test "create/update without validations" do assert @visitor.valid?(:create), 'visitor should be valid' assert @visitor.valid?(:update), 'visitor should be valid' @@ -31,6 +31,18 @@ class SecurePasswordTest < ActiveModel::TestCase assert @visitor.valid?(:update), 'visitor should be valid' end + test "create a new user with validations and valid password/confirmation" do + @user.password = 'password' + @user.password_confirmation = 'password' + + assert @user.valid?(:create), 'user should be valid' + + @user.password = 'a' * 72 + @user.password_confirmation = 'a' * 72 + + assert @user.valid?(:create), 'user should be valid' + end + test "create a new user with validation and a blank password" do @user.password = '' assert !@user.valid?(:create), 'user should be invalid' @@ -45,6 +57,14 @@ class SecurePasswordTest < ActiveModel::TestCase assert_equal ["can't be blank"], @user.errors[:password] end + test 'create a new user with validation and password length greater than 72' do + @user.password = 'a' * 73 + @user.password_confirmation = 'a' * 73 + assert !@user.valid?(:create), 'user should be invalid' + assert_equal 1, @user.errors.count + assert_equal ["is too long (maximum is 72 characters)"], @user.errors[:password] + end + test "create a new user with validation and a blank password confirmation" do @user.password = 'password' @user.password_confirmation = '' @@ -67,15 +87,19 @@ class SecurePasswordTest < ActiveModel::TestCase assert_equal ["doesn't match Password"], @user.errors[:password_confirmation] end - test "create a new user with validation and a correct password confirmation" do - @user.password = 'password' - @user.password_confirmation = 'something else' - assert !@user.valid?(:create), 'user should be invalid' - assert_equal 1, @user.errors.count - assert_equal ["doesn't match Password"], @user.errors[:password_confirmation] + test "update an existing user with validation and no change in password" do + assert @existing_user.valid?(:update), 'user should be valid' end - test "update an existing user with validation and no change in password" do + test "update an existing user with validations and valid password/confirmation" do + @existing_user.password = 'password' + @existing_user.password_confirmation = 'password' + + assert @existing_user.valid?(:update), 'user should be valid' + + @existing_user.password = 'a' * 72 + @existing_user.password_confirmation = 'a' * 72 + assert @existing_user.valid?(:update), 'user should be valid' end @@ -97,6 +121,14 @@ class SecurePasswordTest < ActiveModel::TestCase assert_equal ["can't be blank"], @existing_user.errors[:password] end + test 'updating an existing user with validation and password length greater than 72' do + @existing_user.password = 'a' * 73 + @existing_user.password_confirmation = 'a' * 73 + assert !@existing_user.valid?(:update), 'user should be invalid' + assert_equal 1, @existing_user.errors.count + assert_equal ["is too long (maximum is 72 characters)"], @existing_user.errors[:password] + end + test "updating an existing user with validation and a blank password confirmation" do @existing_user.password = 'password' @existing_user.password_confirmation = '' @@ -119,14 +151,6 @@ class SecurePasswordTest < ActiveModel::TestCase assert_equal ["doesn't match Password"], @existing_user.errors[:password_confirmation] end - test "updating an existing user with validation and a correct password confirmation" do - @existing_user.password = 'password' - @existing_user.password_confirmation = 'something else' - assert !@existing_user.valid?(:update), 'user should be invalid' - assert_equal 1, @existing_user.errors.count - assert_equal ["doesn't match Password"], @existing_user.errors[:password_confirmation] - end - test "updating an existing user with validation and a blank password digest" do @existing_user.password_digest = '' assert !@existing_user.valid?(:update), 'user should be invalid' diff --git a/activemodel/test/cases/validations/absence_validation_test.rb b/activemodel/test/cases/validations/absence_validation_test.rb index 795ce16d28..ebfe1cf4e4 100644 --- a/activemodel/test/cases/validations/absence_validation_test.rb +++ b/activemodel/test/cases/validations/absence_validation_test.rb @@ -11,7 +11,7 @@ class AbsenceValidationTest < ActiveModel::TestCase CustomReader.clear_validators! end - def test_validate_absences + def test_validates_absence_of Topic.validates_absence_of(:title, :content) t = Topic.new t.title = "foo" @@ -23,11 +23,12 @@ class AbsenceValidationTest < ActiveModel::TestCase t.content = "something" assert t.invalid? assert_equal ["must be blank"], t.errors[:content] + assert_equal [], t.errors[:title] t.content = "" assert t.valid? end - def test_accepts_array_arguments + def test_validates_absence_of_with_array_arguments Topic.validates_absence_of %w(title content) t = Topic.new t.title = "foo" @@ -37,7 +38,7 @@ class AbsenceValidationTest < ActiveModel::TestCase assert_equal ["must be blank"], t.errors[:content] end - def test_validates_acceptance_of_with_custom_error_using_quotes + def test_validates_absence_of_with_custom_error_using_quotes Person.validates_absence_of :karma, message: "This string contains 'single' and \"double\" quotes" p = Person.new p.karma = "good" |