@@ -110,7 +110,7 @@ module Clearance # :expires => 1.year.from_now.utc # } def remember_me! - self.remember_token = encrypt("--#{Time.now.utc}--#{password}--") + self.remember_token = encrypt("--#{Time.now.utc}--#{password}--#{id}--") save(false) end lib/clearance/user.rb @@ -140,6 +140,22 @@ class UserTest < ActiveSupport::TestCase end end + should "not generate the same remember token for users with the same password at the same time" do + password = 'secret' + first_user = Factory(:email_confirmed_user, + :password => password, + :password_confirmation => password) + second_user = Factory(:email_confirmed_user, + :password => password, + :password_confirmation => password) + + Time.stubs(:now => Time.now) + first_user.remember_me! + second_user.remember_me! + + assert_not_equal first_user.remember_token, second_user.remember_token + end + # recovering forgotten password context "An email confirmed user" do test/models/user_test.rb 5f13fcf7ac9abce1e8ec1a31d32416cdb46a980a Joe Ferris jferris@metaphor.local http://github.com/thoughtbot/clearance/commit/536828c06c146bb2122863fd175a6398c141f790 536828c06c146bb2122863fd175a6398c141f790 2009-10-21T07:50:53-07:00 2009-10-21T07:50:53-07:00 Fix for potential remember me token collisions ab4e97ee59a2adbfee7f3ef47cde1163182ac120 Joe Ferris jferris@metaphor.local