Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

344 lines (300 sloc) 17.258 kB
module Authlogic
module ActsAsAuthentic
# This module has a lot of neat functionality. It is responsible for encrypting your password, salting it, and verifying it.
# It can also help you transition to a new encryption algorithm. See the Config sub module for configuration options.
module Password
def self.included(klass)
klass.class_eval do
extend Config
add_acts_as_authentic_module(Callbacks)
add_acts_as_authentic_module(Methods)
end
end
# All configuration for the password aspect of acts_as_authentic.
module Config
# The name of the crypted_password field in the database.
#
# * <tt>Default:</tt> :crypted_password, :encrypted_password, :password_hash, or :pw_hash
# * <tt>Accepts:</tt> Symbol
def crypted_password_field(value = nil)
rw_config(:crypted_password_field, value, first_column_to_exist(nil, :crypted_password, :encrypted_password, :password_hash, :pw_hash))
end
alias_method :crypted_password_field=, :crypted_password_field
# The name of the password_salt field in the database.
#
# * <tt>Default:</tt> :password_salt, :pw_salt, :salt, nil if none exist
# * <tt>Accepts:</tt> Symbol
def password_salt_field(value = nil)
rw_config(:password_salt_field, value, first_column_to_exist(nil, :password_salt, :pw_salt, :salt))
end
alias_method :password_salt_field=, :password_salt_field
# Whether or not to require a password confirmation. If you don't want your users to confirm their password
# just set this to false.
#
# * <tt>Default:</tt> true
# * <tt>Accepts:</tt> Boolean
def require_password_confirmation(value = nil)
rw_config(:require_password_confirmation, value, true)
end
alias_method :require_password_confirmation=, :require_password_confirmation
# By default passwords are required when a record is new or the crypted_password is blank, but if both of these things
# are met a password is not required. In this case, blank passwords are ignored.
#
# Think about a profile page, where the user can edit all of their information, including changing their password.
# If they do not want to change their password they just leave the fields blank. This will try to set the password to
# a blank value, in which case is incorrect behavior. As such, Authlogic ignores this. But let's say you have a completely
# separate page for resetting passwords, you might not want to ignore blank passwords. If this is the case for you, then
# just set this value to false.
#
# * <tt>Default:</tt> true
# * <tt>Accepts:</tt> Boolean
def ignore_blank_passwords(value = nil)
rw_config(:ignore_blank_passwords, value, true)
end
alias_method :ignore_blank_passwords=, :ignore_blank_passwords
# When calling valid_password?("some pass") do you want to check that password against what's in that object or whats in
# the datbase. Take this example:
#
# u = User.first
# u.password = "new pass"
# u.valid_password?("old pass")
#
# Should the last line above return true or false? The record hasn't been saved yet, so most would assume yes.
# Other would assume no. So I let you decide by giving you this option.
#
# * <tt>Default:</tt> true
# * <tt>Accepts:</tt> Boolean
def check_passwords_against_database(value = nil)
rw_config(:check_passwords_against_database, value, true)
end
alias_method :check_passwords_against_database=, :check_passwords_against_database
# Whether or not to validate the password field.
#
# * <tt>Default:</tt> true
# * <tt>Accepts:</tt> Boolean
def validate_password_field(value = nil)
rw_config(:validate_password_field, value, true)
end
alias_method :validate_password_field=, :validate_password_field
# A hash of options for the validates_length_of call for the password field. Allows you to change this however you want.
#
# <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
# merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
# options.</b>
#
# * <tt>Default:</tt> {:minimum => 4, :if => :require_password?}
# * <tt>Accepts:</tt> Hash of options accepted by validates_length_of
def validates_length_of_password_field_options(value = nil)
rw_config(:validates_length_of_password_field_options, value, {:minimum => 4, :if => :require_password?})
end
alias_method :validates_length_of_password_field_options=, :validates_length_of_password_field_options
# A convenience function to merge options into the validates_length_of_login_field_options. So intead of:
#
# self.validates_length_of_password_field_options = validates_length_of_password_field_options.merge(:my_option => my_value)
#
# You can do this:
#
# merge_validates_length_of_password_field_options :my_option => my_value
def merge_validates_length_of_password_field_options(options = {})
self.validates_length_of_password_field_options = validates_length_of_password_field_options.merge(options)
end
# A hash of options for the validates_confirmation_of call for the password field. Allows you to change this however you want.
#
# <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
# merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
# options.</b>
#
# * <tt>Default:</tt> {:if => :require_password?}
# * <tt>Accepts:</tt> Hash of options accepted by validates_confirmation_of
def validates_confirmation_of_password_field_options(value = nil)
rw_config(:validates_confirmation_of_password_field_options, value, {:if => :require_password?})
end
alias_method :validates_confirmation_of_password_field_options=, :validates_confirmation_of_password_field_options
# See merge_validates_length_of_password_field_options. The same thing, except for validates_confirmation_of_password_field_options
def merge_validates_confirmation_of_password_field_options(options = {})
self.validates_confirmation_of_password_field_options = validates_confirmation_of_password_field_options.merge(options)
end
# A hash of options for the validates_length_of call for the password_confirmation field. Allows you to change this however you want.
#
# <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
# merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
# options.</b>
#
# * <tt>Default:</tt> validates_length_of_password_field_options
# * <tt>Accepts:</tt> Hash of options accepted by validates_length_of
def validates_length_of_password_confirmation_field_options(value = nil)
rw_config(:validates_length_of_password_confirmation_field_options, value, validates_length_of_password_field_options)
end
alias_method :validates_length_of_password_confirmation_field_options=, :validates_length_of_password_confirmation_field_options
# See merge_validates_length_of_password_field_options. The same thing, except for validates_length_of_password_confirmation_field_options
def merge_validates_length_of_password_confirmation_field_options(options = {})
self.validates_length_of_password_confirmation_field_options = validates_length_of_password_confirmation_field_options.merge(options)
end
# The class you want to use to encrypt and verify your encrypted passwords. See the Authlogic::CryptoProviders module for more info
# on the available methods and how to create your own.
#
# * <tt>Default:</tt> CryptoProviders::Sha512
# * <tt>Accepts:</tt> Class
def crypto_provider(value = nil)
rw_config(:crypto_provider, value, CryptoProviders::Sha512)
end
alias_method :crypto_provider=, :crypto_provider
# Let's say you originally encrypted your passwords with Sha1. Sha1 is starting to join the party with MD5 and you want to switch
# to something stronger. No problem, just specify your new and improved algorithm with the crypt_provider option and then let
# Authlogic know you are transitioning from Sha1 using this option. Authlogic will take care of everything, including transitioning
# your users to the new algorithm. The next time a user logs in, they will be granted access using the old algorithm and their
# password will be resaved with the new algorithm. All new users will obviously use the new algorithm as well.
#
# Lastly, if you want to transition again, you can pass an array of crypto providers. So you can transition from as many algorithms
# as you want.
#
# * <tt>Default:</tt> nil
# * <tt>Accepts:</tt> Class or Array
def transition_from_crypto_providers(value = nil)
rw_config(:transition_from_crypto_providers, (!value.nil? && [value].flatten.compact) || value, [])
end
alias_method :transition_from_crypto_providers=, :transition_from_crypto_providers
end
# Callbacks / hooks to allow other modules to modify the behavior of this module.
module Callbacks
METHODS = [
"before_password_set", "after_password_set",
"before_password_verification", "after_password_verification"
]
def self.included(klass)
return if klass.crypted_password_field.nil?
klass.define_callbacks *METHODS
end
private
METHODS.each do |method|
class_eval <<-"end_eval", __FILE__, __LINE__
def #{method}
run_callbacks(:#{method}) { |result, object| result == false }
end
end_eval
end
end
# The methods related to the password field.
module Methods
def self.included(klass)
return if klass.crypted_password_field.nil?
klass.class_eval do
include InstanceMethods
if validate_password_field
validates_length_of :password, validates_length_of_password_field_options
if require_password_confirmation
validates_confirmation_of :password, validates_confirmation_of_password_field_options
validates_length_of :password_confirmation, validates_length_of_password_confirmation_field_options
end
end
after_save :reset_password_changed
end
end
module InstanceMethods
# The password
def password
@password
end
# This is a virtual method. Once a password is passed to it, it will create new password salt as well as encrypt
# the password.
def password=(pass)
return if ignore_blank_passwords? && pass.blank?
before_password_set
@password = pass
send("#{password_salt_field}=", Authlogic::Random.friendly_token) if password_salt_field
send("#{crypted_password_field}=", crypto_provider.encrypt(*encrypt_arguments(@password, false, act_like_restful_authentication? ? :restful_authentication : nil)))
@password_changed = true
after_password_set
end
# Accepts a raw password to determine if it is the correct password or not. Notice the second argument. That defaults to the value of
# check_passwords_against_database. See that method for mor information, but basically it just tells Authlogic to check the password
# against the value in the database or the value in the object.
def valid_password?(attempted_password, check_against_database = check_passwords_against_database?)
crypted = check_against_database && send("#{crypted_password_field}_changed?") ? send("#{crypted_password_field}_was") : send(crypted_password_field)
return false if attempted_password.blank? || crypted.blank?
before_password_verification
crypto_providers.each_with_index do |encryptor, index|
# The arguments_type of for the transitioning from restful_authentication
arguments_type = (act_like_restful_authentication? && index == 0) ||
(transition_from_restful_authentication? && index > 0 && encryptor == Authlogic::CryptoProviders::Sha1) ?
:restful_authentication : nil
if encryptor.matches?(crypted, *encrypt_arguments(attempted_password, check_against_database, arguments_type))
transition_password(attempted_password) if transition_password?(index, encryptor, crypted, check_against_database)
after_password_verification
return true
end
end
false
end
# Resets the password to a random friendly token.
def reset_password
friendly_token = Authlogic::Random.friendly_token
self.password = friendly_token
self.password_confirmation = friendly_token
end
alias_method :randomize_password, :reset_password
# Resets the password to a random friendly token and then saves the record.
def reset_password!
reset_password
save_without_session_maintenance(false)
end
alias_method :randomize_password!, :reset_password!
private
def check_passwords_against_database?
self.class.check_passwords_against_database == true
end
def crypto_providers
[crypto_provider] + transition_from_crypto_providers
end
def encrypt_arguments(raw_password, check_against_database, arguments_type = nil)
salt = nil
salt = (check_against_database && send("#{password_salt_field}_changed?") ? send("#{password_salt_field}_was") : send(password_salt_field)) if password_salt_field
case arguments_type
when :restful_authentication
[REST_AUTH_SITE_KEY, salt, raw_password, REST_AUTH_SITE_KEY].compact
else
[raw_password, salt].compact
end
end
# Determines if we need to tranisiton the password.
# If the index > 0 then we are using an "transition from" crypto provider.
# If the encryptor has a cost and the cost it outdated.
# If we aren't using database values
# If we are using database values, only if the password hasnt change so we don't overwrite any changes
def transition_password?(index, encryptor, crypted, check_against_database)
(index > 0 || (encryptor.respond_to?(:cost_matches?) && !encryptor.cost_matches?(send(crypted_password_field)))) &&
(!check_against_database || !send("#{crypted_password_field}_changed?"))
end
def transition_password(attempted_password)
self.password = attempted_password
save(false)
end
def require_password?
new_record? || password_changed? || send(crypted_password_field).blank?
end
def ignore_blank_passwords?
self.class.ignore_blank_passwords == true
end
def password_changed?
@password_changed == true
end
def reset_password_changed
@password_changed = nil
end
def crypted_password_field
self.class.crypted_password_field
end
def password_salt_field
self.class.password_salt_field
end
def crypto_provider
self.class.crypto_provider
end
def transition_from_crypto_providers
self.class.transition_from_crypto_providers
end
end
end
end
end
end
Jump to Line
Something went wrong with that request. Please try again.