Be sure to halt on failures, closes heartcombo#856

caelum · Feb 24, 2011 · 392e664 · 392e664
1 parent 43a3431
commit 392e664
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 3 deletions.
diff --git a/CHANGELOG.rdoc b/CHANGELOG.rdoc
@@ -16,6 +16,7 @@
   * Custom failure apps no longer ignored in test mode (by github.com/jaghion)
   * Do not depend on ActiveModel::Dirty
   * Manual sign_in now triggers remember token
+  * Be sure to halt strategies on failures
 
 * deprecations
   * Deprecated anybody_signed_in? in favor of signed_in? (by github.com/gavinhughes)

diff --git a/lib/devise/strategies/authenticatable.rb b/lib/devise/strategies/authenticatable.rb
@@ -21,6 +21,7 @@ def validate(resource, &block)
         case result
         when String, Symbol
           fail!(result)
+          false
         when TrueClass
           decorate(resource)
           true

diff --git a/lib/devise/strategies/database_authenticatable.rb b/lib/devise/strategies/database_authenticatable.rb
@@ -10,7 +10,7 @@ def authenticate!
         if validate(resource){ resource.valid_password?(password) }
           resource.after_database_authentication
           success!(resource)
-        else
+        elsif !halted?
           fail(:invalid)
         end
       end

diff --git a/lib/devise/strategies/rememberable.rb b/lib/devise/strategies/rememberable.rb
@@ -20,7 +20,7 @@ def authenticate!
 
         if validate(resource)
           success!(resource)
-        else
+        elsif !halted?
           cookies.delete(remember_key)
           pass
         end

diff --git a/lib/devise/strategies/token_authenticatable.rb b/lib/devise/strategies/token_authenticatable.rb
@@ -20,7 +20,7 @@ def authenticate!
         if validate(resource)
           resource.after_token_authentication
           success!(resource)
-        else
+        elsif !halted?
           fail(:invalid_token)
         end
       end