The noteworthy changes for each Clearance version are included here. For a complete changelog, see the git history for each version via the version links.
1.16.0 - January 16, 2017
- Clearance users can now help prevent session fixation attacks by setting
true. This will cause the user's CSRF token to be rotated on sign in and is recommended for all Clearance applications. This setting will default to
truein Clearance 2.0. Clearance will emit a warning on each sign in until this configuration setting is explicitly set to
1.15.1 - October 6, 2016
- Password reset form redirect no longer uses a named route helper, which means it will work for developers that have customized their routes.
1.15.0 - September 26, 2016
- Prevent possible password reset token leak to external sites linked to on the password reset page. See PR #707 for more information.
1.14.2 - August 10, 2016
- Fixed incompatibility with
attr_encryptedgem by inlining the body of the
encrypthelper method used in the BCrypt password strategy.
1.14.1 - May 12, 2016
- Fixed insertion of
include Clearance::Userwhen running the install generator in an app that already has a
deny_accessmatcher to assert against configured redirect location rather than hard coded
1.14.0 - April 29, 2016
Clearance::BackDoornow accepts a block, allowing the user for a test to be looked up by a parameter other than
idif you have overridden
- We now correctly track the dirty state of
User#encrypted_password, which fixes custom validations on
User#password(e.g. validating password length) that were conditional on the password actually changing.
clearance:installgenerator will now generate a
Usermodel that inherits from
ApplicationRecordif run on a Rails 5 app that doesn't already have a
User#password_changingis deprecated in favor of automatic dirty tracking on
password. If you are calling this in your application you should be able to remove it.
1.13.0 - March 4, 2016
- Clearance now supports Rails 5.0.0.beta3 and newer.
- Clearance will now infer the parameter name to use when accessing user
parameters in a request. This previously used
:user, which was incorrect for customized user models.
- Generated feature specs no longer rely on RSpec monkey patches.
1.12.1 - January 7, 2016
- Fixed the
create_usersmigration generated by
rails generate clearance:installunder Rails 3.x.
1.12.0 - November 17, 2015
- Users will now see a flash message when redirected to sign in by
require_login. This I18n key for this message is
flashes.failure_when_not_signed_inand defaults to "Please sign in to continue".
- Added significant API documentation. API documentation effort is ongoing.
- Fixed expectation in the generated
- Corrected indentation of routes inserted by the routes generator.
- Corrected indentation of
include Clearance::Userwhen the install generator adds it to an existing user class.
1.11.0 - August 21, 2015
sign_in_ashelper methods to view specs. These helpers avoid errors from verified partial doubles that come from. See 462c009.
clearance:routesgenerator now properly disables internal routes in your Clearance initializer.
- Clearance now accesses the cookie jar via ActionDispatch::Request rather than
Rack::Request. This is more consistent with what Rails does internally.
Clearance::Testing::Helpershas been deprecated in favor of
Clearance::Testing::ControllerHelpers. Most users are accessing these helpers by requiring
clearance/test_unitand should be unaffected.
1.10.1 - May 15, 2015
- All clearance-provided password strategies other than BCrypt have been
deprecated. You can continue to use those strategies without a deprecation
warning by adding
clearance-deprecated_password_strategiesto your Gemfile.
1.9.0 - April 3, 2015
- The change password mailer now produces a multipart message which includes a
text part along with the previously existing HTML part. To override the text
user_modelconfigured in a Rails initializer will now be reloaded in development mode.
- Change password template now contains "Change my password" link text to address an issue linking the URL in some mail clients.
1.8.1 - March 3, 2015
- Enable cross-site request forgery protection on
sessions#create. See 7f5d56e.
- All methods included by
Clearance::Controllerare now excluded from
1.8.0 - January 23, 2015
- The remember token cookie name is now customizable via
- Fixed a redirect loop on the sign in page for applications that are still
using the deprecated
- Signed in users that attempt to visit the sign in path are now redirected. The
redirect URL defaults to the same URL used for the redirect after sign in, but
can be customized by overriding
users_controller#avoid_sign_inis now deprecated in favor of
redirect_signed_in_userswhich is more accurately named.
1.7.0 - January, 8, 2015
- Fix the negation of the
deny_accessmatcher in Rails 4.0.x on Ruby 2.2
authorizefilter has been deprecated in favor of
require_login. Update all reference to the filter including any calls to
Clearance.rootmethod has been deprecated. It was used internally and unlikely to impact external users.
1.6.1 - January 6, 2015
- Secure cookies are no longer overwritten when the user visits a non-HTTPS URL.
1.6.0 - December 20, 2014
- When using Rails 4.2, password reset emails are sent with the
1.5.1 - December 19, 2014
- Blowfish password strategy fixed
- Specs generated with
rails generate clearance:specsnow work properly in RSpec 3 projects.
1.5.0 - October 17, 2014
- Disable clearance routes by setting
config.routes = false.
rails generate clearance:routeswill dump the default set of routes to your application's routes file for modification.
1.4.3 - October 3, 2014
- Routing constraints act appropriately when session data is missing.
1.4.2 - September 13, 2014
- Eliminate deprecation message when using DenyAccess matcher with RSpec 3.
1.4.1 - September 5, 2014
- Prevent BCrypt strategy from raising an exception when
1.4.0 - July 18, 2014
user_paramsmethod was added to
Clearance::UsersControllerwhich provides a convenient place to override the parameters used when creating users.
- Controllers now inherit from
Clearance::BaseControllerto allow for easily adding behavior to all of them.
- Clearance now uses
original_fullpathwhen redirecting to a saved URL after login. This should improve the behavior in mounted engines.
1.3.0 - March 14, 2014
- Installing Clearance with an existing User model will now create a migration that includes adding remember tokens to all existing user records.
1.2.1 - March 6, 2014
- Query string is now included in the redirect URL when Clearance redirects to a previously stored URL.
1.2.0 - February 28, 2014
- Support for Rails 4.1.0.rc1
- Sign in can now be disabled with
config.allow_sign_in = false
- Sign in failure message is now customized exclusively via I18n.
SessionsController#flash_failure_after_createis no longer called. To customize the message, change the
clearance/testingis now deprecated. Require
1.1.0 - November 21, 2013
- Validate email with
cookie_expirationconfiguration lambda can now be called with a
cookiesparameter. Allows the Clearance cookie expiration to be set according to the value of another cookie (such as
- Allow cookie domain and path configuration.
- Add sign in guards.
- Don't allow logins with blank
cookie_expirationlambda that does not accept this
cookiesparameter has been deprecated.
1.0.1 - August 9, 2013
- Fix an issue when trying to sign in with
1.0.0 - August 1, 2013
- Support Rails 4.
- Speed up test suites using
- Speed up integration suites with
BCryptMigrationFromSHA1password strategy to help people migrate from SHA1 (the old default password strategy) to BCrypt (the new default).
- Support Ruby 2.
- More extension points in more controllers.
- Add a fake password strategy, which is useful when writing tests.
- Change default password strategy to BCrypt.
- Replace email regular expression with
- Require > Ruby 1.9.
remember_tokenfields of the users table are
NOT NULLin the default migration.
- Replace Cucumber feature generator with RSpec + Capybara.
- Remove Diesel dependency.
params[:user]has changed to
params[:password_reset]to avoid locale conflicts.
- Improve security when changing password.
- Reduce extra user lookups when adding cookie to headers.
- Unauthorized API requests return HTTP status 401 rather than a redirect to the sign in page.
- Remove deprecated methods on User:
unloadablefrom controllers (Rails 4 bug fix in development environment).
- Remove support for supplying
return_tovalue via request parameter.
0.16.2 - May 11, 2012
- Change default email sender to
0.16.1 - April 16, 2012
- Behave correctly when Rails whitelist attributes mass assignment protection is turned on.
- Fix for Rails 3.2.x modifying the HTTP cookie headers in rack requests.
0.16.0 - March 16, 2012
- Blowfish password encryption strategy.
0.15.0 - February 3, 2012
Usermodel can be swapped out using the
User::InstanceMethodsto silence a Rails 3.2 deprecation warning.
0.14.0 - January 13, 2012
- Support clearance session management from the Rack environment.
0.13.2 - January 13, 2012
- Fixed the
0.13.0 - October 11, 2011
- In Clearance's optional generated features, use pure Capybara instead of
depending on Cucumber's removed
web_steps, paths, and selectors.
- Extract SHA-1-specific code out of
- Extract sign in form so that other methods can be added easily.
- Test against Rails 3.1. Required upgrades to Diesel and Appraisal.
0.12.0 - June 30, 2011
- Denying access redirects to
root_urlwhen signed in,
sign_in_urlwhen signed out.
- Using flash
:noticekey everywhere now instead of
:failure. More in line with Rails conventions.
redirect_back_oron sign up.
- Resetting password no longer redirects to sign in page. It displays a message telling them to look for an email.
- Removed redundant flash messages. ("Signed in.", "Signed out.", and "You are now signed up.")
0.11.2 - June 29, 2011
- Rails 3.1.rc compatible.
- RSpec and Test::Unit compliant test matcher (
should deny_access, etc)
- No more Clearance
shoulda_macros. Instead providing RSpec and Test::Unit-compliant test matchers (
should deny_access, etc).
0.11.1 - April 30, 2011
- Redirect to home page after sign up.
validates_uniqueness_of. It was unnecessary and causes a small performance problem on some apps.
- Remove dependency on
dynamic_form. Replaced with flashes due to limited number of failure cases.
0.11.0 - April 24, 2011
controller#authenticate(params)method. Redefine username & password or other styles of authentication.
before_filter :authenticateAPI replaced with more aptly-named
- Removing password confirmation.
0.10.5 - April 19, 2011
- Closing CSRF hole for Rails >= 3.0.4 apps.
0.10.4 - April 16, 2011
- Use HTML5 email fields.
- Emails forced to be downcased (particularly for iPhone user case).
- Password reset requires a password.
- Formtastic views generator removed.
0.10.3.2 - March 6, 2011
- Fix gemspec to include all necessary files.
0.10.3.1 - February 20, 2011
- Ensure everything within features inside any engine directory is included in
0.10.3 - February 19, 2011
- Include features/engines in
gemspecfile list so generator works as expected.
0.10.2 - February 18, 2011
- New generator command:
rails generate clearance:install.
- When Clearance installed in an app that already has users, allow old users to sign in by resetting their password.
- Step definitions are now prefixed with
visitor_to use thoughtbot convention.
0.10.1 - February 9, 2011
ActionController::Forbiddenwith a user-friendly flash message.
0.10.0 - June 29, 2010
- Better email validation regular expression.
- Removed email confirmation step, was mostly a hassle and can always be added back in at the application level (instead of engine level) if necessary.
disable_withon forms since it does not allow IE users to submit forms. Read more.
0.9.1 - June 29, 2010
- This release supports Rails 3, capybara, and shoulda 2.10+.
0.9.0 - June 11, 2010
- Allow customization of cookie duration.
- Removed unnecessary db index.
0.8.8 - February 25, 2010
0.8.7 - February 21, 2010
- Fixed global sign out bug.
- Allow Rails apps to
before_filter :authenticatethe entire app in
ApplicationControllerand still have password recovery work without overriding any controllers.
- Rails 3 fix for
0.8.6 - February 17, 2010
- Allow overridden user models to skip email/password validations conditionally. This makes username/facebook integration easier.
- Clearance features capitalization should match view text.
:authenticate before_filterin controllers so apps can easily authenticate a whole site without subclassing.
- Added randomness to token and salt generation,
- Reset the
remember_tokenon sign out instead of sign in. Allows for the same user to sign in from two locations at once.
- Append the version number to generated update migrations.
0.8.5 - January 20, 2010
- Remove dependency on
Clearance.configureblock to set mailer sender instead of
- Replaced routing hack with
Clearance::Routes.draw(map)to give more control to the application developer.
- Fixed bug in password reset feature.
0.8.4 - December 08, 2009
- Remove unnecessary
require 'factory_girl'in generator.
0.8.3 - September 21, 2009
- Avoid possible collisions in the remember me token.
0.8.2 - September 01, 2009
0.8.1 - August 31, 2009
- Removed unnecessary
forget_me!user instance methods.
0.8.0 - August 31, 2009
- Always remember me. Replaced session-and-remember-me authentication with always using a cookie with a long timeout.
0.7.0 - August 4, 2009
signed_out?convenience method for controllers, helpers, views.
clearance_viewsgenerator. By default, creates formtastic views which pass all tests and features.
- Redirect signed in user who clicks confirmation link again.
- Redirect signed out user who clicks confirmation link again.
0.6.9 - July 4, 2009
- Added timestamps to create users migration.
- Ready for Ruby 1.9.
0.6.8 - June 24, 2009
defined?checks for various Rails constants such as
ActionControllerfor easier unit testing of Clearance extensions... particularly
0.6.7 - June 13, 2009
before_filterson confirmations controller.
should_be_signed_in_asshouldn't look in the session.
sign_user_in. Told developers to use
0.6.6 - May 18, 2009
Clearance::Userwith modules. This was needed so we could write our own validations.
0.6.5 - May 17, 2009
- Make Clearance i18n aware.
0.6.4 - May 12, 2009
sign_outshoulda macros with a stubbing (requires no dependency) approach. This will avoid dealing with the internals of
current_user, such as session & cookies. Added
sign_inmacro which signs in an email confirmed user from clearance's factories.
- Move private methods on sessions controller into
- Audited flash keys.
0.6.3 - April 23, 2009
ClearanceMailerproperly within controllers so it works in production environments.
0.6.2 - April 22, 2009
Clearance::Userinto User model if it exists.
0.6.1 - April 21, 2009
- Scope operators are necessary to keep Rails happy. Reverting the original revert so they're back in the library now for constants referenced inside of the gem.
0.6.0 - April 21, 2009
- Converted Clearance to a Rails engine.
Clearance::Userin User model in app.
- Namespace controllers under
- Routes move to engine, use namespaced controllers but publicly the same.
- If you want to override a controller, subclass it like
SessionsController < Clearance::SessionsController. This gives you access to usual hooks such as
- Controllers, mailer, model, routes all unit tested inside engine. Use
script/generate clearance_featuresto test integration of Clearance with your Rails app. No longer including modules in your app's test files.
- Moved views to engine.
- Converted generated
test/factories/clearance.rbto use inheritence for
- Corrected some spelling errors with methods.
- Loading clearance routes after rails routes via some monkeypatching.
- Made the clearance controllers
unloadableto stop constant loading errors in development mode.
0.5.6 - April 11, 2009
- Step definition changed for "User should see error messages" so features won't fail for certain validations.
0.5.5 - March 23, 2009
- Removing duplicate test to get rid of warning.
0.5.4 - March 21, 2009
- When users fail logging in, redirect them instead of rendering.
0.5.3 - March 5, 2009
- Clearance now works with (and requires) Shoulda 2.10.0.
0.5.2 - March 2, 2009
- Full compatible with Rails 2.3 (all tests pass)
0.5.1 - February 27, 2009
- A user with unconfirmed email who resets password now confirms email.
- Switch order of cookies and sessions to take advantage of Rails 2.3's "Rack-based lazy-loaded sessions",
- Altered generator to interact with
application.rbin Rails 2.3 apps.
- Rack-based session change altered how to test remember me cookie.
0.5.0 - February 27, 2009
- Fixed problem with Cucumber features.
- Fixed missing HTTP fluency use case.
0.4.9 - February 20, 2009
- Protect passwords & confirmations actions with forbidden filters.
- Return 403 Forbidden status code in those cases.
- Fixed bug that allowed anyone to edit another user's password.
0.4.8 - February 16, 2009
- Added documentation for the flash.
require 'test_helper'instead of
File.joinfor RR compatibility.
- Removed interpolated email address from flash message to make i18n easier.
- Standardized flash messages that refer to email delivery.
0.4.7 - February 12, 2009
Clearance::Test::TestHelperso there is one less setup step.
- All test helpers now in
0.4.6 - February 11, 2009
PrivateMethodsmodules on controllers for future RDoc reasons.
0.4.5 - February 9, 2009
- Added password reset feature to
- Only store location for
session[:return_to]for GET requests.
- Audited "sign up" naming convention. "Register" had slipped in a few places.
- Switched to
SHA1encryption. Cypher doesn't matter much for email confirmation, password reset. Better to have shorter hashes in the emails for clients who line break on 72 chars.
- Removed email downcasing because local-part is case sensitive per RFC5321.
- Removed unnecessary
0.4.4 - February 2, 2009
- Added a generator for Cucumber features.
- Standardized naming for "Sign up," "Sign in," and "Sign out".