diff --git a/FIST_BUMP.md b/FIST_BUMP.md index 79ed31c..ff9633e 100644 --- a/FIST_BUMP.md +++ b/FIST_BUMP.md @@ -6,6 +6,7 @@ A note of thanks from Grant ([@gblakeman](http://twitter.com/gblakeman)) and Jak Fist Bump! +* Thanks to Marc van Hoof (https://github.com/mvanh) for adding support for Rails Credentials. * Thanks to Nathan Broadbent (https://github.com/ndbroadbent) for finding an issue when the `HTTP_USER_AGENT` header is missing. * Thanks (again) to Dan Rabinowitz (https://github.com/danrabinowitz) for adding support for customizing the length of the cookie. * Thanks to Nathan Broadbent (https://github.com/ndbroadbent) for some nice refactoring and an additional check. diff --git a/lib/lockup.rb b/lib/lockup.rb index 8c36501..c74e08a 100644 --- a/lib/lockup.rb +++ b/lib/lockup.rb @@ -17,11 +17,17 @@ def check_for_lockup return unless respond_to?(:lockup) && lockup_codeword_present? return if cookies[:lockup].present? && cookies[:lockup] == lockup_codeword - redirect_to lockup.unlock_path(return_to: request.fullpath.split('?lockup_codeword')[0], lockup_codeword: params[:lockup_codeword]) + redirect_to lockup.unlock_path( + return_to: request.fullpath.split('?lockup_codeword')[0], + lockup_codeword: params[:lockup_codeword], + ) end def lockup_codeword_present? - ENV["LOCKUP_CODEWORD"].present? || ENV["lockup_codeword"].present? || (Rails.application.respond_to?(:secrets) && Rails.application.secrets.lockup_codeword.present?) || (Rails.application.respond_to?(:credentials) && Rails.application.credentials.lockup_codeword.present?) + ENV["LOCKUP_CODEWORD"].present? || + ENV["lockup_codeword"].present? || + (Rails.application.respond_to?(:secrets) && Rails.application.secrets.lockup_codeword.present?) || + (Rails.application.respond_to?(:credentials) && Rails.application.credentials.lockup_codeword.present?) end def lockup_codeword diff --git a/lib/lockup/version.rb b/lib/lockup/version.rb index 51f0213..0d7806d 100644 --- a/lib/lockup/version.rb +++ b/lib/lockup/version.rb @@ -1,3 +1,3 @@ module Lockup - VERSION = "1.4.3" + VERSION = "1.4.4" end diff --git a/spec/controllers/lockup/lockup_controller_spec.rb b/spec/controllers/lockup/lockup_controller_spec.rb index 47a0eb5..d620ee5 100644 --- a/spec/controllers/lockup/lockup_controller_spec.rb +++ b/spec/controllers/lockup/lockup_controller_spec.rb @@ -9,6 +9,7 @@ post 'unlock', params: {foo: 'bar'} end end + describe 'a malicious user requests a format that is not HTML' do it 'throws an unknown format error' do lambda { get 'unlock', format: 'text' }.should raise_error(ActionController::UnknownFormat)