Download as
Browse Code »

Commit 4c24cabf4709b8421c751970fa72a9eba145b992

Authored by Dmitriy Zaporozhets
2 parents 9497b1a7 65337118
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

Merge pull request #1012 from NARKOZ/devise 

Add 10 minutes lock after 10 failed login attempts (Devise :lockable)
Showing 11 changed files with 72 additions and 41 deletions   Show diff stats
Gemfile
  Diff comments   View file @4c24cab
... ... @@ -7,7 +7,7 @@ gem "sqlite3"
7 7 gem "mysql2"
8 8  
9 9 # Auth
10   -gem "devise", "~> 1.5"
  10 +gem "devise", "~> 2.1.0"
11 11  
12 12 # GITLAB patched libs
13 13 gem "grit", :git => "https://github.com/gitlabhq/grit.git", :ref => "7f35cb98ff17d534a07e3ce6ec3d580f67402837"
... ...
Gemfile.lock
  Diff comments   View file @4c24cab
... ... @@ -148,10 +148,11 @@ GEM
148 148 nokogiri (>= 1.5.0)
149 149 daemons (1.1.8)
150 150 database_cleaner (0.8.0)
151   - devise (1.5.3)
  151 + devise (2.1.2)
152 152 bcrypt-ruby (~> 3.0)
153   - orm_adapter (~> 0.0.3)
154   - warden (~> 1.1)
  153 + orm_adapter (~> 0.1)
  154 + railties (~> 3.1)
  155 + warden (~> 1.2.1)
155 156 diff-lcs (1.1.3)
156 157 drapper (0.8.4)
157 158 email_spec (1.2.1)
... ... @@ -225,7 +226,7 @@ GEM
225 226 omniauth (1.1.0)
226 227 hashie (~> 1.2)
227 228 rack
228   - orm_adapter (0.0.7)
  229 + orm_adapter (0.3.0)
229 230 polyglot (0.3.3)
230 231 posix-spawn (0.3.6)
231 232 pry (0.9.9.6)
... ... @@ -356,7 +357,7 @@ GEM
356 357 raindrops (~> 0.7)
357 358 vegas (0.1.11)
358 359 rack (>= 1.0.0)
359   - warden (1.2.0)
  360 + warden (1.2.1)
360 361 rack (>= 1.0)
361 362 webmock (1.8.7)
362 363 addressable (>= 2.2.7)
... ... @@ -383,7 +384,7 @@ DEPENDENCIES
383 384 colored
384 385 cucumber-rails
385 386 database_cleaner
386   - devise (~> 1.5)
  387 + devise (~> 2.1.0)
387 388 drapper
388 389 email_spec
389 390 ffaker
... ...
app/controllers/application_controller.rb
  Diff comments   View file @4c24cab
... ... @@ -52,7 +52,7 @@ class ApplicationController < ActionController::Base
52 52  
53 53 def layout_by_resource
54 54 if devise_controller?
55   - "devise"
  55 + "devise_layout"
56 56 else
57 57 "application"
58 58 end
... ...
app/models/user.rb
  Diff comments   View file @4c24cab
1 1 class User < ActiveRecord::Base
2 2 include Account
3 3  
4   - devise :database_authenticatable, :token_authenticatable,
  4 + devise :database_authenticatable, :token_authenticatable, :lockable,
5 5 :recoverable, :rememberable, :trackable, :validatable, :omniauthable
6 6  
7 7 attr_accessible :email, :password, :password_confirmation, :remember_me, :bio,
8   - :name, :projects_limit, :skype, :linkedin, :twitter, :dark_scheme,
  8 + :name, :projects_limit, :skype, :linkedin, :twitter, :dark_scheme,
9 9 :theme_id, :force_random_password
10 10  
11 11 attr_accessor :force_random_password
... ...
app/views/layouts/devise.html.haml
View file @9497b1a
... ... @@ -1,6 +0,0 @@
1   -!!! 5
2   -%html{ :lang => "en"}
3   - = render "layouts/head"
4   - %body.ui_basic.login-page
5   - = render :partial => "layouts/flash"
6   - .container= yield
app/views/layouts/devise_layout.html.haml 0 → 100644
  Diff comments   View file @4c24cab
... ... @@ -0,0 +1,6 @@
  1 +!!! 5
  2 +%html{ :lang => "en"}
  3 + = render "layouts/head"
  4 + %body.ui_basic.login-page
  5 + = render :partial => "layouts/flash"
  6 + .container= yield
... ...
config/initializers/devise.rb
  Diff comments   View file @4c24cab
... ... @@ -93,10 +93,6 @@ Devise.setup do |config|
93 93 # If true, extends the user's remember period when remembered via cookie.
94 94 # config.extend_remember_period = false
95 95  
96   - # If true, uses the password salt as remember token. This should be turned
97   - # to false if you are not using database authenticatable.
98   - config.use_salt_as_remember_token = true
99   -
100 96 # Options to be passed to the created cookie. For instance, you can set
101 97 # :secure => true in order to force SSL only cookies.
102 98 # config.cookie_options = {}
... ... @@ -119,7 +115,7 @@ Devise.setup do |config|
119 115 # Defines which strategy will be used to lock an account.
120 116 # :failed_attempts = Locks an account after a number of failed attempts to sign in.
121 117 # :none = No lock strategy. You should handle locking by yourself.
122   - # config.lock_strategy = :failed_attempts
  118 + config.lock_strategy = :failed_attempts
123 119  
124 120 # Defines which key will be used when locking and unlocking an account
125 121 # config.unlock_keys = [ :email ]
... ... @@ -129,14 +125,14 @@ Devise.setup do |config|
129 125 # :time = Re-enables login after a certain amount of time (see :unlock_in below)
130 126 # :both = Enables both strategies
131 127 # :none = No unlock strategy. You should handle unlocking by yourself.
132   - # config.unlock_strategy = :both
  128 + config.unlock_strategy = :time
133 129  
134 130 # Number of authentication tries before locking an account if lock_strategy
135 131 # is failed attempts.
136   - # config.maximum_attempts = 20
  132 + config.maximum_attempts = 10
137 133  
138 134 # Time interval to unlock the account if :time is enabled as unlock_strategy.
139   - # config.unlock_in = 1.hour
  135 + config.unlock_in = 10.minutes
140 136  
141 137 # ==> Configuration for :recoverable
142 138 #
... ... @@ -160,9 +156,9 @@ Devise.setup do |config|
160 156 # Defines name of the authentication token params key
161 157 config.token_authentication_key = :private_token
162 158  
163   - # If true, authentication through token does not store user in session and needs
  159 + # Authentication through token does not store user in session and needs
164 160 # to be supplied on each request. Useful if you are using the token as API token.
165   - config.stateless_token = true
  161 + config.skip_session_storage << :token_auth
166 162  
167 163 # ==> Scopes configuration
168 164 # Turn scoped views on. Before rendering "sessions/new", it will first check for
... ...
config/locales/devise.en.yml
  Diff comments   View file @4c24cab
... ... @@ -35,13 +35,11 @@ en:
35 35 confirmed: 'Your account was successfully confirmed. You are now signed in.'
36 36 registrations:
37 37 signed_up: 'Welcome! You have signed up successfully.'
38   - inactive_signed_up: 'You have signed up successfully. However, we could not sign you in because your account is %{reason}.'
39 38 updated: 'You updated your account successfully.'
40 39 destroyed: 'Bye! Your account was successfully cancelled. We hope to see you again soon.'
41   - reasons:
42   - inactive: 'inactive'
43   - unconfirmed: 'unconfirmed'
44   - locked: 'locked'
  40 + signed_up_but_unconfirmed: 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
  41 + signed_up_but_inactive: 'You have signed up successfully. However, we could not sign you in because your account is not yet activated.'
  42 + signed_up_but_locked: 'You have signed up successfully. However, we could not sign you in because your account is locked.'
45 43 unlocks:
46 44 send_instructions: 'You will receive an email with instructions about how to unlock your account in a few minutes.'
47 45 unlocked: 'Your account was successfully unlocked. You are now signed in.'
... ...
db/migrate/20110913200833_devise_create_users.rb
  Diff comments   View file @4c24cab
1 1 class DeviseCreateUsers < ActiveRecord::Migration
2 2 def self.up
3 3 create_table(:users) do |t|
4   - t.database_authenticatable :null => false
5   - t.recoverable
6   - t.rememberable
7   - t.trackable
  4 + ## Database authenticatable
  5 + t.string :email, :null => false, :default => ""
  6 + t.string :encrypted_password, :null => false, :default => ""
8 7  
9   - # t.encryptable
10   - # t.confirmable
11   - # t.lockable :lock_strategy => :failed_attempts, :unlock_strategy => :both
12   - # t.token_authenticatable
  8 + ## Recoverable
  9 + t.string :reset_password_token
  10 + t.datetime :reset_password_sent_at
  11 +
  12 + ## Rememberable
  13 + t.datetime :remember_created_at
  14 +
  15 + ## Trackable
  16 + t.integer :sign_in_count, :default => 0
  17 + t.datetime :current_sign_in_at
  18 + t.datetime :last_sign_in_at
  19 + t.string :current_sign_in_ip
  20 + t.string :last_sign_in_ip
  21 +
  22 + ## Encryptable
  23 + # t.string :password_salt
  24 +
  25 + ## Confirmable
  26 + # t.string :confirmation_token
  27 + # t.datetime :confirmed_at
  28 + # t.datetime :confirmation_sent_at
  29 + # t.string :unconfirmed_email # Only if using reconfirmable
  30 +
  31 + ## Lockable
  32 + # t.integer :failed_attempts, :default => 0 # Only if lock strategy is :failed_attempts
  33 + # t.string :unlock_token # Only if unlock strategy is :email or :both
  34 + # t.datetime :locked_at
  35 +
  36 + # Token authenticatable
  37 + # t.string :authentication_token
  38 +
  39 + ## Invitable
  40 + # t.string :invitation_token
13 41  
14 42 t.timestamps
15 43 end
... ... @@ -18,7 +46,7 @@ class DeviseCreateUsers &lt; ActiveRecord::Migration
18 46 add_index :users, :reset_password_token, :unique => true
19 47 # add_index :users, :confirmation_token, :unique => true
20 48 # add_index :users, :unlock_token, :unique => true
21   - # add_index :users, :authentication_token, :unique => true
  49 + add_index :users, :authentication_token, :unique => true
22 50 end
23 51  
24 52 def self.down
... ...
db/migrate/20120706065612_add_lockable_to_users.rb 0 → 100644
  Diff comments   View file @4c24cab
... ... @@ -0,0 +1,6 @@
  1 +class AddLockableToUsers < ActiveRecord::Migration
  2 + def change
  3 + add_column :users, :failed_attempts, :integer, :default => 0
  4 + add_column :users, :locked_at, :datetime
  5 + end
  6 +end
... ...
db/schema.rb
  Diff comments   View file @4c24cab
... ... @@ -11,7 +11,7 @@
11 11 #
12 12 # It's strongly recommended to check this file into your version control system.
13 13  
14   -ActiveRecord::Schema.define(:version => 20120627145613) do
  14 +ActiveRecord::Schema.define(:version => 20120706065612) do
15 15  
16 16 create_table "events", :force => true do |t|
17 17 t.string "target_type"
... ... @@ -169,6 +169,8 @@ ActiveRecord::Schema.define(:version =&gt; 20120627145613) do
169 169 t.integer "theme_id", :default => 1, :null => false
170 170 t.string "bio"
171 171 t.boolean "blocked", :default => false, :null => false
  172 + t.integer "failed_attempts", :default => 0
  173 + t.datetime "locked_at"
172 174 end
173 175  
174 176 add_index "users", ["email"], :name => "index_users_on_email", :unique => true
... ...