kotovalexarian-likes-github/heartcombo--devise
1
0
Fork 0
mirror of https://github.com/heartcombo/devise.git synced 2022-11-09 12:18:31 -05:00
Code Releases Activity

Creating stretches to force encrypting password as many times as possible.

Browse source
This commit is contained in:
Carlos A. da Silva 2009-10-08 19:16:43 -03:00
parent 5c210d725f
commit 3cc61e4a96
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
lib/devise/models/authenticable.rb
View file

@ -2,9 +2,11 @@ module Devise
module Authenticable module Authenticable
require 'digest/sha1' require 'digest/sha1'
mattr_accessor :pepper, :stretches
# Pepper for encrypting password # Pepper for encrypting password
mattr_accessor :pepper
self.pepper = '23c64df433d9b08e464db5c05d1e6202dd2823f0' self.pepper = '23c64df433d9b08e464db5c05d1e6202dd2823f0'
# Encrypt password as many times as possible
self.stretches = 10
def self.included(base) def self.included(base)
base.class_eval do base.class_eval do
@ -52,7 +54,9 @@ module Devise
# incoming password # incoming password
# #
def password_digest(password_to_digest) def password_digest(password_to_digest)
secure_digest(password_salt, @@pepper, password_to_digest) digest = pepper
stretches.times { digest = secure_digest(password_salt, digest, password_to_digest, pepper)}
digest
end end
# Generate a SHA1 digest joining args. Generated token is something like # Generate a SHA1 digest joining args. Generated token is something like

3
test/models/authenticable_test.rb
View file

@ -92,8 +92,9 @@ class AuthenticableTest < ActiveSupport::TestCase
test 'should encrypt password using a sha1 hash' do test 'should encrypt password using a sha1 hash' do
Devise::Authenticable.pepper = 'pepper' Devise::Authenticable.pepper = 'pepper'
Devise::Authenticable.stretches = 1
user = create_user user = create_user
expected_password = ::Digest::SHA1.hexdigest("--#{user.password_salt}--pepper--123456--") expected_password = ::Digest::SHA1.hexdigest("--#{user.password_salt}--pepper--123456--pepper--")
assert_equal expected_password, user.encrypted_password assert_equal expected_password, user.encrypted_password
end end