mirror of
https://github.com/heartcombo/devise.git
synced 2022-11-09 12:18:31 -05:00
Remove faux bcrypt encryptor from Devise (it was never released and it wont be until we solve the encryptable issue
This commit is contained in:
parent
4600b4ab22
commit
b07dd76453
4 changed files with 10 additions and 24 deletions
|
@ -23,7 +23,6 @@ module Devise
|
|||
module Encryptors
|
||||
autoload :Base, 'devise/encryptors/base'
|
||||
autoload :AuthlogicSha512, 'devise/encryptors/authlogic_sha512'
|
||||
autoload :BCrypt, 'devise/encryptors/bcrypt'
|
||||
autoload :ClearanceSha1, 'devise/encryptors/clearance_sha1'
|
||||
autoload :RestfulAuthenticationSha1, 'devise/encryptors/restful_authentication_sha1'
|
||||
autoload :Sha512, 'devise/encryptors/sha512'
|
||||
|
|
|
@ -1,17 +0,0 @@
|
|||
module Devise
|
||||
module Encryptors
|
||||
# Encryptor for BCrypt. It ignores the values given for salt,
|
||||
# as it is repsonsible for managing its own salt.
|
||||
class BCrypt < Base
|
||||
def self.digest(password, stretches, _salt, pepper)
|
||||
::BCrypt::Password.create("#{password}#{pepper}", :cost => stretches).to_s
|
||||
end
|
||||
|
||||
def self.compare(encrypted_password, password, _stretches, _salt, pepper)
|
||||
bcrypt = ::BCrypt::Password.new(encrypted_password)
|
||||
password = ::BCrypt::Engine.hash_secret("#{password}#{pepper}", bcrypt.salt)
|
||||
Devise.secure_compare(password, encrypted_password)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
|
@ -40,7 +40,9 @@ module Devise
|
|||
# Verifies whether an password (ie from sign in) is the user password.
|
||||
def valid_password?(password)
|
||||
return false if encrypted_password.blank?
|
||||
encryptor_class.compare(encrypted_password, password, self.class.stretches, authenticatable_salt, self.class.pepper)
|
||||
bcrypt = ::BCrypt::Password.new(encrypted_password)
|
||||
password = ::BCrypt::Engine.hash_secret("#{password}#{self.class.pepper}", bcrypt.salt)
|
||||
Devise.secure_compare(password, encrypted_password)
|
||||
end
|
||||
|
||||
# Set password and password confirmation to nil
|
||||
|
@ -105,11 +107,7 @@ module Devise
|
|||
|
||||
# Digests the password using bcrypt.
|
||||
def password_digest(password)
|
||||
encryptor_class.digest(password, self.class.stretches, ::BCrypt::Engine.generate_salt, self.class.pepper)
|
||||
end
|
||||
|
||||
def encryptor_class
|
||||
Devise::Encryptors::BCrypt
|
||||
::BCrypt::Password.create("#{password}#{self.class.pepper}", :cost => self.class.stretches).to_s
|
||||
end
|
||||
|
||||
module ClassMethods
|
||||
|
|
|
@ -35,6 +35,12 @@ module Devise
|
|||
super
|
||||
end
|
||||
|
||||
# Validates the password considering the salt.
|
||||
def valid_password?(password)
|
||||
return false if encrypted_password.blank?
|
||||
encryptor_class.compare(encrypted_password, password, self.class.stretches, authenticatable_salt, self.class.pepper)
|
||||
end
|
||||
|
||||
# Overrides authenticatable salt to use the new password_salt
|
||||
# column. authenticatable_salt is used by `valid_password?`
|
||||
# and by other modules whenever there is a need for a random
|
||||
|
|
Loading…
Add table
Reference in a new issue