1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
module Authentication
mattr_accessor :login_regex, :bad_login_message,
:name_regex, :bad_name_message,
:email_name_regex, :domain_head_regex, :domain_tld_regex, :email_regex, :bad_email_message
self.login_regex = /\A\w[\w\.\-_@]+\z/ # ASCII, strict
# self.login_regex = /\A[[:alnum:]][[:alnum:]\.\-_@]+\z/ # Unicode, strict
# self.login_regex = /\A[^[:cntrl:]\\<>\/&]*\z/ # Unicode, permissive
self.bad_login_message = "use only letters, numbers, and .-_@ please.".freeze
self.name_regex = /\A[^[:cntrl:]\\<>\/&]*\z/ # Unicode, permissive
self.bad_name_message = "avoid non-printing characters and \\><&/ please.".freeze
self.email_name_regex = '[\w\.%\+\-]+'.freeze
self.domain_head_regex = '(?:[A-Z0-9\-]+\.)+'.freeze
self.domain_tld_regex = '(?:[A-Z]{2}|com|org|net|edu|gov|mil|biz|info|mobi|name|aero|jobs|museum)'.freeze
self.email_regex = /\A#{email_name_regex}@#{domain_head_regex}#{domain_tld_regex}\z/i
self.bad_email_message = "should look like an email address.".freeze
def self.included(recipient)
recipient.extend(ModelClassMethods)
recipient.class_eval do
include ModelInstanceMethods
end
end
module ModelClassMethods
def secure_digest(*args)
Digest::SHA1.hexdigest(args.flatten.join('--'))
end
def make_token
secure_digest(Time.now, (1..10).map{ rand.to_s })
end
end # class methods
module ModelInstanceMethods
end # instance methods
module ByPassword
# Stuff directives into including module
def self.included(recipient)
recipient.extend(ModelClassMethods)
recipient.class_eval do
include ModelInstanceMethods
# Virtual attribute for the unencrypted password
attr_accessor :password
validates_presence_of :password, :if => :password_required?
validates_presence_of :password_confirmation, :if => :password_required?
validates_confirmation_of :password, :if => :password_required?
validates_length_of :password, :within => 6..40, :if => :password_required?
before_save :encrypt_password
end
end # #included directives
#
# Class Methods
#
module ModelClassMethods
# This provides a modest increased defense against a dictionary attack if
# your db were ever compromised, but will invalidate existing passwords.
# See the README and the file config/initializers/site_keys.rb
#
# It may not be obvious, but if you set REST_AUTH_SITE_KEY to nil and
# REST_AUTH_DIGEST_STRETCHES to 1 you'll have backwards compatibility with
# older versions of restful-authentication.
def password_digest(password, salt)
digest = REST_AUTH_SITE_KEY
REST_AUTH_DIGEST_STRETCHES.times do
digest = secure_digest(digest, salt, password, REST_AUTH_SITE_KEY)
end
digest
end
end # class methods
#
# Instance Methods
#
module ModelInstanceMethods
# Encrypts the password with the user salt
def encrypt(password)
self.class.password_digest(password, salt)
end
def authenticated?(password)
crypted_password == encrypt(password)
end
# before filter
def encrypt_password
return if password.blank?
self.salt = self.class.make_token if new_record?
self.crypted_password = encrypt(password)
end
def password_required?
crypted_password.blank? || !password.blank?
end
end # instance methods
end
end
|
