Only allow insecure token lookup if a flag is given

Author: José Valim

lib/devise.rb

@@ -50,9 +50,10 @@ module Strategies
   mattr_accessor :secret_key
   @@secret_key = nil
 
-  # Secret key used by the key generator
-  mattr_accessor :token_generator
-  @@token_generator = nil
+  # Allow insecure token lookup. Must be used
+  # temporarily just for migration.
+  mattr_accessor :allow_insecure_token_lookup
+  @@allow_insecure_tokens_lookup = false
 
   # Custom domain or key for cookies. Not set by default
   mattr_accessor :rememberable_options
@@ -260,6 +261,10 @@ module Strategies
   mattr_accessor :paranoid
   @@paranoid = false
 
+  # Stores the token generator
+  mattr_accessor :token_generator
+  @@token_generator = nil
+
   # Default way to setup Devise. Run rails generate devise_install to create
   # a fresh initializer with all configuration values.
   def self.setup

lib/devise/models/confirmable.rb

@@ -276,13 +276,16 @@ def send_confirmation_instructions(attributes={})
         # If the user is already confirmed, create an error for the user
         # Options must have the confirmation_token
         def confirm_by_token(confirmation_token)
-          original_token = confirmation_token
+          original_token     = confirmation_token
           confirmation_token = Devise.token_generator.digest(self, :confirmation_token, confirmation_token)
+
           confirmable = find_or_initialize_with_error_by(:confirmation_token, confirmation_token)
-          unless confirmable.persisted?
+          if !confirmable.persisted? && Devise.allow_insecure_token_lookup
             confirmable = find_or_initialize_with_error_by(:confirmation_token, original_token)
           end
+
           confirmable.confirm! if confirmable.persisted?
+          confirmable.confirmation_token = original_token
           confirmable
         end
 

lib/devise/models/lockable.rb

@@ -162,14 +162,15 @@ def send_unlock_instructions(attributes={})
         # Options must have the unlock_token
         def unlock_access_by_token(unlock_token)
           original_token = unlock_token
-          unlock_token = Devise.token_generator.digest(self, :unlock_token, unlock_token)
+          unlock_token   = Devise.token_generator.digest(self, :unlock_token, unlock_token)
 
           lockable = find_or_initialize_with_error_by(:unlock_token, unlock_token)
-          unless lockable.persisted?
+          if !lockable.persisted? && Devise.allow_insecure_token_lookup
             lockable = find_or_initialize_with_error_by(:unlock_token, original_token)
           end
 
           lockable.unlock_access! if lockable.persisted?
+          lockable.unlock_token = original_token
           lockable
         end
 

lib/devise/models/recoverable.rb

@@ -112,11 +112,11 @@ def reset_password_token
         # containing an error in reset_password_token attribute.
         # Attributes must contain reset_password_token, password and confirmation
         def reset_password_by_token(attributes={})
-          original_token = attributes[:reset_password_token]
+          original_token       = attributes[:reset_password_token]
           reset_password_token = Devise.token_generator.digest(self, :reset_password_token, original_token)
 
           recoverable = find_or_initialize_with_error_by(:reset_password_token, reset_password_token)
-          unless recoverable.persisted?
+          if !recoverable.persisted? && Devise.allow_insecure_token_lookup
             recoverable = find_or_initialize_with_error_by(:reset_password_token, original_token)
           end
 
@@ -127,6 +127,8 @@ def reset_password_by_token(attributes={})
               recoverable.errors.add(:reset_password_token, :expired)
             end
           end
+
+          recoverable.reset_password_token = original_token
           recoverable
         end
 

lib/devise/token_generator.rb

@@ -10,24 +10,23 @@ def initialize(key_generator)
     end
 
     def digest(klass, column, value)
-      value.present? && OpenSSL::HMAC.hexdigest("SHA1", key_for(klass, column), value.to_s)
+      value.present? && OpenSSL::HMAC.hexdigest("SHA1", key_for(column), value.to_s)
     end
 
     def generate(klass, column)
-      adapter = klass.to_adapter
-      key     = key_for(klass, column)
+      key = key_for(column)
 
       loop do
         raw = Devise.friendly_token
         enc = OpenSSL::HMAC.hexdigest("SHA1", key, raw)
-        break [raw, enc] unless adapter.find_first({ column => enc })
+        break [raw, enc] unless klass.to_adapter.find_first({ column => enc })
       end
     end
 
     private
 
-    def key_for(klass, column)
-      @key_generator.generate_key("#{klass.name} #{column}")
+    def key_for(column)
+      @key_generator.generate_key(column.to_s)
     end
   end
 

test/controllers/passwords_controller_test.rb

@@ -4,16 +4,15 @@ class PasswordsControllerTest < ActionController::TestCase
   tests Devise::PasswordsController
   include Devise::TestHelpers
 
-  def setup
+  setup do
     request.env["devise.mapping"] = Devise.mappings[:user]
-
     @user = create_user
-    @user.send_reset_password_instructions
+    @raw  = @user.send_reset_password_instructions
   end
 
   def put_update_with_params
     put :update, "user" => {
-      "reset_password_token" => @user.reset_password_token, "password" => "123456", "password_confirmation" => "123456"
+      "reset_password_token" => @raw, "password" => "123456", "password_confirmation" => "123456"
     }
   end
 

test/integration/confirmable_test.rb

@@ -28,9 +28,7 @@ def resend_confirmation
 
   test 'user should receive a confirmation from a custom mailer' do
     User.any_instance.stubs(:devise_mailer).returns(Users::Mailer)
-
     resend_confirmation
-
     assert_equal ['[email protected]'], ActionMailer::Base.deliveries.first.from
   end
 
@@ -43,7 +41,7 @@ def resend_confirmation
   test 'user with valid confirmation token should be able to confirm an account' do
     user = create_user(:confirm => false)
     assert_not user.confirmed?
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
 
     assert_contain 'Your account was successfully confirmed.'
     assert_current_url '/'
@@ -54,7 +52,7 @@ def resend_confirmation
     swap Devise, :confirm_within => 3.days do
       user = create_user(:confirm => false, :confirmation_sent_at => 4.days.ago)
       assert_not user.confirmed?
-      visit_user_confirmation_with_token(user.confirmation_token)
+      visit_user_confirmation_with_token(user.raw_confirmation_token)
 
       assert_have_selector '#error_explanation'
       assert_contain /needs to be confirmed within 3 days/
@@ -66,7 +64,7 @@ def resend_confirmation
     swap Devise, :confirm_within => 3.days do
       user = create_user(:confirm => false, :confirmation_sent_at => 2.days.ago)
       assert_not user.confirmed?
-      visit_user_confirmation_with_token(user.confirmation_token)
+      visit_user_confirmation_with_token(user.raw_confirmation_token)
 
       assert_contain 'Your account was successfully confirmed.'
       assert_current_url '/'
@@ -78,7 +76,7 @@ def resend_confirmation
     Devise::ConfirmationsController.any_instance.stubs(:after_confirmation_path_for).returns("/?custom=1")
 
     user = create_user(:confirm => false)
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
 
     assert_current_url "/?custom=1"
   end
@@ -87,7 +85,7 @@ def resend_confirmation
     user = create_user(:confirm => false)
     user.confirmed_at = Time.now
     user.save
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
 
     assert_have_selector '#error_explanation'
     assert_contain 'already confirmed'
@@ -98,7 +96,7 @@ def resend_confirmation
     user.confirmed_at = Time.now
     user.save
 
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
     assert_contain 'already confirmed'
 
     fill_in 'email', :with => user.email
@@ -108,14 +106,14 @@ def resend_confirmation
 
   test 'sign in user automatically after confirming its email' do
     user = create_user(:confirm => false)
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
 
     assert warden.authenticated?(:user)
   end
 
   test 'increases sign count when signed in through confirmation' do
     user = create_user(:confirm => false)
-    visit_user_confirmation_with_token(user.confirmation_token)
+    visit_user_confirmation_with_token(user.raw_confirmation_token)
 
     user.reload
     assert_equal 1, user.sign_in_count
@@ -175,7 +173,7 @@ def resend_confirmation
 
   test 'confirm account with valid confirmation token in XML format should return valid response' do
     user = create_user(:confirm => false)
-    get user_confirmation_path(:confirmation_token => user.confirmation_token, :format => 'xml')
+    get user_confirmation_path(:confirmation_token => user.raw_confirmation_token, :format => 'xml')
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
   end
@@ -256,7 +254,7 @@ def visit_admin_confirmation_with_token(confirmation_token)
     admin = create_admin
     admin.update_attributes(:email => '[email protected]')
     assert_equal '[email protected]', admin.unconfirmed_email
-    visit_admin_confirmation_with_token(admin.confirmation_token)
+    visit_admin_confirmation_with_token(admin.raw_confirmation_token)
 
     assert_contain 'Your account was successfully confirmed.'
     assert_current_url '/admin_area/home'
@@ -269,15 +267,17 @@ def visit_admin_confirmation_with_token(confirmation_token)
     admin.update_attributes(:email => '[email protected]')
     assert_equal '[email protected]', admin.unconfirmed_email
 
-    confirmation_token = admin.confirmation_token
+    raw_confirmation_token = admin.raw_confirmation_token
+    admin = Admin.find(admin.id)
+
     admin.update_attributes(:email => '[email protected]')
     assert_equal '[email protected]', admin.unconfirmed_email
 
-    visit_admin_confirmation_with_token(confirmation_token)
+    visit_admin_confirmation_with_token(raw_confirmation_token)
     assert_have_selector '#error_explanation'
     assert_contain(/Confirmation token(.*)invalid/)
 
-    visit_admin_confirmation_with_token(admin.confirmation_token)
+    visit_admin_confirmation_with_token(admin.raw_confirmation_token)
     assert_contain 'Your account was successfully confirmed.'
     assert_current_url '/admin_area/home'
     assert admin.reload.confirmed?
@@ -291,7 +291,7 @@ def visit_admin_confirmation_with_token(confirmation_token)
 
     create_second_admin(:email => "[email protected]")
 
-    visit_admin_confirmation_with_token(admin.confirmation_token)
+    visit_admin_confirmation_with_token(admin.raw_confirmation_token)
     assert_have_selector '#error_explanation'
     assert_contain(/Email.*already.*taken/)
     assert admin.reload.pending_reconfirmation?

test/integration/lockable_test.rb

@@ -13,6 +13,7 @@ def send_unlock_request
     visit new_user_session_path
     click_link "Didn't receive unlock instructions?"
 
+    Devise.stubs(:friendly_token).returns("abcdef")
     fill_in 'email', :with => user.email
     click_button 'Resend unlock instructions'
   end
@@ -22,8 +23,11 @@ def send_unlock_request
 
     assert_template 'sessions/new'
     assert_contain 'You will receive an email with instructions about how to unlock your account in a few minutes'
+
+    mail = ActionMailer::Base.deliveries.last
     assert_equal 1, ActionMailer::Base.deliveries.size
-    assert_equal ['[email protected]'], ActionMailer::Base.deliveries.first.from
+    assert_equal ['[email protected]'], mail.from
+    assert_match user_unlock_path(unlock_token: 'abcdef'), mail.body.encoded
   end
 
   test 'user should receive the instructions from a custom mailer' do
@@ -75,23 +79,15 @@ def send_unlock_request
   end
 
   test "locked user should be able to unlock account" do
-    user = create_user(:locked => true)
-    assert user.access_locked?
-
-    visit_user_unlock_with_token(user.unlock_token)
+    user = create_user
+    raw  = user.lock_access!
+    visit_user_unlock_with_token(raw)
 
     assert_current_url "/users/sign_in"
     assert_contain 'Your account has been unlocked successfully. Please sign in to continue.'
-
     assert_not user.reload.access_locked?
   end
 
-  test "redirect user to sign in page after unlocking its account" do
-    user = create_user(:locked => true)
-    visit_user_unlock_with_token(user.unlock_token)
-    assert_not warden.authenticated?(:user)
-  end
-
   test "user should not send a new e-mail if already locked" do
     user = create_user(:locked => true)
     user.failed_attempts = User.maximum_attempts + 1
@@ -153,9 +149,10 @@ def send_unlock_request
   end
 
   test 'user with valid unlock token should be able to unlock account via XML request' do
-    user = create_user(:locked => true)
+    user = create_user()
+    raw  = user.lock_access!
     assert user.access_locked?
-    get user_unlock_path(:format => 'xml', :unlock_token => user.unlock_token)
+    get user_unlock_path(:format => 'xml', :unlock_token => raw)
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
   end