Skip to content

🚨 [security] Upgrade devise: 4.5.0 → 4.6.1 (minor) #126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
depfu wants to merge 1 commit into from
Closed

🚨 [security] Upgrade devise: 4.5.0 → 4.6.1 (minor) #126

depfu wants to merge 1 commit into from

Conversation

@depfu
Copy link
Contributor

@depfu depfu bot commented Mar 14, 2019

🚨 Your version of devise has known security vulnerabilities 🚨

Advisory: CVE-2019-5421
Disclosed: February 07, 2019
URL: https://github.com/plataformatec/devise/issues/4981

Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module

Devise ruby gem before 4.6.0 when the lockable module is used is vulnerable to a
time-of-check time-of-use (TOCTOU) race condition due to increment_failed_attempts
within the Devise::Models::Lockable class not being concurrency safe.


🚨 We recommend to merge and deploy this update as soon as possible! 🚨

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ devise (4.5.0 → 4.6.1) · Repo · Changelog

Release Notes

4.6.1 (from changelog)

  • bug fixes
    • Check if root_path is defined with #respond_to? instead of #present (by @tegon)

4.6.0 (from changelog)

  • enhancements

    • Allow to skip email and password change notifications (by @iorme1)
    • Include the use of nil for allow_unconfirmed_access_for in the docs (by @joaumg)
    • Ignore useless files into the .gem file (by @huacnlee)
    • Explain the code that prevents enumeration attacks inside Devise::Strategies::DatabaseAuthenticatable (by @tegon)
    • Refactor the devise_error_messages! helper to render a partial (by @prograhamer)
    • Add an option (Devise.sign_in_after_change_password) to not automatically sign in a user after changing a password (by @knjko)

  • bug fixes

    • Fix missing comma in Simple Form generator (by @colinross)
    • Fix error with migration generator in Rails 6 (by @oystersauce8)
    • Set encrypted_password to nil when password is set to nil (by @sivagollapalli)
    • Consider whether the request supports flash messages inside Devise::Controllers::Helpers#is_flashing_format? (by @colinross)
    • Fix typo inside Devise::Generators::ControllersGenerator (by @kopylovvlad)
    • Sanitize parameters inside Devise::Models::Authenticatable#find_or_initialize_with_errors (by @rlue)
    • #after_database_authentication callback was not called after authentication on password reset (by @kanmaniselvan)
    • Fix corner case when #confirmation_period_valid? was called at the same second as confirmation_sent_at was set. Mostly true for date types that only have second precisions. (by @stanhu)
    • Fix unclosed li tag in error_messages partial (by @mracos)
    • Fix Routes issue when devise engine is mounted in another engine on Rails versions lower than 5.1 (by @a-barbieri)
    • Make #increment_failed_attempts concurrency safe (by @tegon)
    • Apply Test Helper fix to Rails 6.0 as well as 5.x (by @matthewrudy)

  • deprecations

    • The second argument of DatabaseAuthenticatable's #update_with_password and #update_without_password is deprecated and will be removed in the next major version. It was added to support a feature deprecated in Rails 4, so you can safely remove it from your code. (by @ihatov08)
    • The DeviseHelper.devise_error_messages! is deprecated and will be removed in the next major version. Use the devise/shared/error_messages partial instead. (by @mracos)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 57 commits:

↗️ responders (indirect, 2.4.0 → 2.4.1) · Repo · Changelog

Release Notes

2.4.1 (from changelog)

  • Add support for Rails 6 beta

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Mar 14, 2019
@depfu
Copy link
Contributor Author

depfu bot commented Sep 10, 2019

Closed in favor of #147.

@depfu depfu bot closed this Sep 10, 2019
@depfu depfu bot deleted the depfu/update/devise-4.6.1 branch September 10, 2019 02:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants