CHANGELOG.rdoc

master¶ ↑

• bug fix

  • Generating scoped devise views now uses the correct scoped shared links partial instead of the default devise one (by @nashby)

  • Fix inheriting mailer templates from ‘Devise::Mailer`

2.2.3¶ ↑

Security announcement: blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/

• bug fix

  • Require string conversion for all values

2.2.2¶ ↑

• bug fix

  • Fix bug when checking for reconfirmable in templates

2.2.1¶ ↑

• bug fix

  • Fix regression with case_insensitive_keys

  • Fix regression when password is blank when it is invalid

2.2.0¶ ↑

• backwards incompatible changes

  • ‘headers_for` is deprecated, customize the mailer directly instead

  • All mailer methods now expect a second argument with delivery options

  • Default minimum password length is now 8 (by @carlosgaldino)

  • Support alternate sign in error message when email record does not exist (this adds a new I18n key to the locale file) (by @gabetax)

  • DeviseController responds only to HTML requests by default (call ‘DeviseController.respond_to` or `ApplicationController.respond_to` to add new formats)

  • Support Mongoid 3 onwards (by @durran)

• enhancements

  • Fix unlockable which could leak account existence on paranoid mode (by @latortuga)

  • Confirmable now has a confirm_within option to set a period while the confirmation token is still valid (by @promisedlandt)

  • Flash messages in controller now respects ‘resource_name` (by @latortuga)

  • Separate ‘sign_in` and `sign_up` on RegistrationsController (by @rubynortheast)

  • Add autofocus to default views (by @Radagaisus)

  • Unlock user on password reset (by @marcinb)

  • Allow validation callbacks to apply to virtual attributes (by @latortuga)

• bug fix

  • unconfirmed_email now uses the proper e-mail on salutation

  • Fix default email_regexp config to not allow spaces (by @kukula)

  • Fix a regression introduced on warden 1.2.1 (by @ejfinneran)

  • Properly camelize omniauth strategies (by @saizai)

  • Do not set flash messages for non navigational requests on session sign out (by @mathieul)

  • Set the proper fields as required on the lockable module (by @nickhoffman)

  • Respects Devise mailer default’s reply_to (by @mrchrisadams)

  • Properly assign resource on ‘sign_in` related action (by @adammcnamara)

  • ‘update_with_password` doesn’t change encrypted password when it is invalid (by @nashby)

  • Properly handle namespaced models on Active Record generator (by @nashby)

2.1.2¶ ↑

• enhancements

  • Handle backwards incompatibility between Rails 3.2.6 and Thor 0.15.x

• bug fix

  • Fix regression on strategy validation on previous release

2.1.1 (yanked)¶ ↑

• enhancements

  • ‘sign_out_all_scopes` now locks warden and does not allow new logins in the same action

  • ‘Devise.omniauth_path_prefix` is available to configure omniauth path prefix

  • Redirect to sign in page when trying to access password#edit without a token (by @gbataille)

  • Allow a lambda in authenticate(d) routes helpers to further select the scope

  • Removed warnings on Rails 3.2.6 (by @nashby)

• bug fix

  • ‘update_with_password` now relies on assign_attributes and forwards the :as option (by @wtn)

  • Do not trigger timeout on sign in related actions

  • Timeout does not explode when reset_authentication_token! is accidentally defined by Active Model (by @remomueller)

• deprecations

  • Strategy#validate() no longer validates nil resources

2.1.0¶ ↑

• enhancements

  • Add ‘check_fields!(model_class)` method on Devise::Models to check if the model includes the fields that Devise uses

  • Add ‘skip_reconfirmation!` to skip reconfirmation

  • Devise model generator now works with engines

  • Devise encryptable was moved to its new gem (github.com/plataformatec/devise-encryptable)

• deprecations

  • Deprecations warnings added on Devise 2.0 are now removed with their features

  • All devise modules should now have a ‘required_fields(klass)` module method to help gathering missing attributes

  • ‘use_salt_as_remember_token` and `apply_schema` does not have any effect since 2.0 and are now deprecated

  • ‘valid_for_authentication?` must now return a boolean

• bug fix

  • Ensure after sign in hook is not called without a resource

  • Fix a term: now on Omniauth related flash messages, we say that we’re authenticating from an omniauth provider instead of authorizing

  • Fixed redirect when authenticated mounted apps (by @hakanensari)

  • Ensure the failure app still respects config.relative_url_root

  • ‘/users/sign_in` doesn’t choke on protected attributes used to select sign in scope (by @Paymium)

  • ‘failed_attempts` is set to zero after any sign in (including via reset password) (by @rodrigoflores)

  • Added token expiration on timeout (by @antiarchitect)

  • Do not accidentally mark ‘_prefixes` as private

  • Better support for custom strategies on test helpers (by @mattconnolly)

  • Return ‘head :no_content` in SessionsController now that most JS libraries handle it (by @julianvargasalvarez)

2.0.4¶ ↑

Notes: github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0

• bug fix

  • Fix when :host is used with devise_for (by @mreinsch)

  • Fix a regression that caused Warden to be initialized too late

2.0.3 (yanked)¶ ↑

• bug fix

  • Ensure warning is not shown by mistake on apps with mounted engines

  • Fixes related to remember_token and rememberable_options

  • Ensure serializable_hash does not depend on accessible attributes

  • Ensure that timeout callback does not run on sign out action

2.0.2¶ ↑

• enhancements

  • Add devise_i18n_options to customize I18n message

• bug fix

  • Ensure Devise.available_router_name defaults to :main_app

  • Set autocomplete to off for password on edit forms

  • Better error messages in case a trackable model can’t be saved

  • Show a warning in case someone gives a pluralized name to devise generator

  • Fix test behavior for rspec subject requests (by @sj26)

2.0.1¶ ↑

• enhancements

  • Improved error messages on deprecation warnings

  • Hide Devise’s internal generators from ‘rails g` command

• bug fix

  • Removed tmp and log files from gem

2.0.0¶ ↑

• enhancements

  • Add support for e-mail reconfirmation on change (by @Mandaryn and @heimidal)

  • Redirect users to sign in page after unlock (by @nashby)

  • Redirect to the previous URL on timeout

  • Inherit from the same Devise parent controller (by @sj26)

  • Allow parent_controller to be customizable via Devise.parent_controller, useful for engines

  • Allow router_name to be customizable via Devise.router_name, useful for engines

  • Allow alternate ORMs to run compatibility setup code before Authenticatable is included (by @jm81)

• deprecation

  • Devise now only supports Rails 3.1 forward

  • Devise.confirm_within was deprecated in favor Devise.allow_unconfirmed_access_for

  • Devise.stateless_token= is deprecated in favor of appending :token_auth to Devise.skip_session_storage

  • Usage of Devise.apply_schema is deprecated

  • Usage of Devise migration helpers are deprecated

  • Usage of Devise.remember_across_browsers was deprecated

  • Usage of rememberable with remember_token was removed

  • Usage of recoverable without reset_password_sent_at was removed

  • Usage of Devise.case_insensitive_keys equals to false was removed

  • Move devise/shared/_links.erb to devise/_links.erb

  • Deprecated support of nested devise_for blocks

  • Deprecated support to devise.registrations.reasons and devise.registrations.inactive_signed_up in favor of devise.registrations.signed_up_but_*

  • Protected method render_with_scope was removed.

1.5.3¶ ↑

• bug fix

  • Ensure delegator converts scope to symbol (by @dmitriy-kiriyenko)

  • Ensure passing :format => false to devise_for is not permanent

  • Ensure path checker does not check invalid routes

1.5.2¶ ↑

• enhancements

  • Add support for Rails 3.1 new mass assignment conventions (by @kirs)

  • Add timeout_in method to Timeoutable, it can be overridden in a model (by @lest)

• bug fix

  • OmniAuth error message now shows the proper option (:strategy_class instead of :klass)

1.5.1¶ ↑

• bug fix

  • Devise should not attempt to load OmniAuth strategies. Strategies should be loaded before hand by the developer or explicitly given to Devise.

1.5.0¶ ↑

• enhancements

  • Timeoutable also skips tracking if skip_trackable is given

  • devise_for now accepts :failure_app as an option

  • Models can select the proper mailer via devise_mailer method (by @locomotivecms)

  • Migration generator now uses the change method (by @nashby)

  • Support to markerb templates on the mailer generator (by @sbounmy)

  • Support for Omniauth 1.0 (older versions are no longer supported) (by @TamiasSibiricus)

• bug fix

  • Allow idempotent API requests

  • Fix bug where logs did not show 401 as status code

  • Change paranoid settings to behave as success instead of as failure

  • Fix bug where activation messages were shown first than the credentials error message

  • Instance variables are expired after sign out

• deprecation

  • redirect_location is deprecated, please use after_sign_in_path_for

  • after_sign_in_path_for now redirects to session if any value is stored in it

1.4.9¶ ↑

• bug fix

  • url helpers were not being set under some circumstances

1.4.8¶ ↑

• enhancements

  • Add docs for assets pipeline and Heroku

• bug fix

  • confirmation_url was not being set under some circumstances

1.4.7¶ ↑

• bug fix

  • Fix backward incompatible change from 1.4.6 for those using custom controllers

1.4.6 (yanked)¶ ↑

• enhancements

  • Allow devise_for :skip => :all

  • Allow options to be passed to authenticate_user!

  • Allow –skip-routes to devise generator

  • Add allow_params_authentication! to make it explicit when params authentication is allowed in a controller

1.4.5¶ ↑

• bug fix

  • Failure app tries the root path if a session one does not exist

  • No need to finalize Devise helpers all the time (by @bradleypriest)

  • Reset password shows proper message if user is not active

  • ‘clean_up_passwords` sets the accessors to nil to skip validations

1.4.4¶ ↑

• bug fix

  • Do not always skip helpers, instead provide :skip_helpers as option to trigger it manually

1.4.3¶ ↑

• enhancements

  • Improve Rails 3.1 compatibility

  • Use serialize_into_session and serialize_from_session in Warden serialize to improve extensibility

• bug fix

  • Generator properly generates a change_table migration if a model already exists

  • Properly deprecate setup_mail

  • Fix encoding issues with email regexp

  • Only generate helpers for the used mappings

  • Wrap :action constraints in the proper hash

• deprecations

  • Loosened the used email regexp to simply assert the existent of “@”. If someone relies on a more strict regexp, they may use github.com/SixArm/sixarm_ruby_email_address_validation

1.4.2¶ ↑

• bug fix

  • Provide a more robust behavior to serializers and add :force_except option

1.4.1¶ ↑

• enhancements

  • Add :defaults and :format support on router

  • Add simple form generators

  • Better localization for devise_error_messages! (by @zedtux)

• bug fix

  • Ensure to_xml is properly white listened

  • Ensure handle_unverified_request clean up any cached signed-in user

1.4.0¶ ↑

• enhancements

  • Added authenticated and unauthenticated to the router to route the used based on his status (by @sj26)

  • Improve e-mail regexp (by @rodrigoflores)

  • Add strip_whitespace_keys and default to e-mail (by @swrobel)

  • Do not run format and uniqueness validations on e-mail if it hasn’t changed (by @Thibaut)

  • Added update_without_password to update models but not allowing the password to change (by @fschwahn)

  • Added config.paranoid, check the generator for more information (by @rodrigoflores)

• bug fix

  • password_required? should not affect length validation

  • User cannot access sign up and similar pages if he is already signed in through a cookie or token

  • Do not convert booleans to strings on finders (by @xavier)

  • Run validations even if current_password fails (by @crx)

  • Devise now honors routes constraints (by @macmartine)

  • Do not return the user resource when requesting instructions (by @rodrigoflores)

1.3.4¶ ↑

• bug fix

  • Do not add formats if html or “/”

1.3.3¶ ↑

• bug fix

  • Explicitly mark the token as expired if so

1.3.2¶ ↑

• bug fix

  • Fix another regression related to reset_password_sent_at (by @alexdreher)

1.3.1¶ ↑

• enhancements

  • Improve failure_app responses (by @indirect)

  • sessions/new and registrations/new also respond to xml and json now

• bug fix

  • Fix a regression that occurred if reset_password_sent_at is not present (by @stevehodgkiss)

1.3.0¶ ↑

• enhancements

  • All controllers can now handle different mime types than html using Responders (by @sikachu)

  • Added reset_password_within as configuration option to send the token for recovery (by @jdguyot)

  • Bump password length to 128 characters (by @k33l0r)

  • Add :only as option to devise_for (by @timoschilling)

  • Allow to override path after sending password instructions (by @irohiroki)

  • require_no_authentication has its own flash message (by @jackdempsey)

• bug fix

  • Fix a bug where configuration options were being included too late

  • Ensure Devise::TestHelpers can be used to tests Devise internal controllers (by @jwilger)

  • valid_password? should not choke on empty passwords (by @mikel)

  • Calling devise more than once does not include previously added modules anymore

  • downcase_keys before validation

• backward incompatible changes

  • authentication_keys are no longer considered when creating the e-mail validations, the previous behavior was buggy. You must double check if you were relying on such behavior.

1.2.1¶ ↑

• enhancements

  • Improve update path messages

1.2.0¶ ↑

• bug fix

  • Properly ignore path prefix on omniauthable

  • Faster uniqueness queries

  • Rename active? to active_for_authentication? to avoid conflicts

1.2.rc2¶ ↑

• enhancements

  • Make friendly_token 20 chars long

  • Use secure_compare

• bug fix

  • Fix an issue causing infinite redirects in production

  • rails g destroy works properly with devise generators (by @andmej)

  • before_failure callbacks should work on test helpers (by @twinge)

  • rememberable cookie now is httponly by default (by @JamesFerguson)

  • Add missing confirmation_keys (by @JohnPlummer)

  • Ensure after_* hooks are called on RegistrationsController

  • When using database_authenticatable Devise will now only create an email field when appropriate (if using default authentication_keys or custom authentication_keys with email included)

  • Ensure stateless token does not trigger timeout (by @pixelauthority)

  • Implement handle_unverified_request for Rails 3.0.4 compatibility and improve FailureApp reliance on symbols

  • Consider namespaces while generating routes

  • Custom failure apps no longer ignored in test mode (by @jaghion)

  • Do not depend on ActiveModel::Dirty

  • Manual sign_in now triggers remember token

  • Be sure to halt strategies on failures

  • Consider SCRIPT_NAME on Omniauth paths

  • Reset failed attempts when lock is expired

  • Ensure there is no Mongoid injection

• deprecations

  • Deprecated anybody_signed_in? in favor of signed_in? (by @gavinhughes)

  • Removed –haml and –slim view templates

  • Devise::OmniAuth helpers were deprecated and removed in favor of Omniauth.config.test_mode

1.2.rc¶ ↑

• deprecations

  • cookie_domain is deprecated in favor of cookie_options

  • after_update_path_for can no longer be defined in ApplicationController

• enhancements

  • Added OmniAuth support

  • Added ORM adapter to abstract ORM iteraction

  • sign_out_via is available in the router to configure the method used for sign out (by @martinrehfeld)

  • Improved Ajax requests handling in failure app (by @spastorino)

  • Added request_keys to easily use request specific values (like subdomain) in authentication

  • Increased the size of friendly_token to 60 characters (reduces the chances of a successful brute attack)

  • Ensure the friendly token does not include “_” or “-” since some e-mails may not autolink it properly (by @rymai)

  • Extracted encryptors into :encryptable for better bcrypt support

  • :rememberable is now able to use salt as token if no remember_token is provided

  • Store the salt in session and expire the session if the user changes his password

  • Allow :stateless_token to be set to true avoiding users to be stored in session through token authentication

  • cookie_options uses session_options values by default

  • Sign up now check if the user is active or not and redirect him accordingly setting the inactive_signed_up message

  • Use ActiveModel#to_key instead of #id

  • sign_out_all_scopes now destroys the whole session

  • Added case_insensitive_keys that automatically downcases the given keys, by default downcases only e-mail (by @adahl)

• default behavior changes

  • sign_out_all_scopes defaults to true as security measure

  • http authenticatable is disabled by default

  • Devise does not intercept 401 returned from applications

• bugfix

  • after_sign_in_path_for always receives a resource

  • Do not execute Warden::Callbacks on Devise::TestHelpers (by @sgronblo)

  • Allow password recovery and account unlocking to change used keys (by @RStankov)

  • FailureApp now properly handles nil request.format

  • Fix a bug causing FailureApp to return with HTTP Auth Headers for IE7

  • Ensure namespaces has proper scoped views

  • Ensure Devise does not set empty flash messages (by @sxross)

1.1.6¶ ↑

• Use a more secure e-mail regexp

• Implement Rails 3.0.4 handle unverified request

• Use secure_compare to compare passwords

1.1.5¶ ↑

• bugfix

  • Ensure to convert keys on indifferent hash

• defaults

  • Set config.http_authenticatable to false to avoid confusion

1.1.4¶ ↑

• bugfix

  • Avoid session fixation attacks

1.1.3¶ ↑

• bugfix

  • Add reply-to to e-mail headers by default

  • Updated the views generator to respect the rails :template_engine option (by @fredwu)

  • Check the type of HTTP Authentication before using Basic headers

  • Avoid invalid_salt errors by checking salt presence (by @thibaudgg)

  • Forget user deletes the right cookie before logout, not remembering the user anymore (by @emtrane)

  • Fix for failed first-ever logins on PostgreSQL where column default is nil (by @bensie)

  • :default options is now honored in migrations

1.1.2¶ ↑

• bugfix

  • Compatibility with latest Rails routes schema

1.1.1¶ ↑

• bugfix

  • Fix a small bug where generated locale file was empty on devise:install

1.1.0¶ ↑

• enhancements

  • Rememberable module allows user to be remembered across browsers and is enabled by default (by @trevorturk)

  • Rememberable module allows you to activate the period the remember me token is extended (by @trevorturk)

  • devise_for can now be used together with scope method in routes but with a few limitations (check the documentation)

  • Support ‘as` or `devise_scope` in the router to specify controller access scope

  • HTTP Basic Auth can now be disabled/enabled for xhr(ajax) requests using http_authenticatable_on_xhr option (by @pellja)

• bug fix

  • Fix a bug in Devise::TestHelpers where current_user was returning a Response object for non active accounts

  • Devise should respect script_name and path_info contracts

  • Fix a bug when accessing a path with (.:format) (by @klacointe)

  • Do not add unlock routes unless unlock strategy is email or both

  • Email should be case insensitive

  • Store classes as string in session, to avoid serialization and stale data issues

• deprecations

  • use_default_scope is deprecated and has no effect. Use :as or :devise_scope in the router instead

1.1.rc2¶ ↑

• enhancements

  • Allow to set cookie domain for the remember token. (by @mantas)

  • Added navigational formats to specify when it should return a 302 and when a 401.

  • Added authenticate(scope) support in routes (by @wildchild)

  • Added after_update_path_for to registrations controller (by @thedelchop)

  • Allow the mailer object to be replaced through config.mailer = “MyOwnMailer”

• bug fix

  • Fix a bug where session was timing out on sign out

• deprecations

  • bcrypt is now the default encryptor

  • devise.mailer.confirmations_instructions now should be devise.mailer.confirmations_instructions.subject

  • devise.mailer.user.confirmations_instructions now should be devise.mailer.confirmations_instructions.user_subject

  • Generators now use Rails 3 syntax (devise:install) instead of devise_install

1.1.rc1¶ ↑

• enhancements

  • Rails 3 compatibility

  • All controllers and views are namespaced, for example: Devise::SessionsController and “devise/sessions”

  • Devise.orm is deprecated. This reduces the required API to hook your ORM with devise

  • Use metal for failure app

  • HTML e-mails now have proper formatting

  • Allow to give :skip and :controllers in routes

  • Move trackable logic to the model

  • E-mails now use any template available in the filesystem. Easy to create multipart e-mails

  • E-mails asks headers_for in the model to set the proper headers

  • Allow to specify haml in devise_views

  • Compatibility with Mongoid

  • Make config.devise available on config/application.rb

  • TokenAuthenticatable now works with HTTP Basic Auth

  • Allow :unlock_strategy to be :none and add :lock_strategy which can be :failed_attempts or none. Setting those values to :none means that you want to handle lock and unlocking by yourself

  • No need to append ?unauthenticated=true in URLs anymore since Flash was moved to a middleware in Rails 3

  • :activatable is included by default in your models

• bug fix

  • Fix a bug with STI

• deprecations

  • Rails 3 compatible only

  • Removed support for MongoMapper

  • Scoped views are no longer “sessions/users/new”. Now use “users/sessions/new”

  • Devise.orm is deprecated, just require “devise/orm/YOUR_ORM” instead

  • Devise.default_url_options is deprecated, just modify ApplicationController.default_url_options

  • All messages under devise.sessions, except :signed_in and :signed_out, should be moved to devise.failure

  • :as and :scope in routes is deprecated. Use :path and :singular instead

1.0.8¶ ↑

• enhancements

  • Support for latest MongoMapper

  • Added anybody_signed_in? helper (by @SSDany)

• bug fix

  • confirmation_required? is properly honored on active? calls. (by @paulrosania)

1.0.7¶ ↑

• bug fix

  • Ensure password confirmation is always required

• deprecations

  • authenticatable was deprecated and renamed to database_authenticatable

  • confirmable is not included by default on generation

1.0.6¶ ↑

• bug fix

  • Do not allow unlockable strategies based on time to access a controller.

  • Do not send unlockable email several times.

  • Allow controller to upstram custom! failures to Warden.

1.0.5¶ ↑

• bug fix

  • Use prepend_before_filter in require_no_authentication.

  • require_no_authentication on unlockable.

  • Fix a bug when giving an association proxy to devise.

  • Do not use lock! on lockable since it’s part of ActiveRecord API.

1.0.4¶ ↑

• bug fix

  • Fixed a bug when deleting an account with rememberable

  • Fixed a bug with custom controllers

1.0.3¶ ↑

• enhancements

  • HTML e-mails now have proper formatting

  • Do not remove MongoMapper options in find

1.0.2¶ ↑

• enhancements

  • Allows you set mailer content type (by @glennr)

• bug fix

  • Uses the same content type as request on http authenticatable 401 responses

1.0.1¶ ↑

• enhancements

  • HttpAuthenticatable is not added by default automatically.

  • Avoid mass assignment error messages with current password.

• bug fix

  • Fixed encryptors autoload

1.0.0¶ ↑

• deprecation

  • :old_password in update_with_password is deprecated, use :current_password instead

• enhancements

  • Added Registerable

  • Added Http Basic Authentication support

  • Allow scoped_views to be customized per controller/mailer class

  • #99

    Allow authenticatable to used in change_table statements

0.9.2¶ ↑

• bug fix

  • Ensure inactive user cannot sign in

  • Ensure redirect to proper url after sign up

• enhancements

  • Added gemspec to repo

  • Added token authenticatable (by @grimen)

0.9.1¶ ↑

• bug fix

  • Allow bigger salt size (by @jgeiger)

  • Fix relative url root

0.9.0¶ ↑

• deprecation

  • devise :all is deprecated

  • :success and :failure flash messages are now :notice and :alert

• enhancements

  • Added devise lockable (by @mhfs)

  • Warden 0.9.0 compatibility

  • Mongomapper 0.6.10 compatibility

  • Added Devise.add_module as hooks for extensions (by @grimen)

  • Ruby 1.9.1 compatibility (by @grimen)

• bug fix

  • Accept path prefix not starting with slash

  • url helpers should rely on find_scope!

0.8.2¶ ↑

• enhancements

  • Allow Devise.mailer_sender to be a proc (by @grimen)

• bug fix

  • Fix bug with passenger, update is required to anyone deploying on passenger (by @dvdpalm)

0.8.1¶ ↑

• enhancements

  • Move salt to encryptors

  • Devise::Lockable

  • Moved view links into partial and I18n’ed them

• bug fix

  • Bcrypt generator was not being loaded neither setting the proper salt

0.8.0¶ ↑

• enhancements

  • Warden 0.8.0 compatibility

  • Add an easy for map.connect “sign_in”, :controller => “sessions”, :action => “new” to work

  • Added :bcrypt encryptor (by @capotej)

• bug fix

  • sign_in_count is also increased when user signs in via password change, confirmation, etc..

  • More DataMapper compatibility (by @lancecarlson)

• deprecation

  • Removed DeviseMailer.sender

0.7.5¶ ↑

• enhancements

  • Set a default value for mailer to avoid find_template issues

  • Add models configuration to MongoMapper::EmbeddedDocument as well

0.7.4¶ ↑

• enhancements

  • Extract Activatable from Confirmable

  • Decouple Serializers from Devise modules

0.7.3¶ ↑

• bug fix

  • Give scope to the proper model validation

• enhancements

  • Mail views are scoped as well

  • Added update_with_password for authenticatable

  • Allow render_with_scope to accept :controller option

0.7.2¶ ↑

• deprecation

  • Renamed reset_confirmation! to resend_confirmation!

  • Copying locale is part of the installation process

• bug fix

  • Fixed render_with_scope to work with all controllers

  • Allow sign in with two different users in Devise::TestHelpers

0.7.1¶ ↑

• enhancements

  • Small enhancements for other plugins compatibility (by @grimen)

0.7.0¶ ↑

• deprecations

  • :authenticatable is not included by default anymore

• enhancements

  • Improve loading process

  • Extract SessionSerializer from Authenticatable

0.6.3¶ ↑

• bug fix

  • Added trackable to migrations

  • Allow inflections to work

0.6.2¶ ↑

• enhancements

  • More DataMapper compatibility

  • Devise::Trackable - track sign in count, timestamps and ips

0.6.1¶ ↑

• enhancements

  • Devise::Timeoutable - timeout sessions without activity

  • DataMapper now accepts conditions

0.6.0¶ ↑

• deprecations

  • :authenticatable is still included by default, but yields a deprecation warning

• enhancements

  • Added DataMapper support

  • Remove store_location from authenticatable strategy and add it to failure app

  • Allow a strategy to be placed after authenticatable

  • #45

    Do not rely attribute? methods, since they are not added on Datamapper

0.5.6¶ ↑

• enhancements

  • #42

    Do not send nil to build (DataMapper compatibility)

  • #44

    Allow to have scoped views

0.5.5¶ ↑

• enhancements

  • Allow overwriting find for authentication method

  • #38

    Remove Ruby 1.8.7 dependency

0.5.4¶ ↑

• deprecations

  • Deprecate :singular in devise_for and use :scope instead

• enhancements

  • #37

    Create after_sign_in_path_for and after_sign_out_path_for hooks to be

    overwriten in ApplicationController

  • Create sign_in_and_redirect and sign_out_and_redirect helpers

  • Warden::Manager.default_scope is automatically configured to the first given scope

0.5.3¶ ↑

• bug fix

  • MongoMapper now converts DateTime to Time

  • Ensure all controllers are unloadable

• enhancements

  • #35

    Moved friendly_token to Devise

  • Added Devise.all, so you can freeze your app strategies

  • Added Devise.apply_schema, so you can turn it to false in Datamapper or MongoMapper in cases you don’t want it be handlded automatically

0.5.2¶ ↑

• enhancements

  • #28

    Improved sign_in and sign_out helpers to accepts resources

  • #28

    Added stored_location_for as a helper

  • #20

    Added test helpers

0.5.1¶ ↑

• enhancements

  • Added serializers based on Warden ones

  • Allow authentication keys to be set

0.5.0¶ ↑

• bug fix

  • Fixed a bug where remember me module was not working properly

• enhancements

  • Moved encryption strategy into the Encryptors module to allow several algorithms (by @mhfs)

  • Implemented encryptors for Clearance, Authlogic and Restful-Authentication (by @mhfs)

  • Added support for MongoMapper (by @shingara)

0.4.3¶ ↑

• bug fix

  • #29

    Authentication just fails if user cannot be serialized from session, without raising errors;

  • Default configuration values should not overwrite user values;

0.4.2¶ ↑

• deprecations

  • Renamed mail_sender to mailer_sender

• enhancements

  • skip_before_filter added in Devise controllers

  • Use home_or_root_path on require_no_authentication as well

  • Added devise_controller?, useful to select or reject filters in ApplicationController

  • Allow :path_prefix to be given to devise_for

  • Allow default_url_options to be configured through devise (:path_prefix => “/:locale” is now supported)

0.4.1¶ ↑

• bug fix

  • #21

    Ensure options can be set even if models were not loaded

0.4.0¶ ↑

• deprecations

  • Notifier is deprecated, use DeviseMailer instead. Remember to rename app/views/notifier to app/views/devise_mailer and I18n key from devise.notifier to devise.mailer

  • :authenticable calls are deprecated, use :authenticatable instead

• enhancements

  • #16

    Allow devise to be more agnostic and do not require ActiveRecord to be loaded

  • Allow Warden::Manager to be configured through Devise

  • Created a generator which creates an initializer

0.3.0¶ ↑

• bug fix

  • #15

    Allow yml messages to be configured by not using engine locales

• deprecations

  • Renamed confirm_in to confirm_within

  • #14

    Do not send confirmation messages when user changes his e-mail

  • #13

    Renamed authenticable to authenticatable and added deprecation warnings

0.2.3¶ ↑

• enhancements

  • Ensure fail! works inside strategies

  • #12

    Make unauthenticated message (when you haven’t signed in) different from invalid message

• bug fix

  • Do not redirect on invalid authenticate

  • Allow model configuration to be set to nil

0.2.2¶ ↑

• bug fix

  • #9

    Fix a bug when using customized resources

0.2.1¶ ↑

• refactor

  • Clean devise_views generator to use devise existing views

• enhancements

  • #7

    Create instance variables (like @user) for each devise controller

  • Use Devise::Controller::Helpers only internally

• bug fix

  • #6

    Fix a bug with Mongrel and Ruby 1.8.6

0.2.0¶ ↑

• enhancements

  • #4

    Allow option :null => true in authenticable migration

  • #3

    Remove attr_accessible calls from devise modules

  • Customizable time frame for rememberable with :remember_for config

  • Customizable time frame for confirmable with :confirm_in config

  • Generators for creating a resource and copy views

• optimize

  • Do not load hooks or strategies if they are not used

• bug fixes

  • #2

    Fixed requiring devise strategies

0.1.1¶ ↑

• bug fixes

  • #1

    Fixed requiring devise mapping

0.1.0¶ ↑

• Devise::Authenticable

• Devise::Confirmable

• Devise::Recoverable

• Devise::Validatable

• Devise::Migratable

• Devise::Rememberable

• SessionsController

• PasswordsController

• ConfirmationsController

• Create an example app

• devise :all, :except => :rememberable

• Use sign_in and sign_out in SessionsController

• Mailer subjects namespaced by model

• Allow stretches and pepper per model

• Store session in session

• Sign user in automatically after confirming or changing it’s password