Fix rescuing of application errors when call_app! is used.
As a consequence of the changes that were merged in #689, errors
thrown by strategies that utilize other_phase (or more specifically
call_app!), would be caught by omniauth, causing headaches for folks
looking to have those errors handled by their application. This
should allow for errors that come from the app to pass through, while
passing errors that come from the authentication phases to the fail!
handler.
Fix for incorrect order of request_validation_phase in test_mode.
@jsdalton gave an awesome report of the issue present in test_mode in #1033
The current implementation of mock_call was verifying the token for all requests, regardless of whether the current path is on the omniauth request path. The change was introduced recently in 1b784ff. See #1032 for details.
This creates two problems:
When test mode is on, the authenticity verification logic is run inappropriately against requests where this may not even be wanted.
The behavior varies from actual production behavior, potentially allowing bugs to be introduced by unwary developers.
Note that this bug was only present when OmniAuth was configured for test_mode and using the mock_call phases.
Allow passing rack-protection configuration to default request_validation_phase
This release now properly allows an instance of OmniAuth::AuthenticityTokenProtection (with passed in rack-protection configuration) to be used as the request_validation_phase.
Remove unintended side-effects on Rails app initialization order. It was potentially affecting the order of config/initializers/* in respect to gems initializers (#457)
v6.2.0
Added
Failsafe on Redis error replies in RedisCacheStoreProxy (#421) (@cristiangreco)
Rack::Attack middleware is now auto added for Rails 5.1+ apps to simplify gem setup (#431) (@fatkodima)
You can disable Rack::Attack with Rack::Attack.enabled = false (#431) (@fatkodima)
v6.1.0
Added
Provide throttle discriminator in the env throttle_data
Fixes deprecation warning in redis 4.6+ ([@ixti])
[6.6.0] - 2022-01-29
Added
Ability to have access to the request object instead of only env (still can access env with request.env) when
customizing throttle and blocklist responses with new methods Rack::Attack.blocklisted_responder= and
Rack::Attack.throttled_responder= which yield the request to your lambda. ([@NikolayRys])
Deprecated
Rack::Attack.blocklisted_response=
Rack::Attack.throttled_response=
[6.5.0] - 2021-02-07
Added
Added ability to normalize throttle discriminator by setting Rack::Attack.throttle_discriminator_normalizer (@fatkodima)
class AddAccountLink
include CGI::Util
def add_pair(job)
# yield a (name, value) pair
# You can include HTML tags and CSS, Sidekiq does not do any
# escaping so beware user data injection! Note how we use CGI's
# h escape helper.
aid = job["account_id"]
yield "Account", "<a href='/accounts/#{h aid}'>#{h aid}</a>" if aid
end
end
7.0.1
Allow an embedding process to reuse its own heartbeat thread
Change ActiveRecord::Coders::YAMLColumn default to safe_load
This adds two new configuration options The configuration options are as
follows:
config.active_storage.use_yaml_unsafe_load
When set to true, this configuration option tells Rails to use the old
"unsafe" YAML loading strategy, maintaining the existing behavior but leaving
the possible escalation vulnerability in place. Setting this option to true
is not recommended, but can aid in upgrading.
The "safe YAML" loading method does not allow all classes to be deserialized
by default. This option allows you to specify classes deemed "safe" in your
application. For example, if your application uses Symbol and Time in
serialized data, you can add Symbol and Time to the allowed list as follows:
As of v2.0.0 of this gem, it will require OmniAuth 2.0.0. This is due to changes that came with OmniAuth that required a breaking change in this gem. Because we changed the strategy's code, you should not need to change any omniauth-github specific code.
You should refer to OmniAuth's v2.0.0 release and/or the v2.0 upgrade guide when upgrading OmniAuth to v2.0.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/griffithlab/civic-server/network/alerts).
Bumps omniauth, rack-cors, rack-attack, sidekiq, rails, activeadmin and omniauth-github. These dependencies needed to be updated together. Updates
omniauth
from 1.9.2 to 2.1.1Release notes
Sourced from omniauth's releases.
... (truncated)
Commits
d2fd0fc
v2.1.1 releasef66dd2d
Merge pull request #1092 from shreyakurian02/fix_nil_error_in_callback_pathdece21b
Fixed nil error in callback_path7d90ba2
Update SECURITY.md66110da
Merge pull request #1070 from HoneyryderChuck/patch-17413f4f
Added docs showing how to integrate omniauth with rack_csrff35c0bb
Fix badges1df974b
Merge pull request #1065 from omniauth/new-CI-workflows56b369f
Update badgesdce31d7
Separate jruby and truffle ruby workflowsUpdates
rack-cors
from 1.0.6 to 2.0.0Changelog
Sourced from rack-cors's changelog.
Commits
97882eb
Support custom protocols as origins70f9126
README: Exampe for start & end string anchors908ea29
Remove incorrect wildcard usage from READMEb718a19
Update Rails6 example3b6b5af
Update rack examplea37c33e
Update Rails5 exampled83baa7
Link to SO about testing CORS47af8a8
Updates to note common issues.43a1882
Update .travis.ymlb528e2b
Update README.mdUpdates
rack-attack
from 6.0.0 to 6.6.1Release notes
Sourced from rack-attack's releases.
Changelog
Sourced from rack-attack's changelog.
... (truncated)
Commits
f5f92f4
Bump gem version to v6.6.107822ad
ci: update rubiesb0be383
Merge pull request #575 from sixpark/adriancb/update_readme8313e38
fix(documentation): Updating README with non-deprecated configuration.933c057
Lower case headers. (#573)d41abd7
Merge pull request #572 from ixti/ixti/fix-redis-4.6.0-warningsc01208a
fix: Fix redis-rb 4.6.0 deprecation warnings8218132
docs: update docs to point to main branchd0ec4de
Bump gem version to v6.6.03eca60d
Merge pull request #556 from zarqman/dalli3-and-rails7Updates
sidekiq
from 6.2.1 to 7.0.6Changelog
Sourced from sidekiq's changelog.
... (truncated)
Commits
b292bc0
prep for release1813cbd
5793404827a
Handle correctly subclasses when finding json unsafe item0b753ff
changes0592931
changescbfa0f6
Fix detecting json unsafe item within job argumentsa552633
Improve error message when checking arguments for json safety4c101d2
releasea703890
move perf lower6bd03aa
Change all repo links from mperham/sidekiq to sidekiq/sidekiqUpdates
rails
from 5.2.6 to 5.2.8.1Release notes
Sourced from rails's releases.
... (truncated)
Commits
8030cff
Preparing for 5.2.8.1 release85b72c3
Ruby 3.1 compatibilityec10235
updating version and changelog6576aa7
Change ActiveRecord::Coders::YAMLColumn default to safe_load2652133
Preparing for 5.2.8 releasea1b8a9b
Merge pull request #45027 from rails/fix-tag-helper-regressioncfef5e9
Merge pull request #44966 from fallwith/patch-1cd9d9f0
retain Ruby 2.2 compatibility for Rails 5.29f3761a
Merge branch '5-2-sec' into 5-2-stableb290430
Preparing for 5.2.7.1 releaseUpdates
activeadmin
from 1.4.3 to 2.9.0Release notes
Sourced from activeadmin's releases.
... (truncated)
Changelog
Sourced from activeadmin's changelog.
... (truncated)
Commits
ec5a516
Bump rollup from 2.34.2 to 2.35.0 (#6614)c761470
Get ready for 2.9.0 release (#6612)e055434
Bump cancancan from 3.1.0 to 3.2.0 (#6609)2c83a39
Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_60 (#6607)4f755da
Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_52 (#6610)515822e
Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_61_webpacker (#6611)4cd47d1
Bump cancancan from 3.1.0 to 3.2.0 in /gemfiles/rails_61_turbolinks (#6608)388f270
Merge pull request #6606 from activeadmin/bundler_2.288b5b9c
Use latest rubygems029b4c8
Use bundler 2.2.0Updates
omniauth-github
from 1.4.0 to 2.0.1Release notes
Sourced from omniauth-github's releases.
Commits
0ac46b5
Release 2.0.1fa3e9cf
Merge pull request #102 from jessieay/master684a74a
Upgrade omniauth-oauth2 dependency1633cbb
Merge pull request #100 from petergoldstein/feature/add_modern_rubies23cfa75
Add Ruby 2.7, 3.0, and 3.1 to the CI matrixd2d9e01
Merge pull request #96 from gogainda/patch-14ac10c7
Update ruby.ymlf4e28d9
Update ruby.yml027b861
Update ruby.yml1f77226
Merge pull request #95 from BobbyMcWho/chores-2020-01-12Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/griffithlab/civic-server/network/alerts).