dmacvicar/devise_unix2_chkpwd_authenticatable — pull request #2 by lslezak (2012-02-06 13:32:25+00:00)
Title: Security fixes + session gem replacement

Hi, this pull request contains several fixes:

- fixed shell command injection vulnerability: escape quotes in the input, user could run any arbitrary command and/or skip the password check. Example username: ' ; /bin/touch /tmp/hacked; echo ' (including the quotes)
- fixed logging: decreased log level, don't log user password
- get rid of session gem dependency (open3 is used) - for some reason Session.new failed with "Broken pipe" error when running webyast in nginx, but when running via "rails server" it was OK
With open3 it works correctly in both scenarios, and the gem dependencies are decreased