phatworx/devise_security_extension — pull request #34 by pcantrell (2012-04-23 23:12:23+00:00)
Title: Fixes for three bugs related to password_archivable

(1) The call to reverse_order(:id) is raising exceptions, because reverse_order is a no-args method. I don't know when it worked in the past, but it doesn't on Rails 3.2.3!

(2) Fixed a buggy behavior where password_archivable failed to detect that a user is changing their password to the same password the *first* time they do it — but then flagging it every time *after* that. The problem was that "validate :validate_password_archive" happens before the "before_update :archive_password" hook, so the first time, the current password isn't in the history. Changed it so that deny_old_passwords > 0 always disallows changing to the same password, even the first time. (Another solution would be to add the *current* password to the history as well as the *previous* one, but that seemed to mess with your code more than I was comfortable doing without unit tests.)

(3) Fixed an exception when the authenticatable model has a "password_salt" method, caused by the fact that OldPassword doesn't declare password_salt as a mass-assignable attr, but the code uses mass assignment to create OldPassword instances.