Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Changeset 8229

Show
Ignore:
Timestamp:
11/28/07 19:36:59 (7 months ago)
Author:
bitsweat
Message:

Introduce SecretKeyGenerator for more secure session secrets than CGI::Session's pseudo-random id generator. Consider extracting to Active Support later. Closes #10286.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/railties/CHANGELOG

    r8160 r8229  
    11*SVN* 
     2 
     3* Introduce SecretKeyGenerator for more secure session secrets than CGI::Session's pseudo-random id generator. Consider extracting to Active Support later.  #10286 [Hongli Lai] 
    24 
    35* RAILS_GEM_VERSION may be set to any valid gem version specifier.  #10057 [Chad Woolley, Chu Yeow] 

  • trunk/railties/lib/rails_generator/generators/applications/app/app_generator.rb

    r8016 r8229  
    11require 'rbconfig' 
    22require 'digest/md5'  
     3require 'rails_generator/secret_key_generator' 
    34 
    45class AppGenerator < Rails::Generator::Base 
    …… 
    3435    md5 << @app_name 
    3536 
     37    # Do our best to generate a secure secret key for CookieStore 
     38    secret = Rails::SecretKeyGenerator.new(@app_name).generate_secret 
     39 
    3640    record do |m| 
    3741      # Root directory and all subdirectories. 
    …… 
    6266      # Environments 
    6367      m.file "environments/boot.rb",    "config/boot.rb" 
    64       m.template "environments/environment.rb", "config/environment.rb", :assigns => { :freeze => options[:freeze], :app_name => @app_name, :app_secret => md5.hexdigest } 
     68      m.template "environments/environment.rb", "config/environment.rb", :assigns => { :freeze => options[:freeze], :app_name => @app_name, :app_secret => secret } 
    6569      m.file "environments/production.rb",  "config/environments/production.rb" 
    6670      m.file "environments/development.rb", "config/environments/development.rb"