2011-02-02 06:08:48 +08:00
|
|
|
source :rubygems
|
2011-02-01 09:57:29 +08:00
|
|
|
|
2011-09-27 13:28:33 +08:00
|
|
|
ONE_NINE = RUBY_VERSION >= "1.9."
|
|
|
|
|
2011-09-27 23:43:05 +08:00
|
|
|
gem 'rails', '2.3.14'
|
2011-02-01 09:57:29 +08:00
|
|
|
gem 'authlogic', '2.1.3'
|
2011-10-27 04:47:13 +08:00
|
|
|
#gem 'aws-s3', '0.6.2', :require => 'aws/s3'
|
|
|
|
# use custom gem until pull request at https://github.com/marcel/aws-s3/pull/41
|
|
|
|
# is merged into mainline. gem built from https://github.com/lukfugl/aws-s3
|
|
|
|
gem "aws-s3-instructure", "~> 0.6.2.1319643167", :require => 'aws/s3'
|
multi-factor authentication closes #9532
test plan:
* enable optional MFA, and check the following:
* normal log in should not be affected
* you can enroll in MFA from your profile page
* you can re-enroll in MFA from your profile page
* you can disable MFA from your profile page
* MFA can be reset by an admin on your user page
* when enrolled, you are asked for verification code after
username/password when logging in
* you can't access any other part of the site directly until
until entering your verification code
* enable required MFA, and check the following
* when not enrolled in MFA, and you log in, you are forced to
enroll
* you cannot disable MFA from your profile page
* you can re-enroll in MFA from your profile page
* an admin (other than himself) can reset MFA from the user page
* for enrolling in MFA
* use Google Authenticator and scan the QR code; you should have
30-seconds or so of extra leeway to enter your code
* having no SMS communication channels on your profile, the
enrollment page should just have a form to add a new phone
* having one or more SMS communication channels on your profile,
the enrollment page should list them, or allow you to create
a new one (and switch back)
* having more than one SMS communication channel on your profile,
the enrollment page should remember which one you have selected
after you click "send"
* an unconfirmed SMS channel should go to confirmed when it's used
to enroll in MFA
* you should not be able to go directly to /login/otp to enroll
if you used "Remember me" token to log in
* MFA login flow
* if configured with SMS, it should send you an SMS after you
put in your username/password; you should have about 5 minutes
of leeway to put it in
* if you don't check "remember computer" checkbox, you should have
to enter a verification code each time you log in
* if you do check it, you shouldn't have to enter your code
anymore (for three days). it also shouldn't SMS you a
verification code each time you log in
* setting MFA to required for admins should make it required for
admins, optional for other users
* with MFA enabled, directly go to /login/otp after entering
username/password but before entering a verification code; it
should send you back to the main login page
* if you enrolled via SMS, you should not be able to remove that
SMS from your profile
* there should not be a reset MFA link on a user page if they
haven't enrolled
* test a login or required enrollment sequence with CAS and/or SAML
Change-Id: I692de7405bf7ca023183e717930ee940ccf0d5e6
Reviewed-on: https://gerrit.instructure.com/12700
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
2012-08-03 05:17:50 +08:00
|
|
|
gem 'barby', '0.5.0'
|
make "stay logged in" use a one-time token
closes #6382
Previously, the "stay logged in" cookie just used the authlogic default
implementation, which is the pseudonym persistence_token. This is a
problem, because that persistence_token only ever changes when the
pseudonym password changes, so it's the same everywhere; so if that
cookie is stolen, it's valid for a very long time.
This switches us to one-time-use tokens that expire as soon as the token
logs the user in once. Each user agent also gets a different
one-time-use token.
Change-Id: I4f20cd7759fd74590e82ed55797552e342243d49
testplan:
* Check that no token is set at all when "stay logged in" isn't
selected.
* Check "stay logged in", and verify:
* That you don't have to login again after restarting your browser,
but your _normandy_session got reset.
* That if you save and try to replay using the same
pseudonym_credentials, they don't work the second time.
* That a second browser will get a different pseudonym_credentials
value, and using one token doesn't affect the other.
* That once the token is used, a new one is generated and set in
your cookies. Verify this new token works as well.
* That logging out removes the pseudonym_credentials cookie in your
browser. And also that manually restoring this cookie still
doesn't log you in, since it was removed server-side as well.
* Change your password, and verify that the existing "stay logged in"
tokens no longer work.
* Delete your pseudonym, and verify the same.
Reviewed-on: https://gerrit.instructure.com/7093
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Zach Wily <zach@instructure.com>
2011-11-22 05:20:48 +08:00
|
|
|
gem 'bcrypt-ruby', '3.0.1'
|
2011-02-01 09:57:29 +08:00
|
|
|
gem 'builder', '2.1.2'
|
|
|
|
gem 'daemons', '1.1.0'
|
|
|
|
gem 'diff-lcs', '1.1.2', :require => 'diff/lcs'
|
2012-05-21 23:13:38 +08:00
|
|
|
gem 'encrypted_cookie_store-instructure', '1.0.1', :require => 'encrypted_cookie_store'
|
2011-05-07 02:44:34 +08:00
|
|
|
gem 'erubis', '2.7.0'
|
2012-09-04 12:01:08 +08:00
|
|
|
gem 'ffi', '1.1.5'
|
2012-11-08 00:28:50 +08:00
|
|
|
gem 'hairtrigger', '0.1.14'
|
2012-09-20 08:02:55 +08:00
|
|
|
gem 'sass', '3.2.1'
|
2011-09-27 13:28:33 +08:00
|
|
|
if !ONE_NINE
|
|
|
|
gem 'fastercsv', '1.5.3'
|
|
|
|
end
|
2011-03-30 05:18:17 +08:00
|
|
|
gem 'hashery', '1.3.0', :require => 'hashery/dictionary'
|
|
|
|
gem 'highline', '1.6.1'
|
2011-08-20 04:36:53 +08:00
|
|
|
gem 'i18n', '0.6.0'
|
2011-03-30 05:18:17 +08:00
|
|
|
gem 'icalendar', '1.1.5'
|
2011-02-01 09:57:29 +08:00
|
|
|
gem 'jammit', '0.6.0'
|
2011-12-07 06:39:11 +08:00
|
|
|
gem 'json', '1.5.2'
|
2011-02-01 09:57:29 +08:00
|
|
|
# native xml parsing, diigo
|
2012-05-01 06:28:47 +08:00
|
|
|
gem 'libxml-ruby', '2.3.2', :require => 'xml/libxml'
|
2011-08-11 01:53:45 +08:00
|
|
|
gem 'macaddr', '1.0.0' # macaddr 1.2.0 tries to require 'systemu' which isn't a dependency
|
2012-08-30 23:30:43 +08:00
|
|
|
gem 'mailman', '0.5.3'
|
2011-02-01 09:57:29 +08:00
|
|
|
gem 'mime-types', '1.16', :require => 'mime/types'
|
|
|
|
# attachment_fu (even the current technoweenie one on github) does not work
|
|
|
|
# with mini_magick 3.1
|
|
|
|
gem 'mini_magick', '1.3.2'
|
2011-09-04 13:19:47 +08:00
|
|
|
gem 'netaddr', '1.5.0'
|
2012-01-11 10:12:36 +08:00
|
|
|
gem 'nokogiri', '1.5.0'
|
2011-11-01 00:23:35 +08:00
|
|
|
gem 'oauth', '0.4.5'
|
2012-04-30 23:00:36 +08:00
|
|
|
gem 'rack', '1.1.3'
|
2011-09-27 23:44:15 +08:00
|
|
|
gem 'rake', '< 0.10'
|
2012-04-18 04:11:15 +08:00
|
|
|
gem 'rdoc', '3.12'
|
2011-09-30 05:47:49 +08:00
|
|
|
gem 'ratom-instructure', '0.6.9', :require => "atom" # custom gem until necessary changes are merged into mainstream
|
2012-05-12 06:32:11 +08:00
|
|
|
if !ONE_NINE
|
|
|
|
gem 'rbx-require-relative', '0.0.5'
|
|
|
|
end
|
2011-05-07 02:44:34 +08:00
|
|
|
gem 'rdiscount', '1.6.8'
|
2011-06-16 04:17:53 +08:00
|
|
|
gem 'require_relative', '1.0.1'
|
2011-05-25 03:12:22 +08:00
|
|
|
gem 'ritex', '1.0.1'
|
multi-factor authentication closes #9532
test plan:
* enable optional MFA, and check the following:
* normal log in should not be affected
* you can enroll in MFA from your profile page
* you can re-enroll in MFA from your profile page
* you can disable MFA from your profile page
* MFA can be reset by an admin on your user page
* when enrolled, you are asked for verification code after
username/password when logging in
* you can't access any other part of the site directly until
until entering your verification code
* enable required MFA, and check the following
* when not enrolled in MFA, and you log in, you are forced to
enroll
* you cannot disable MFA from your profile page
* you can re-enroll in MFA from your profile page
* an admin (other than himself) can reset MFA from the user page
* for enrolling in MFA
* use Google Authenticator and scan the QR code; you should have
30-seconds or so of extra leeway to enter your code
* having no SMS communication channels on your profile, the
enrollment page should just have a form to add a new phone
* having one or more SMS communication channels on your profile,
the enrollment page should list them, or allow you to create
a new one (and switch back)
* having more than one SMS communication channel on your profile,
the enrollment page should remember which one you have selected
after you click "send"
* an unconfirmed SMS channel should go to confirmed when it's used
to enroll in MFA
* you should not be able to go directly to /login/otp to enroll
if you used "Remember me" token to log in
* MFA login flow
* if configured with SMS, it should send you an SMS after you
put in your username/password; you should have about 5 minutes
of leeway to put it in
* if you don't check "remember computer" checkbox, you should have
to enter a verification code each time you log in
* if you do check it, you shouldn't have to enter your code
anymore (for three days). it also shouldn't SMS you a
verification code each time you log in
* setting MFA to required for admins should make it required for
admins, optional for other users
* with MFA enabled, directly go to /login/otp after entering
username/password but before entering a verification code; it
should send you back to the main login page
* if you enrolled via SMS, you should not be able to remove that
SMS from your profile
* there should not be a reset MFA link on a user page if they
haven't enrolled
* test a login or required enrollment sequence with CAS and/or SAML
Change-Id: I692de7405bf7ca023183e717930ee940ccf0d5e6
Reviewed-on: https://gerrit.instructure.com/12700
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
2012-08-03 05:17:50 +08:00
|
|
|
gem 'rotp', '1.4.1'
|
|
|
|
gem 'rqrcode', '0.4.2'
|
2011-02-01 09:57:29 +08:00
|
|
|
gem 'rscribd', '1.2.0'
|
2012-08-15 02:52:10 +08:00
|
|
|
gem 'net-ldap', '0.3.1', :require => 'net/ldap'
|
2012-09-29 06:02:02 +08:00
|
|
|
gem 'ruby-saml-mod', '0.1.19'
|
2011-04-08 07:01:32 +08:00
|
|
|
gem 'rubycas-client', '2.2.1'
|
2011-02-01 09:57:29 +08:00
|
|
|
gem 'rubyzip', '0.9.4', :require => 'zip/zip'
|
2012-01-11 10:12:36 +08:00
|
|
|
gem 'sanitize', '2.0.3'
|
2011-06-11 00:07:31 +08:00
|
|
|
gem 'uuid', '2.3.2'
|
2011-02-01 09:57:29 +08:00
|
|
|
gem 'will_paginate', '2.3.15'
|
2011-03-30 05:18:17 +08:00
|
|
|
gem 'xml-simple', '1.0.12', :require => 'xmlsimple'
|
2011-03-30 05:30:40 +08:00
|
|
|
# this is only needed by jammit, but we're pinning at 0.9.4 because 0.9.5 breaks
|
|
|
|
gem 'yui-compressor', '0.9.4'
|
2012-05-08 04:18:47 +08:00
|
|
|
gem 'foreigner', '0.9.2'
|
2012-08-21 07:41:42 +08:00
|
|
|
gem 'crocodoc-ruby', '0.0.1', :require => 'crocodoc'
|
2011-02-01 09:57:29 +08:00
|
|
|
|
2012-04-19 00:24:58 +08:00
|
|
|
group :assets do
|
2012-06-14 03:54:33 +08:00
|
|
|
gem 'compass-rails', '1.0.2'
|
2012-06-27 00:22:31 +08:00
|
|
|
gem 'bootstrap-sass', '2.0.3.1'
|
2012-04-19 00:24:58 +08:00
|
|
|
end
|
|
|
|
|
2011-03-01 08:37:39 +08:00
|
|
|
group :mysql do
|
|
|
|
gem 'mysql', '2.8.1'
|
|
|
|
end
|
|
|
|
|
|
|
|
group :postgres do
|
|
|
|
gem 'pg', '0.10.1'
|
|
|
|
end
|
|
|
|
|
2011-05-21 06:15:29 +08:00
|
|
|
group :sqlite do
|
|
|
|
gem 'sqlite3-ruby', '1.3.2'
|
|
|
|
end
|
|
|
|
|
2011-02-01 09:57:29 +08:00
|
|
|
group :test do
|
2012-03-21 04:04:10 +08:00
|
|
|
gem 'coffee-script'
|
2012-04-12 06:32:26 +08:00
|
|
|
gem 'coffee-script-source', '1.3.1' #pinned so everyone's compiled output matches
|
2011-03-30 05:18:17 +08:00
|
|
|
gem 'bluecloth', '2.0.10' # for generating api docs
|
2012-04-12 06:31:15 +08:00
|
|
|
gem 'parallel', '0.5.16'
|
2012-11-06 08:26:43 +08:00
|
|
|
gem 'parallelized_specs', '0.3.38'
|
2012-08-30 04:38:30 +08:00
|
|
|
gem 'mocha', '0.12.3', :require => 'mocha_standalone'
|
2011-03-30 05:18:17 +08:00
|
|
|
gem 'rcov', '0.9.9'
|
2011-09-21 06:00:33 +08:00
|
|
|
gem 'rspec', '1.3.2'
|
|
|
|
gem 'rspec-rails', '1.3.4'
|
2012-09-11 00:34:43 +08:00
|
|
|
gem 'selenium-webdriver', '2.25.0'
|
2011-09-30 06:43:20 +08:00
|
|
|
gem 'webrat', '0.7.3'
|
2012-05-04 00:14:19 +08:00
|
|
|
gem 'yard', '0.8.0'
|
2011-09-27 13:28:33 +08:00
|
|
|
if ONE_NINE
|
|
|
|
gem 'test-unit', '1.2.3'
|
|
|
|
end
|
2011-02-01 09:57:29 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
group :development do
|
2012-03-21 04:04:10 +08:00
|
|
|
gem 'coffee-script'
|
2012-04-12 06:32:26 +08:00
|
|
|
gem 'coffee-script-source', '1.3.1' #pinned so everyone's compiled output matches
|
2012-04-12 06:31:15 +08:00
|
|
|
gem 'parallel', '0.5.16'
|
2011-09-27 13:28:33 +08:00
|
|
|
if ONE_NINE
|
2012-05-13 04:44:03 +08:00
|
|
|
gem 'debugger', '1.1.3'
|
2011-09-27 13:28:33 +08:00
|
|
|
else
|
|
|
|
gem 'ruby-debug', '0.10.4'
|
|
|
|
end
|
2012-06-13 06:07:14 +08:00
|
|
|
gem 'guard', '1.0.3'
|
|
|
|
end
|
|
|
|
|
|
|
|
group :i18n_tools do
|
2011-06-16 23:22:00 +08:00
|
|
|
gem 'ruby_parser', '2.0.6'
|
|
|
|
gem 'sexp_processor', '3.0.5'
|
2011-07-16 00:59:22 +08:00
|
|
|
gem 'ya2yaml', '0.30'
|
2011-02-01 09:57:29 +08:00
|
|
|
end
|
|
|
|
|
2011-03-23 07:02:27 +08:00
|
|
|
group :redis do
|
2012-06-13 00:17:36 +08:00
|
|
|
gem 'instructure-redis-store', '1.0.0.1.instructure1', :require => 'redis-store'
|
|
|
|
gem 'redis', '3.0.1'
|
2011-03-23 07:02:27 +08:00
|
|
|
end
|
|
|
|
|
2012-09-25 04:05:43 +08:00
|
|
|
group :cassandra do
|
|
|
|
gem 'cassandra-cql', '1.1.1'
|
|
|
|
end
|
|
|
|
|
2012-05-16 05:15:11 +08:00
|
|
|
group :embedly do
|
|
|
|
gem 'embedly', '1.5.5'
|
|
|
|
end
|
|
|
|
|
2012-08-02 04:36:26 +08:00
|
|
|
group :statsd do
|
|
|
|
gem 'statsd-ruby', '1.0.0', :require => 'statsd'
|
|
|
|
end
|
|
|
|
|
2011-02-01 09:57:29 +08:00
|
|
|
# Non-standard Canvas extension to Bundler behavior -- load the Gemfiles from
|
|
|
|
# plugins.
|
|
|
|
Dir[File.join(File.dirname(__FILE__),'vendor/plugins/*/Gemfile')].each do |g|
|
|
|
|
eval(File.read(g))
|
|
|
|
end
|