canvas-lms/Gemfile

151 lines
4.2 KiB
Ruby
Raw Normal View History

source :rubygems
2011-02-01 09:57:29 +08:00
ONE_NINE = RUBY_VERSION >= "1.9."
gem 'rails', '2.3.15'
2011-02-01 09:57:29 +08:00
gem 'authlogic', '2.1.3'
#gem 'aws-s3', '0.6.2', :require => 'aws/s3'
# use custom gem until pull request at https://github.com/marcel/aws-s3/pull/41
# is merged into mainline. gem built from https://github.com/lukfugl/aws-s3
gem "aws-s3-instructure", "0.6.2.1352914936", :require => 'aws/s3'
multi-factor authentication closes #9532 test plan: * enable optional MFA, and check the following: * normal log in should not be affected * you can enroll in MFA from your profile page * you can re-enroll in MFA from your profile page * you can disable MFA from your profile page * MFA can be reset by an admin on your user page * when enrolled, you are asked for verification code after username/password when logging in * you can't access any other part of the site directly until until entering your verification code * enable required MFA, and check the following * when not enrolled in MFA, and you log in, you are forced to enroll * you cannot disable MFA from your profile page * you can re-enroll in MFA from your profile page * an admin (other than himself) can reset MFA from the user page * for enrolling in MFA * use Google Authenticator and scan the QR code; you should have 30-seconds or so of extra leeway to enter your code * having no SMS communication channels on your profile, the enrollment page should just have a form to add a new phone * having one or more SMS communication channels on your profile, the enrollment page should list them, or allow you to create a new one (and switch back) * having more than one SMS communication channel on your profile, the enrollment page should remember which one you have selected after you click "send" * an unconfirmed SMS channel should go to confirmed when it's used to enroll in MFA * you should not be able to go directly to /login/otp to enroll if you used "Remember me" token to log in * MFA login flow * if configured with SMS, it should send you an SMS after you put in your username/password; you should have about 5 minutes of leeway to put it in * if you don't check "remember computer" checkbox, you should have to enter a verification code each time you log in * if you do check it, you shouldn't have to enter your code anymore (for three days). it also shouldn't SMS you a verification code each time you log in * setting MFA to required for admins should make it required for admins, optional for other users * with MFA enabled, directly go to /login/otp after entering username/password but before entering a verification code; it should send you back to the main login page * if you enrolled via SMS, you should not be able to remove that SMS from your profile * there should not be a reset MFA link on a user page if they haven't enrolled * test a login or required enrollment sequence with CAS and/or SAML Change-Id: I692de7405bf7ca023183e717930ee940ccf0d5e6 Reviewed-on: https://gerrit.instructure.com/12700 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Brian Palmer <brianp@instructure.com>
2012-08-03 05:17:50 +08:00
gem 'barby', '0.5.0'
make "stay logged in" use a one-time token closes #6382 Previously, the "stay logged in" cookie just used the authlogic default implementation, which is the pseudonym persistence_token. This is a problem, because that persistence_token only ever changes when the pseudonym password changes, so it's the same everywhere; so if that cookie is stolen, it's valid for a very long time. This switches us to one-time-use tokens that expire as soon as the token logs the user in once. Each user agent also gets a different one-time-use token. Change-Id: I4f20cd7759fd74590e82ed55797552e342243d49 testplan: * Check that no token is set at all when "stay logged in" isn't selected. * Check "stay logged in", and verify: * That you don't have to login again after restarting your browser, but your _normandy_session got reset. * That if you save and try to replay using the same pseudonym_credentials, they don't work the second time. * That a second browser will get a different pseudonym_credentials value, and using one token doesn't affect the other. * That once the token is used, a new one is generated and set in your cookies. Verify this new token works as well. * That logging out removes the pseudonym_credentials cookie in your browser. And also that manually restoring this cookie still doesn't log you in, since it was removed server-side as well. * Change your password, and verify that the existing "stay logged in" tokens no longer work. * Delete your pseudonym, and verify the same. Reviewed-on: https://gerrit.instructure.com/7093 Tested-by: Hudson <hudson@instructure.com> Reviewed-by: Cody Cutrer <cody@instructure.com> Reviewed-by: Zach Wily <zach@instructure.com>
2011-11-22 05:20:48 +08:00
gem 'bcrypt-ruby', '3.0.1'
2011-02-01 09:57:29 +08:00
gem 'builder', '2.1.2'
gem 'canvas_connect'
2011-02-01 09:57:29 +08:00
gem 'daemons', '1.1.0'
gem 'diff-lcs', '1.1.2', :require => 'diff/lcs'
gem 'encrypted_cookie_store-instructure', '1.0.2', :require => 'encrypted_cookie_store'
gem 'erubis', '2.7.0'
gem 'ffi', '1.1.5'
gem 'hairtrigger', '0.1.14'
gem 'sass', '3.2.1'
if !ONE_NINE
gem 'fastercsv', '1.5.3'
end
gem 'hashery', '1.3.0', :require => 'hashery/dictionary'
gem 'highline', '1.6.1'
gem 'i18n', '0.6.0'
gem 'icalendar', '1.1.5'
2011-02-01 09:57:29 +08:00
gem 'jammit', '0.6.0'
gem 'json', '1.5.2'
2011-02-01 09:57:29 +08:00
# native xml parsing, diigo
gem 'libxml-ruby', '2.3.2', :require => 'xml/libxml'
gem 'macaddr', '1.0.0' # macaddr 1.2.0 tries to require 'systemu' which isn't a dependency
if !ONE_NINE
# mail gem v2.5.* introduces a failure on 1.8 with bad unicode in headers
gem 'mail', '2.4.4'
end
gem 'mailman', '0.5.3'
gem 'mime-types', '1.17.2', :require => 'mime/types'
2011-02-01 09:57:29 +08:00
# attachment_fu (even the current technoweenie one on github) does not work
# with mini_magick 3.1
gem 'mini_magick', '1.3.2'
gem 'netaddr', '1.5.0'
gem 'nokogiri', '1.5.5'
gem 'oauth', '0.4.5'
gem 'rack', '1.1.3'
gem 'rake', '< 0.10'
gem 'rdoc', '3.12'
gem 'ratom-instructure', '0.6.9', :require => "atom" # custom gem until necessary changes are merged into mainstream
if !ONE_NINE
gem 'rbx-require-relative', '0.0.5'
end
gem 'rdiscount', '1.6.8'
gem 'require_relative', '1.0.1'
gem 'ritex', '1.0.1'
multi-factor authentication closes #9532 test plan: * enable optional MFA, and check the following: * normal log in should not be affected * you can enroll in MFA from your profile page * you can re-enroll in MFA from your profile page * you can disable MFA from your profile page * MFA can be reset by an admin on your user page * when enrolled, you are asked for verification code after username/password when logging in * you can't access any other part of the site directly until until entering your verification code * enable required MFA, and check the following * when not enrolled in MFA, and you log in, you are forced to enroll * you cannot disable MFA from your profile page * you can re-enroll in MFA from your profile page * an admin (other than himself) can reset MFA from the user page * for enrolling in MFA * use Google Authenticator and scan the QR code; you should have 30-seconds or so of extra leeway to enter your code * having no SMS communication channels on your profile, the enrollment page should just have a form to add a new phone * having one or more SMS communication channels on your profile, the enrollment page should list them, or allow you to create a new one (and switch back) * having more than one SMS communication channel on your profile, the enrollment page should remember which one you have selected after you click "send" * an unconfirmed SMS channel should go to confirmed when it's used to enroll in MFA * you should not be able to go directly to /login/otp to enroll if you used "Remember me" token to log in * MFA login flow * if configured with SMS, it should send you an SMS after you put in your username/password; you should have about 5 minutes of leeway to put it in * if you don't check "remember computer" checkbox, you should have to enter a verification code each time you log in * if you do check it, you shouldn't have to enter your code anymore (for three days). it also shouldn't SMS you a verification code each time you log in * setting MFA to required for admins should make it required for admins, optional for other users * with MFA enabled, directly go to /login/otp after entering username/password but before entering a verification code; it should send you back to the main login page * if you enrolled via SMS, you should not be able to remove that SMS from your profile * there should not be a reset MFA link on a user page if they haven't enrolled * test a login or required enrollment sequence with CAS and/or SAML Change-Id: I692de7405bf7ca023183e717930ee940ccf0d5e6 Reviewed-on: https://gerrit.instructure.com/12700 Tested-by: Jenkins <jenkins@instructure.com> Reviewed-by: Brian Palmer <brianp@instructure.com>
2012-08-03 05:17:50 +08:00
gem 'rotp', '1.4.1'
gem 'rqrcode', '0.4.2'
2011-02-01 09:57:29 +08:00
gem 'rscribd', '1.2.0'
gem 'net-ldap', '0.3.1', :require => 'net/ldap'
gem 'ruby-saml-mod', '0.1.19'
gem 'rubycas-client', '2.2.1'
2011-02-01 09:57:29 +08:00
gem 'rubyzip', '0.9.4', :require => 'zip/zip'
gem 'sanitize', '2.0.3'
gem 'uuid', '2.3.2'
2011-02-01 09:57:29 +08:00
gem 'will_paginate', '2.3.15'
gem 'xml-simple', '1.0.12', :require => 'xmlsimple'
# this is only needed by jammit, but we're pinning at 0.9.4 because 0.9.5 breaks
gem 'yui-compressor', '0.9.4'
gem 'foreigner', '0.9.2'
gem 'crocodoc-ruby', '0.0.1', :require => 'crocodoc'
2011-02-01 09:57:29 +08:00
group :assets do
gem 'compass-rails', '1.0.2'
gem 'bootstrap-sass', '2.0.3.1'
end
group :mysql do
gem 'mysql', '2.8.1'
end
group :postgres do
gem 'pg', '0.10.1'
end
group :sqlite do
gem 'sqlite3-ruby', '1.3.2'
end
2011-02-01 09:57:29 +08:00
group :test do
gem 'bluecloth', '2.0.10' # for generating api docs
gem 'parallelized_specs', '0.3.91'
gem 'mocha', '0.12.3', :require => 'mocha_standalone'
gem 'rcov', '0.9.9'
gem 'rspec', '1.3.2'
gem 'rspec-rails', '1.3.4'
gem 'selenium-webdriver', '2.27.2'
gem 'webrat', '0.7.3'
gem 'yard', '0.8.0'
if ONE_NINE
gem 'test-unit', '1.2.3'
end
2011-02-01 09:57:29 +08:00
end
group :development do
gem 'guard', '1.6.0'
gem 'rb-inotify', :require => false
gem 'rb-fsevent', :require => false
gem 'rb-fchange', :require => false
if ONE_NINE
gem 'debugger', '1.1.3'
else
gem 'ruby-debug', '0.10.4'
end
end
group :development, :test do
gem 'coffee-script'
gem 'coffee-script-source', '1.4.0' #pinned so everyone's compiled output matches
gem 'parallel', '0.5.16'
end
group :i18n_tools do
gem 'ruby_parser', '2.0.6'
gem 'sexp_processor', '3.0.5'
gem 'ya2yaml', '0.30'
2011-02-01 09:57:29 +08:00
end
group :redis do
gem 'instructure-redis-store', '1.0.0.2.instructure1', :require => 'redis-store'
gem 'redis', '3.0.1'
end
group :cassandra do
gem 'cassandra-cql', '1.1.1'
end
group :embedly do
gem 'embedly', '1.5.5'
end
group :statsd do
gem 'statsd-ruby', '1.0.0', :require => 'statsd'
end
2011-02-01 09:57:29 +08:00
# Non-standard Canvas extension to Bundler behavior -- load the Gemfiles from
# plugins.
Dir[File.join(File.dirname(__FILE__),'vendor/plugins/*/Gemfile')].each do |g|
eval(File.read(g))
end