Repository navigation
Restore ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWED - #59627
Open
thomasklemm wants to merge 1 commit into
Open
thomasklemm wants to merge 1 commit into
thomasklemm wants to merge 1 commit into
Conversation
rails#56041 moved the constant to the new BCryptPassword class. Applications and gems use it to cap password length, for example Spree's maximum_password_length preference and open-build-service's User validation, and raise NameError on main when that code loads. Keep the public constant on SecurePassword, pointing at the BCrypt limit.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This keeps
ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWEDas a public constant that points atBCryptPassword::MAX_PASSWORD_LENGTH_ALLOWED. #56041 moved the constant into the newBCryptPasswordclass when it addedalgorithm:. The removal is unreleased.Applications and gems use the old name to cap password length, so on main they raise
NameErrorwhen the code loads:Sources: Spree 6.0.2, open-build-service master.
The constant preserves the BCrypt byte limit and is defined directly on
SecurePasswordagain, as in 8.1. Loading stays as lazy as on main:SecurePasswordalready requiresbcrypt_password.rb, and the bcrypt gem is still only required when a password is hashed. The new test fails without the constant.Found by comparing the public API of 8-1-stable and main and searching released gems and apps for callers of what was removed (record, part of my research project Lowrail).