New Audited version released, develop test may be broken

tbrisker · January 9, 2018, 10:43pm

Audited 4.6.0 has been released just now, locally it leads to new test failures due to rails change tracking deprecations, will investigate tomorrow.

tbrisker · January 10, 2018, 8:48am

Opened PR to pin audited version for now, will continue to work on fixing this correctly in our code base:

tbrisker · January 10, 2018, 10:52am

Another update - I’ve refactored the password auditing to correct this, PR at:

github.com/theforeman/foreman

Fixes #22208, #21920 - Refactor password auditing

theforeman:develop ← tbrisker:22208b

opened 10:51AM - 10 Jan 18 UTC

tbrisker

+49 -111

Recent changes in Rails 5.1 and audited gem cause our method of auditing passwo…rds to break. This PR refactors password auditing, so that instead of recording a change to attribute `password_changed`, we will now record the string `[redacted]` instead of any actual password. The change is done currently in our audit extensions, which mean that it will now apply to all resources that have a `password` attribute instead of just those that have defined the workaround. The next step will be to move this to the audited gem in a more generalized method that can be defined in the model when initializing audited, so that the workaround can be removed.

tbrisker · January 10, 2018, 1:43pm

Temporary pinning has been merged, any tests that ran today and failed on password audit issues can be safely ignored.