Skip to content

Commit 1c12b1a

Browse files
author
Emily Stark
committed
Merge branch 'master' into devel
Conflicts: History.md packages/accounts-password/password_server.js packages/spacebars-tests/template_tests.html packages/spacebars-tests/template_tests.js packages/ui/base.js
2 parents 2ea77a9 + 0787e2f commit 1c12b1a

28 files changed

+554
-206
lines changed

‎History.md

+122-75
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,152 @@
1-
## v.REALLY NEXT
1+
## v.NEXT
22

33
* Upgraded dependencies:
44
- less: 1.7.1 (from 1.6.1)
55

66

7-
## v.NEXT
7+
## v0.8.2
8+
9+
#### Meteor Accounts
10+
11+
* Switch `accounts-password` to use bcrypt to store passwords on the
12+
server. (Previous versions of Meteor used a protocol called SRP.)
13+
Users will be transparently transitioned when they log in. This
14+
transition is one-way, so you cannot downgrade a production app once
15+
you upgrade to 0.8.2. If you are maintaining an authenticating DDP
16+
client:
17+
- Clients that use the plaintext password login handler (i.e. call
18+
the `login` method with argument `{ password: <plaintext
19+
password> }`) will continue to work, but users will not be
20+
transitioned from SRP to bcrypt when logging in with this login
21+
handler.
22+
- Clients that use SRP will no longer work. These clients should
23+
instead directly call the `login` method, as in
24+
`Meteor.loginWithPassword`. The argument to the `login` method
25+
can be either:
26+
- `{ password: <plaintext password> }`, or
27+
- `{ password: { digest: <password hash>, algorithm: "sha-256" } }`,
28+
where the password hash is the hex-encoded SHA256 hash of the
29+
plaintext password.
30+
31+
* Show the display name of the currently logged-in user after following
32+
an email verification link or a password reset link in `accounts-ui`.
33+
34+
* Add a `userEmail` option to `Meteor.loginWithMeteorDeveloperAccount`
35+
to pre-fill the user's email address in the OAuth popup.
36+
37+
* Ensure that the user object has updated token information before
38+
it is passed to email template functions. #2210
39+
40+
* Export the function that serves the HTTP response at the end of an
41+
OAuth flow as `OAuth._endOfLoginResponse`. This function can be
42+
overridden to make the OAuth popup flow work in certain mobile
43+
environments where `window.opener` is not supported.
44+
45+
* Remove support for OAuth redirect URLs with a `redirect` query
46+
parameter. This OAuth flow was never documented and never fully
47+
worked.
48+
49+
50+
#### Blaze
51+
52+
* Blaze now tracks individual CSS rules in `style` attributes and won't
53+
overwrite changes to them made by other JavaScript libraries.
54+
55+
* Add {{> UI.dynamic}} to make it easier to dynamically render a
56+
template with a data context.
857

9-
* Migrate from SRP to bcrypt in `accounts-password`. Users will be
10-
transparently upgraded when they log in.
58+
* Add `UI._templateInstance()` for accessing the current template
59+
instance from within a block helper.
60+
61+
* Add `UI._parentData(n)` for accessing parent data contexts from
62+
within a block helper.
63+
64+
* Add preliminary API for registering hooks to run when Blaze intends to
65+
insert, move, or remove DOM elements. For example, you can use these
66+
hooks to animate nodes as they are inserted, moved, or removed. To use
67+
them, you can set the `_uihooks` property on a container DOM
68+
element. `_uihooks` is an object that can have any subset of the
69+
following three properties:
70+
71+
- `insertElement: function (node, next)`: called when Blaze intends
72+
to insert the DOM element `node` before the element `next`
73+
- `moveElement: function (node, next)`: called when Blaze intends to
74+
move the DOM element `node` before the element `next`
75+
- `removeElement: function (node)`: called when Blaze intends to
76+
remove the DOM element `node`
77+
78+
Note that when you set one of these functions on a container
79+
element, Blaze will not do the actual operation; it's your
80+
responsibility to actually insert, move, or remove the node (by
81+
calling `$(node).remove()`, for example).
1182

1283
* The `findAll` method on template instances now returns a vanilla
1384
array, not a jQuery object. The `$` method continues to
1485
return a jQuery object. #2039
1586

87+
* Fix a Blaze memory leak by cleaning up event handlers when a template
88+
instance is destroyed. #1997
89+
90+
* Fix a bug where helpers used by {{#with}} were still re-running when
91+
their reactive data sources changed after they had been removed from
92+
the DOM.
93+
94+
* Stop not updating form controls if they're focused. If a field is
95+
edited by one user while another user is focused on it, it will just
96+
lose its value but maintain its focus. #1965
97+
98+
* Add `_nestInCurrentComputation` option to `UI.render`, fixing a bug in
99+
{{#each}} when an item is added inside a computation that subsequently
100+
gets invalidated. #2156
101+
102+
* Fix bug where "=" was not allowed in helper arguments. #2157
103+
104+
* Fix bug when a template tag immediately follows a Spacebars block
105+
comment. #2175
106+
107+
108+
#### Command-line tool
109+
110+
* Add --directory flag to `meteor bundle`. Setting this flag outputs a
111+
directory rather than a tarball.
112+
16113
* Speed up updates of NPM modules by upgrading Node to include our fix for
17114
https://github.com/npm/npm/issues/3265 instead of passing `--force` to
18115
`npm install`.
19116

20117
* Always rebuild on changes to npm-shrinkwrap.json files. #1648
21118

119+
* Fix uninformative error message when deploying to long hostnames. #1208
120+
121+
* Increase a buffer size to avoid failing when running MongoDB due to a
122+
large number of processes running on the machine, and fix the error
123+
message when the failure does occur. #2158
124+
125+
* Clarify a `meteor mongo` error message when using the MONGO_URL
126+
environment variable. #1256
127+
128+
129+
#### Testing
130+
22131
* Run server tests from multiple clients serially instead of in
23132
parallel. This allows testing features that modify global server
24133
state. #2088
25134

135+
136+
#### Security
137+
26138
* Add Content-Type headers on JavaScript and CSS resources.
27139

28140
* Add `X-Content-Type-Options: nosniff` header to
29141
`browser-policy-content`'s default policy. If you are using
30142
`browser-policy-content` and you don't want your app to send this
31143
header, then call `BrowserPolicy.content.allowContentTypeSniffing()`.
32144

33-
* Fix a Blaze memory leak by cleaning up event handlers when a template
34-
instance is destroyed. #1997
145+
* Use `Meteor.absoluteUrl()` to compute the redirect URL in the `force-ssl`
146+
package (instead of the host header).
147+
148+
149+
#### Miscellaneous
35150

36151
* Allow `check` to work on the server outside of a Fiber. #2136
37152

@@ -40,96 +155,28 @@
40155
* The legacy polling observe driver handles errors communicating with MongoDB
41156
better and no longer gets "stuck" in some circumstances.
42157

43-
* Add {{> UI.dynamic}} to make it easier to dynamically render a
44-
template with a data context. XXX Update "Using Blaze" wiki page.
45-
46-
* Show the display name of the currently logged-in user after following
47-
a verification link or password reset link in `accounts-ui`.
48-
49-
* Use `Meteor.absoluteUrl()` to compute the redirect URI in `force-ssl`
50-
instead of the host header.
51-
52158
* Automatically rewind cursors before calls to `fetch`, `forEach`, or `map`. On
53159
the client, don't cache the return value of `cursor.count()` (consistently
54160
with the server behavior). `cursor.rewind()` is now a no-op. #2114
55161

56-
* Allow externally applied CSS style attributes to interop with Blaze
57-
dynamic style attributes.
58-
59-
* Add `userEmail` option to `Meteor.loginWithMeteorDeveloperAccount`.
60-
61-
* Fix uninformative error message when deploying to long hostnames. #1208
62-
63-
* Ensure that the user object has updated token information on it before
64-
it is passed to email template functions. #2210
65-
66162
* Remove an obsolete hack in reporting line numbers for LESS errors. #2216
67163

68-
* Fix a bug where helpers used by {{#with}} were still re-running when
69-
their reactive data sources change after they have been removed from
70-
the DOM.
71-
72164
* Avoid exceptions when accessing localStorage in certain Internet
73165
Explorer configurations. #1291, #1688.
74166

75-
* Add `UI._templateInstance()` for accessing the current template
76-
instance from within a block helper.
77-
78-
* Add `UI._parentData(n)` for accessing parent data contexts from
79-
within a block helper.
80-
81-
* Stop not updating form controls if they're focused. If a field is
82-
edited by one user while another user is focused on it, it will just
83-
lose its value but maintain its focus. #1965
84-
85-
* Add tentative API for registering hooks to run when Blaze intends to
86-
insert, move, or remove DOM elements. XXX more detail
87-
88-
* Export the function that serves the HTTP response at the end of an
89-
OAuth flow as `OAuth._endOfLoginResponse`. This function can be
90-
overridden to make the OAuth popup flow work in certain mobile
91-
environments where `window.opener` is not supported.
92-
93-
* Remove support for OAuth redirect URLs where a `redirect` query
94-
parameter. This OAuth flow was never documented and never fully
95-
worked.
96-
97-
* Add `_nestInCurrentComputation` option to `UI.render`, fixing a bug in
98-
{{#each}} when an item is added inside a computation that subsequently
99-
gets invalidated. #2156
100-
101-
* Fix bug where "=" was not allowed in helper arguments. #2157
102-
103-
* Fix bug when a template tag immediately follows a Spacebars block
104-
comment. #2175
105-
106167
* Make `handle.ready()` reactively stop, where `handle` is a
107168
subscription handle.
108169

109-
* Increase a buffer size to avoid failing when running MongoDB due to a
110-
large number of processes running on the machine, and fix the error
111-
message when the failure does occur. #2158
112-
113170
* Fix an error message from `audit-argument-checks` after login.
114171

115-
* Add --directory flag to `meteor bundle`. Setting this flag outputs a
116-
directory rather than a tarball.
117-
118172
* Make the DDP server send an error if the client sends a connect
119173
message with a missing or malformed `support` field. #2125
120174

121175
* Fix missing `jquery` dependency in the `amplify` package. #2113
122176

123177
* Ban inserting EJSON custom types as documents. #2095
124178

125-
* Clarify a `meteor mongo` error message when using the MONGO_URL
126-
environment variable. #1256
127-
128-
* XXX 1e4838ccd38c2df142591a67d675ac38eb8a5630 #2106
129-
130-
* XXX df2820ffd92
131-
132-
* XXX 00157d8aed23fc290fb985fef73b1c293fa24e63
179+
* Fix incorrect URL rewrites in stylesheets. #2106
133180

134181
* Upgraded dependencies:
135182
- node: 0.10.28 (from 0.10.26)

‎docs/.meteor/release

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.8.1.3
1+
0.8.2

‎docs/lib/release-override.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
// While galaxy apps are on their own special meteor releases, override
22
// Meteor.release here.
33
if (Meteor.isClient) {
4-
Meteor.release = Meteor.release ? "0.8.1.3" : undefined;
4+
Meteor.release = Meteor.release ? "0.8.2" : undefined;
55
}

‎examples/clock/.meteor/release

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.8.1.3
1+
0.8.2

‎examples/leaderboard/.meteor/release

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.8.1.3
1+
0.8.2

‎examples/parties/.meteor/release

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.8.1.3
1+
0.8.2

‎examples/todos/.meteor/release

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.8.1.3
1+
0.8.2

‎examples/wordplay/.meteor/release

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.8.1.3
1+
0.8.2

‎packages/accounts-password/password_client.js

+53-23
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,11 @@ Meteor.loginWithPassword = function (selector, password, callback) {
3434
// the password without requiring a full SRP flow, as well as
3535
// SHA256(password), which the server bcrypts and stores in
3636
// place of the old SRP information for this user.
37-
var details;
38-
try {
39-
details = EJSON.parse(error.details);
40-
} catch (e) {}
41-
if (!(details && details.format === 'srp'))
42-
callback(new Meteor.Error(400,
43-
"Password is old. Please reset your " +
44-
"password."));
45-
else
46-
srpUpgradePath(selector, password, details.identity, callback);
37+
srpUpgradePath({
38+
upgradeError: error,
39+
userSelector: selector,
40+
plaintextPassword: password
41+
}, callback);
4742
}
4843
else if (error) {
4944
callback(error);
@@ -61,18 +56,32 @@ var hashPassword = function (password) {
6156
};
6257
};
6358

59+
// XXX COMPAT WITH 0.8.1.3
6460
// The server requested an upgrade from the old SRP password format,
65-
// so supply the needed SRP identity to login.
66-
var srpUpgradePath = function (selector, plaintextPassword,
67-
identity, callback) {
68-
Accounts.callLoginMethod({
69-
methodArguments: [{
70-
user: selector,
71-
srp: SHA256(identity + ":" + plaintextPassword),
72-
password: hashPassword(plaintextPassword)
73-
}],
74-
userCallback: callback
75-
});
61+
// so supply the needed SRP identity to login. Options:
62+
// - upgradeError: the error object that the server returned to tell
63+
// us to upgrade from SRP to bcrypt.
64+
// - userSelector: selector to retrieve the user object
65+
// - plaintextPassword: the password as a string
66+
var srpUpgradePath = function (options, callback) {
67+
var details;
68+
try {
69+
details = EJSON.parse(options.upgradeError.details);
70+
} catch (e) {}
71+
if (!(details && details.format === 'srp')) {
72+
callback(new Meteor.Error(400,
73+
"Password is old. Please reset your " +
74+
"password."));
75+
} else {
76+
Accounts.callLoginMethod({
77+
methodArguments: [{
78+
user: options.userSelector,
79+
srp: SHA256(details.identity + ":" + options.plaintextPassword),
80+
password: hashPassword(options.plaintextPassword)
81+
}],
82+
userCallback: callback
83+
});
84+
}
7685
};
7786

7887

@@ -113,8 +122,29 @@ Accounts.changePassword = function (oldPassword, newPassword, callback) {
113122
[oldPassword ? hashPassword(oldPassword) : null, hashPassword(newPassword)],
114123
function (error, result) {
115124
if (error || !result) {
116-
callback && callback(
117-
error || new Error("No result from changePassword."));
125+
if (error && error.error === 400 &&
126+
error.reason === 'old password format') {
127+
// XXX COMPAT WITH 0.8.1.3
128+
// The server is telling us to upgrade from SRP to bcrypt, as
129+
// in Meteor.loginWithPassword.
130+
srpUpgradePath({
131+
upgradeError: error,
132+
userSelector: { id: Meteor.userId() },
133+
plaintextPassword: oldPassword
134+
}, function (err) {
135+
if (err) {
136+
callback(err);
137+
} else {
138+
// Now that we've successfully migrated from srp to
139+
// bcrypt, try changing the password again.
140+
Accounts.changePassword(oldPassword, newPassword, callback);
141+
}
142+
});
143+
} else {
144+
// A normal error, not an error telling us to upgrade to bcrypt
145+
callback && callback(
146+
error || new Error("No result from changePassword."));
147+
}
118148
} else {
119149
callback && callback();
120150
}

0 commit comments

Comments
 (0)