From c3faccb0f4d74de44677fb2e5b39374f20f7f6eb Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Tue, 20 Oct 2026 08:47:47 -0700 Subject: [PATCH] Read the password digest past the query cache A digest cached earlier in the request would let the check pass on a password that has since changed. --- app/models/session.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/models/session.rb b/app/models/session.rb index bc65f90..9fa3664 100644 --- a/app/models/session.rb +++ b/app/models/session.rb @@ -18,10 +18,10 @@ class Session < ApplicationRecord private # A password change ends every session, so one can't start on a password checked before the change. Validated in # the save's transaction, which holds the database's write lock from the start, so a change commits either before - # this check, and fails it, or after the insert, and ends this session with the others. Compared here rather than in - # the query, which logs its values. + # this check, and fails it, or after the insert, and ends this session with the others. Read past the query cache, + # and compared here rather than in the query, which logs its values. def user_password_unchanged - unless User.where(id: user_id).pick(:password_digest) == user.password_digest + unless User.uncached { User.where(id: user_id).pick(:password_digest) } == user.password_digest errors.add :user, :invalid end end