Changeset 8176

Timestamp:

11/21/07 04:28:59 (1 year ago)

Author:

nzkoz

Message:

Refactor cookie_only option to survive multiple requests and add regression tests. References #10048. [theflow]

Files:

• trunk/actionpack/lib/action_controller/cgi_process.rb (modified) (5 diffs)
• trunk/actionpack/test/controller/session_fixation_test.rb (added)

trunk/actionpack/lib/action_controller/cgi_process.rb

@@ -34 +34 @@
-
-  class CgiRequest < AbstractRequest #:nodoc:
-, :cookie_only
+
-    class SessionFixationAttempt < StandardError; end #:nodoc:
-
@@ -41 +41 @@
-      :prefix           => "ruby_sess.",    # prefix session file names
-      :session_path     => "/",             # available to all paths in app
+      :session_key      => "_session_id",
-      :cookie_only      => true
-    } unless const_defined?(:DEFAULT_SESSION_OPTIONS)
@@ -48 +49 @@
-      @session_options = session_options
-      @env = @cgi.send!(:env_table)
-      @cookie_only = session_options.delete :cookie_only
-      super()
-    end
@@ -113 +113 @@
-        else
-          stale_session_check! do
-@cookie_only && request
+cookie_only? && query
-              raise SessionFixationAttempt
-            end
@@ -159 +159 @@
-      end
-
+      def cookie_only?
+        session_options_with_string_keys['cookie_only']
+      end
+
-      def stale_session_check!
-        yield