Changeset 1770

Timestamp:

10/26/07 21:23:02

Author:

fumanchu

Message:

Fix for #710 (Allow forcing a new session id).

Files:

• trunk/cherrypy/_cptools.py (modified) (1 diff)
• trunk/cherrypy/lib/sessions.py (modified) (5 diffs)
• trunk/cherrypy/test/test_session.py (modified) (2 diffs)

trunk/cherrypy/_cptools.py

@@ -243 +243 @@
-        hooks.attach('before_finalize', _sessions.save)
-        hooks.attach('on_end_request', _sessions.close)
+        
+    def regenerate(self):
+        """Drop the current session and make a new one (with a new id)."""
+        sess = cherrypy.serving.session
+        sess.regenerate()
+        
+        # Grab cookie-relevant tool args
+        conf = dict([(k, v) for k, v in self._merged_args().iteritems()
+                     if k in ('path', 'path_header', 'name', 'timeout',
+                              'domain', 'secure')])
+        _sessions.set_response_cookie(**conf)
+
+
-
-

trunk/cherrypy/lib/sessions.py

@@ -59 +59 @@
-            setattr(self, k, v)
-        
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        while self.id is None:
-            self.id = self.generate_id()
@@ -65 +79 @@
-            if self._load() is not None:
-                self.id = None
+        
+        if old_session_was_locked:
+            self.acquire_lock()
-    
-    def clean_up(self):
@@ -490 +507 @@
-        cookie 'path' will be pulled from request.headers[path_header].
-    name: the name of the cookie.
-
+
+
-    domain: the cookie domain.
-    secure: if False (the default) the cookie 'secure' value will not
@@ -531 +549 @@
-        cherrypy.session = cherrypy._ThreadLocalProxy('session')
-    
+    set_response_cookie(path=path, path_header=path_header, name=name,
+                        timeout=timeout, domain=domain, secure=secure)
+
+
+def set_response_cookie(path=None, path_header=None, name='session_id',
+                        timeout=60, domain=None, secure=False):
+    """Set a response cookie for the client.
+    
+    path: the 'path' value to stick in the response cookie metadata.
+    path_header: if 'path' is None (the default), then the response
+        cookie 'path' will be pulled from request.headers[path_header].
+    name: the name of the cookie.
+    timeout: the expiration timeout for the cookie.
+    domain: the cookie domain.
+    secure: if False (the default) the cookie 'secure' value will not
+        be set. If True, the cookie 'secure' value will be set (to 1).
+    """
-    # Set response cookie
-    cookie = cherrypy.response.cookie
-
-
+
+
+
-    
-    # We'd like to use the "max-age" param as indicated in
@@ -557 +593 @@
-    cherrypy.response.cookie[name]['expires'] = t
-
+

trunk/cherrypy/test/test_session.py

@@ -84 +84 @@
-            return cherrypy.request.method
-        restricted.exposed = True
+        
+        def regen(self):
+            cherrypy.tools.sessions.regenerate()
+            return "logged in"
+        regen.exposed = True
-    
-    cherrypy.tree.mount(Root())
@@ -203 +208 @@
-        self.getPage('/restricted', self.cookies, method='POST')
-        self.assertErrorPage(405, "Specified method is invalid for this server.")
+    
+    def test_6_regenerate(self):
+        self.getPage('/testStr')
+        # grab the cookie ID
+        id1 = self.cookies[0][1].split(";", 1)[0].split("=", 1)[1]
+        self.getPage('/regen')
+        self.assertBody('logged in')
+        id2 = self.cookies[0][1].split(";", 1)[0].split("=", 1)[1]
+        self.assertNotEqual(id1, id2)
-
-