Changeset 1840

Timestamp:

01/12/08 19:22:22

Author:

fumanchu

Message:

Fix for #709 (Cherrypy accepts user-supplied session identifiers). Also fixed some problems with regenerated id's.

Files:

• trunk/cherrypy/lib/sessions.py (modified) (5 diffs)
• trunk/cherrypy/test/test_session.py (modified) (5 diffs)

trunk/cherrypy/lib/sessions.py

@@ -31 +31 @@
-    __metaclass__ = cherrypy._AttributeDocstrings
-    
-
+
+
+
+
-    id__doc = "The current session ID."
+    def _get_id(self):
+        return self._id
+    def _set_id(self, value):
+        self._id = value
+        for o in self.id_observers:
+            o(value)
+    id = property(_get_id, _set_id, doc=id__doc)
-    
-    timeout = 60
@@ -54 +64 @@
-    
-    def __init__(self, id=None, **kwargs):
+        self.id_observers = []
-        self._data = {}
-        
@@ -63 +74 @@
-        else:
-            self.id = id
+            if self._load() is None:
+                # Expired or malicious session. Make a new one.
+                # See http://www.cherrypy.org/ticket/709.
+                self.id = None
+                self.regenerate()
-    
-    def regenerate(self):
@@ -119 +135 @@
-        # data is either None or a tuple (session_data, expiration_time)
-        if data is None or data[1] < datetime.datetime.now():
- (but keep the same id)
+
-            self._data = {}
-        else:
@@ -548 +564 @@
-    kwargs['clean_freq'] = clean_freq
-    cherrypy.serving.session = sess = storage_class(id, **kwargs)
+    def update_cookie(id):
+        """Update the cookie every time the session id changes."""
+        cherrypy.response.cookie[name] = id
+    sess.id_observers.append(update_cookie)
-    
-    # Create cherrypy.session which will proxy to cherrypy.serving.session

trunk/cherrypy/test/test_session.py

@@ -26 +26 @@
-                      'tools.sessions.storage_type' : 'ram',
-                      'tools.sessions.storage_path' : localDir,
-0.017,    # 1.02 secs
-0.017
+(1.0 / 60),
+(1.0 / 60)
-                      }
-        
@@ -99 +99 @@
-class SessionTest(helper.CPWebCase):
-    
+    def tearDown(self):
+        # Clean up sessions.
+        for fname in os.listdir(localDir):
+            if fname.startswith(sessions.FileSession.SESSION_PREFIX):
+                os.unlink(os.path.join(localDir, fname))
+    
-    def test_0_Session(self):
-        self.getPage('/testStr')
@@ -119 +125 @@
-        self.assertStatus(200)
-        
-.02 secs
-1.25
+ second
+2
-        self.getPage('/')
-        self.assertBody('1')
@@ -218 +224 @@
-        id2 = self.cookies[0][1].split(";", 1)[0].split("=", 1)[1]
-        self.assertNotEqual(id1, id2)
+        
+        self.getPage('/testStr')
+        # grab the cookie ID
+        id1 = self.cookies[0][1].split(";", 1)[0].split("=", 1)[1]
+        self.getPage('/testStr',
+                     headers=[('Cookie',
+                               'session_id=maliciousid; '
+                               'expires=Sat, 27 Oct 2017 04:18:28 GMT; Path=/;')])
+        id2 = self.cookies[0][1].split(";", 1)[0].split("=", 1)[1]
+        self.assertNotEqual(id1, id2)
+        self.assertNotEqual(id2, 'maliciousid')
-
-
@@ -261 +278 @@
-            self.assertStatus(200)
-            
-.02 secs
+ second
-            time.sleep(1.25)
-            self.getPage('/')