Changeset 6424

Timestamp:

03/14/07 11:33:10 (1 year ago)

Author:

bitsweat

Message:

Cookie session store: ensure that new sessions doesn't reuse data from a deleted session in the same request.

Files:

• trunk/actionpack/CHANGELOG (modified) (1 diff)
• trunk/actionpack/lib/action_controller/session/cookie_store.rb (modified) (2 diffs)
• trunk/actionpack/test/controller/session/cookie_store_test.rb (modified) (1 diff)

trunk/actionpack/CHANGELOG

@@ -1 +1 @@
-*SVN*
+
+* Cookie session store: ensure that new sessions doesn't reuse data from a deleted session in the same request.  [Jeremy Kemper]
-
-* Deprecation: verification with :redirect_to => :named_route shouldn't be deprecated.  #7525 [Justin French]

trunk/actionpack/lib/action_controller/session/cookie_store.rb

@@ -97 +97 @@
-  def delete
-    @data = nil
+    clear_old_cookie_value
-    write_cookie('value' => '', 'expires' => 1.year.ago)
-  end
@@ -135 +136 @@
-      @session.cgi.send :instance_variable_set, '@output_cookies', [cookie]
-    end
+
+    # Clear cookie value so subsequent new_session doesn't reload old data.
+    def clear_old_cookie_value
+      @session.cgi.cookies[@cookie_options['name']].clear
+    end
-end

trunk/actionpack/test/controller/session/cookie_store_test.rb

@@ -136 +136 @@
-  end
-
+  def test_new_session_doesnt_reuse_deleted_cookie_data
+    set_cookie! cookie_value(:typical)
+
+    new_session do |session|
+      assert_not_nil session['user_id']
+      session.delete
+
+      # Start a new session using the same CGI instance.
+      post_delete_session = CGI::Session.new(session.cgi, self.class.default_session_options)
+      assert_nil post_delete_session['user_id']
+    end
+  end
+
-  private
-    def assert_no_cookies(session)