Changeset 7722

Timestamp:

10/02/07 05:58:16 (1 year ago)

Author:

nzkoz

Message:

Merge session fixation fixes from stable

Files:

• trunk/actionpack/CHANGELOG (modified) (1 diff)
• trunk/actionpack/lib/action_controller/cgi_process.rb (modified) (5 diffs)

trunk/actionpack/CHANGELOG

@@ +1 @@
+*SVN*
+
+* Only accept session ids from cookies, prevents session fixation attacks.  [bradediger] 
+
-*2.0.0 [Preview Release]* (September 29th, 2007) [Includes duplicates of changes from 1.12.2 - 1.13.3]
-

trunk/actionpack/lib/action_controller/cgi_process.rb

@@ -11 +11 @@
-    #   lib/action_controller/session.
-    # * <tt>:session_key</tt> - the parameter name used for the session id. Defaults to '_session_id'.
-parameter
-of the request, or 
+cookie, or 
+
-    # * <tt>:new_session</tt> - if true, force creation of a new session.  If not set, a new session is only created if none currently
-    #   exists.  If false, a new session is never created, and if none currently exists and the +session_id+ option is not set,
@@ -22 +22 @@
-    # * <tt>:session_secure</tt> - if +true+, this session will only work over HTTPS.
-    # * <tt>:session_path</tt> - the path for which this session applies.  Defaults to the directory of the CGI script.
+    # * <tt>:cookie_only</tt> - if +true+ (the default), session IDs will only be accepted from cookies and not from
+    #   the query string or POST parameters. This protects against session fixation attacks.
-    def self.process_cgi(cgi = CGI.new, session_options = {})
-      new.process_cgi(cgi, session_options)
@@ -32 +34 @@
-
-  class CgiRequest < AbstractRequest #:nodoc:
-
+
+
-
-    DEFAULT_SESSION_OPTIONS = {
-      :database_manager => CGI::Session::CookieStore, # store data in cookie
-      :prefix           => "ruby_sess.",    # prefix session file names
-
+
+
-    } unless const_defined?(:DEFAULT_SESSION_OPTIONS)
-
@@ -44 +48 @@
-      @session_options = session_options
-      @env = @cgi.send!(:env_table)
+      @cookie_only = session_options.delete :cookie_only
-      super()
-    end
@@ -110 +115 @@
-        else
-          stale_session_check! do
+            if @cookie_only && request_parameters[session_options_with_string_keys['session_key']]
+              raise SessionFixationAttempt
+            end
-            case value = session_options_with_string_keys['new_session']
-              when true