Completely removed all ways to specify session identifiers and reduced them to 2 possibilities:

* The http argument 'session_id' (higher priority)
* The cookie 'session_id' (lower priority)

bzr revid: nicolas.vanhoren@openerp.com-20130711122034-3nvmkw4q5z4io4tm

addons/web/controllers/main.py

@@ -362,8 +362,6 @@ def login_and_redirect(db, login, key, redirect_url='/'):
 def set_cookie_and_redirect(redirect_url):
     redirect = werkzeug.utils.redirect(redirect_url, 303)
     redirect.autocorrect_location_header = False
-    cookie_val = urllib2.quote(simplejson.dumps(request.session_id))
-    redirect.set_cookie('instance0|session_id', cookie_val)
     return redirect
 
 def load_actions_from_ir_values(key, key2, models, meta):

addons/web/http.py

@@ -114,10 +114,6 @@ class WebRequest(object):
     def init(self, params):
         self.params = dict(params)
 
-        #remove now useless session id
-        if "session_id" in self.params:
-            del self.params["session_id"]
-
         with set_request(self):
             self.db = self.session._db or db_monodb()
 
@@ -360,7 +356,7 @@ class JsonRequest(WebRequest):
             # If we use jsonp, that's mean we are called from another host
             # Some browser (IE and Safari) do no allow third party cookies
             # We need then to manage http sessions manually.
-            response['httpsessionid'] = self.httpsession.sid
+            response['session_id'] = self.session_id
             mime = 'application/javascript'
             body = "%s(%s);" % (self.jsonp, simplejson.dumps(response),)
         else:
@@ -424,6 +420,8 @@ class HttpRequest(WebRequest):
     def __init__(self, *args):
         super(HttpRequest, self).__init__(*args)
         params = dict(self.httprequest.args)
+        if "session_id" in params:
+            params.pop("session_id")
         params.update(self.httprequest.form)
         params.update(self.httprequest.files)
         self.init(params)
@@ -889,9 +887,9 @@ class Root(object):
 
             session_gc(self.session_store)
 
-            sid = httprequest.cookies.get('sid')
+            sid = httprequest.args.get('session_id')
             if not sid:
-                sid = httprequest.args.get('sid')
+                sid = httprequest.cookies.get('session_id')
             if sid is None:
                 httprequest.session = self.session_store.new()
             else:
@@ -922,7 +920,7 @@ class Root(object):
             if httprequest.session.should_save:
                 self.session_store.save(httprequest.session)
             if hasattr(response, 'set_cookie'):
-                response.set_cookie('sid', httprequest.session.sid)
+                response.set_cookie('session_id', httprequest.session.sid)
 
             return response(environ, start_response)
         except werkzeug.exceptions.HTTPException, e:

addons/web/static/src/js/corelib.js

@@ -1068,13 +1068,12 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
         var data = {
             session_id: this.session_id,
             id: payload.id,
-            sid: this.httpsessionid,
         };
 
         var set_sid = function (response, textStatus, jqXHR) {
             // If response give us the http session id, we store it for next requests...
-            if (response.httpsessionid) {
-                self.httpsessionid = response.httpsessionid;
+            if (response.session_id) {
+                self.session_id = response.session_id;
             }
         };
 
@@ -1090,7 +1089,7 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
             ajax.async = false;
         var payload_str = JSON.stringify(payload);
         var payload_url = $.param({r:payload_str});
-        if(payload_url.length < 2000) {
+        if (payload_url.length < 2000) {
             // Direct jsonp request
             ajax.data.r = payload_str;
             return $.ajax(ajax).done(set_sid);
@@ -1139,9 +1138,6 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, {
         var qs = '';
         if (!_.isNull(params)) {
             params = _.extend(params || {}, {session_id: this.session_id});
-            if (this.httpsessionid) {
-                params.sid = this.httpsessionid;
-            }
             qs = '?' + $.param(params);
         }
         var prefix = _.any(['http://', 'https://', '//'], _.bind(_.str.startsWith, null, path)) ? '' : this.prefix; 

addons/web/static/src/js/coresetup.js

@@ -23,7 +23,6 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess
         this.qweb_mutex = new $.Mutex();
     },
     rpc: function(url, params, options) {
-        params.session_id = this.session_id;
         return this._super(url, params, options);
     },
     /**
@@ -58,7 +57,7 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess
     session_init: function () {
         var self = this;
         // TODO: session store in cookie should be optional
-        this.session_id = this.get_cookie('sid');
+        this.session_id = this.get_cookie('session_id');
         return this.session_reload().then(function(result) {
             var modules = instance._modules.join(',');
             var deferred = self.rpc('/web/webclient/qweblist', {mods: modules}).then(self.load_qweb.bind(self));