From 47b5a82ae85e795ae888799426f098066583ecbc Mon Sep 17 00:00:00 2001 From: niv-openerp Date: Thu, 11 Jul 2013 14:20:34 +0200 Subject: [PATCH] Completely removed all ways to specify session identifiers and reduced them to 2 possibilities: * The http argument 'session_id' (higher priority) * The cookie 'session_id' (lower priority) bzr revid: nicolas.vanhoren@openerp.com-20130711122034-3nvmkw4q5z4io4tm --- addons/web/controllers/main.py | 2 -- addons/web/http.py | 14 ++++++-------- addons/web/static/src/js/corelib.js | 10 +++------- addons/web/static/src/js/coresetup.js | 3 +-- 4 files changed, 10 insertions(+), 19 deletions(-) diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index 2734692b5e9..124ca979c5c 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -362,8 +362,6 @@ def login_and_redirect(db, login, key, redirect_url='/'): def set_cookie_and_redirect(redirect_url): redirect = werkzeug.utils.redirect(redirect_url, 303) redirect.autocorrect_location_header = False - cookie_val = urllib2.quote(simplejson.dumps(request.session_id)) - redirect.set_cookie('instance0|session_id', cookie_val) return redirect def load_actions_from_ir_values(key, key2, models, meta): diff --git a/addons/web/http.py b/addons/web/http.py index 8c84083794a..1493f3b8f89 100644 --- a/addons/web/http.py +++ b/addons/web/http.py @@ -114,10 +114,6 @@ class WebRequest(object): def init(self, params): self.params = dict(params) - #remove now useless session id - if "session_id" in self.params: - del self.params["session_id"] - with set_request(self): self.db = self.session._db or db_monodb() @@ -360,7 +356,7 @@ class JsonRequest(WebRequest): # If we use jsonp, that's mean we are called from another host # Some browser (IE and Safari) do no allow third party cookies # We need then to manage http sessions manually. - response['httpsessionid'] = self.httpsession.sid + response['session_id'] = self.session_id mime = 'application/javascript' body = "%s(%s);" % (self.jsonp, simplejson.dumps(response),) else: @@ -424,6 +420,8 @@ class HttpRequest(WebRequest): def __init__(self, *args): super(HttpRequest, self).__init__(*args) params = dict(self.httprequest.args) + if "session_id" in params: + params.pop("session_id") params.update(self.httprequest.form) params.update(self.httprequest.files) self.init(params) @@ -889,9 +887,9 @@ class Root(object): session_gc(self.session_store) - sid = httprequest.cookies.get('sid') + sid = httprequest.args.get('session_id') if not sid: - sid = httprequest.args.get('sid') + sid = httprequest.cookies.get('session_id') if sid is None: httprequest.session = self.session_store.new() else: @@ -922,7 +920,7 @@ class Root(object): if httprequest.session.should_save: self.session_store.save(httprequest.session) if hasattr(response, 'set_cookie'): - response.set_cookie('sid', httprequest.session.sid) + response.set_cookie('session_id', httprequest.session.sid) return response(environ, start_response) except werkzeug.exceptions.HTTPException, e: diff --git a/addons/web/static/src/js/corelib.js b/addons/web/static/src/js/corelib.js index 116ddf2e8c2..01ff92c88a0 100644 --- a/addons/web/static/src/js/corelib.js +++ b/addons/web/static/src/js/corelib.js @@ -1068,13 +1068,12 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, { var data = { session_id: this.session_id, id: payload.id, - sid: this.httpsessionid, }; var set_sid = function (response, textStatus, jqXHR) { // If response give us the http session id, we store it for next requests... - if (response.httpsessionid) { - self.httpsessionid = response.httpsessionid; + if (response.session_id) { + self.session_id = response.session_id; } }; @@ -1090,7 +1089,7 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, { ajax.async = false; var payload_str = JSON.stringify(payload); var payload_url = $.param({r:payload_str}); - if(payload_url.length < 2000) { + if (payload_url.length < 2000) { // Direct jsonp request ajax.data.r = payload_str; return $.ajax(ajax).done(set_sid); @@ -1139,9 +1138,6 @@ instance.web.JsonRPC = instance.web.Class.extend(instance.web.PropertiesMixin, { var qs = ''; if (!_.isNull(params)) { params = _.extend(params || {}, {session_id: this.session_id}); - if (this.httpsessionid) { - params.sid = this.httpsessionid; - } qs = '?' + $.param(params); } var prefix = _.any(['http://', 'https://', '//'], _.bind(_.str.startsWith, null, path)) ? '' : this.prefix; diff --git a/addons/web/static/src/js/coresetup.js b/addons/web/static/src/js/coresetup.js index 81de547d0c1..f153d3ad73a 100644 --- a/addons/web/static/src/js/coresetup.js +++ b/addons/web/static/src/js/coresetup.js @@ -23,7 +23,6 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess this.qweb_mutex = new $.Mutex(); }, rpc: function(url, params, options) { - params.session_id = this.session_id; return this._super(url, params, options); }, /** @@ -58,7 +57,7 @@ instance.web.Session = instance.web.JsonRPC.extend( /** @lends instance.web.Sess session_init: function () { var self = this; // TODO: session store in cookie should be optional - this.session_id = this.get_cookie('sid'); + this.session_id = this.get_cookie('session_id'); return this.session_reload().then(function(result) { var modules = instance._modules.join(','); var deferred = self.rpc('/web/webclient/qweblist', {mods: modules}).then(self.load_qweb.bind(self));