X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FPlugin%2FSession.pm;h=345297fde9d75db316c4c159a7fc5d1d815a1d9b;hb=005dfe4f232485eb89f321eefed95adf1eb60097;hp=59c94fbc1524b52226fdb5fab54ff53b15ce7e2a;hpb=601be17a9e3850de086eed40070ccc5157fa191f;p=catagits%2FCatalyst-Plugin-Session.git

diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm
index 59c94fb..345297f 100644
--- a/lib/Catalyst/Plugin/Session.pm
+++ b/lib/Catalyst/Plugin/Session.pm
@@ -9,11 +9,13 @@ use Catalyst::Exception ();
 use Digest              ();
 use overload            ();
 use Object::Signature   ();
+use HTML::Entities      ();
 use Carp;
+use List::Util qw/ max /;
 
 use namespace::clean -except => 'meta';
 
-our $VERSION = '0.34';
+our $VERSION = '0.41';
 $VERSION = eval $VERSION;
 
 my @session_data_accessors; # used in delete_session
@@ -33,6 +35,7 @@ __PACKAGE__->mk_accessors(
           _tried_loading_session_data
           _tried_loading_session_expires
           _tried_loading_flash_data
+          _needs_early_session_finalization
           /
 );
 
@@ -80,6 +83,7 @@ sub setup_session {
         expires        => 7200,
         verify_address => 0,
         verify_user_agent => 0,
+        expiry_threshold => 0,
         %$cfg,
     );
 
@@ -102,10 +106,14 @@ sub prepare_action {
 sub finalize_headers {
     my $c = shift;
 
-    # Force extension of session_expires before finalizing headers, so a possible cookie will be
-    # up to date. First call to session_expires will extend the expiry, subsequent calls will
+    # fix cookie before we send headers
+    $c->_save_session_expires;
+
+    # Force extension of session_expires before finalizing headers, so a pos
+    # up to date. First call to session_expires will extend the expiry, subs
     # just return the previously extended value.
     $c->session_expires;
+    $c->finalize_session if $c->_needs_early_session_finalization;
 
     return $c->maybe::next::method(@_);
 }
@@ -116,7 +124,8 @@ sub finalize_body {
     # We have to finalize our session *before* $c->engine->finalize_xxx is called,
     # because we do not want to send the HTTP response before the session is stored/committed to
     # the session database (or whatever Session::Store you use).
-    $c->finalize_session;
+    $c->finalize_session unless $c->_needs_early_session_finalization;
+    $c->_clear_session_instance_data;
 
     return $c->maybe::next::method(@_);
 }
@@ -126,12 +135,31 @@ sub finalize_session {
 
     $c->maybe::next::method(@_);
 
-    $c->_save_session_expires;
     $c->_save_session_id;
     $c->_save_session;
     $c->_save_flash;
 
-    $c->_clear_session_instance_data;
+}
+
+sub _session_updated {
+    my $c = shift;
+
+    if ( my $session_data = $c->_session ) {
+
+        no warnings 'uninitialized';
+        if ( Object::Signature::signature($session_data) ne
+            $c->_session_data_sig )
+        {
+            return $session_data;
+        } else {
+            return;
+        }
+
+    } else {
+
+        return;
+
+    }
 }
 
 sub _save_session_id {
@@ -145,26 +173,27 @@ sub _save_session_expires {
     my $c = shift;
 
     if ( defined($c->_session_expires) ) {
-        my $expires = $c->session_expires; # force extension
 
-        my $sid = $c->sessionid;
-        $c->store_session_data( "expires:$sid" => $expires );
+        if (my $sid = $c->sessionid) {
+
+            my $current  = $c->_get_stored_session_expires;
+            my $extended = $c->session_expires;
+            if ($extended > $current) {
+                $c->store_session_data( "expires:$sid" => $extended );
+            }
+
+        }
     }
 }
 
 sub _save_session {
     my $c = shift;
 
-    if ( my $session_data = $c->_session ) {
+    if ( my $session_data = $c->_session_updated ) {
 
-        no warnings 'uninitialized';
-        if ( Object::Signature::signature($session_data) ne
-            $c->_session_data_sig )
-        {
-            $session_data->{__updated} = time();
-            my $sid = $c->sessionid;
-            $c->store_session_data( "session:$sid" => $session_data );
-        }
+        $session_data->{__updated} = time();
+        my $sid = $c->sessionid;
+        $c->store_session_data( "session:$sid" => $session_data );
     }
 }
 
@@ -201,7 +230,7 @@ sub _load_session_expires {
     $c->_tried_loading_session_expires(1);
 
     if ( my $sid = $c->sessionid ) {
-        my $expires = $c->get_session_data("expires:$sid") || 0;
+        my $expires =  $c->_get_stored_session_expires;
 
         if ( $expires >= time() ) {
             $c->_session_expires( $expires );
@@ -359,9 +388,32 @@ sub session_expires {
 
 sub extend_session_expires {
     my ( $c, $expires ) = @_;
-    $c->_extended_session_expires( my $updated = $c->calculate_initial_session_expires( $expires ) );
-    $c->extend_session_id( $c->sessionid, $updated );
-    return $updated;
+
+    my $threshold = $c->_session_plugin_config->{expiry_threshold} || 0;
+
+    if ( my $sid = $c->sessionid ) {
+        my $expires = $c->_get_stored_session_expires;
+        my $cutoff  = $expires - $threshold;
+
+        if (!$threshold || $cutoff <= time || $c->_session_updated) {
+
+            $c->_extended_session_expires( my $updated = $c->calculate_initial_session_expires() );
+            $c->extend_session_id( $sid, $updated );
+
+            return $updated;
+
+        } else {
+
+            return $expires;
+
+        }
+
+    } else {
+
+        return;
+
+    }
+
 }
 
 sub change_session_expires {
@@ -373,20 +425,24 @@ sub change_session_expires {
     $c->store_session_data( "expires:$sid" => $time_exp );
 }
 
+sub _get_stored_session_expires {
+    my ($c) = @_;
+
+    if ( my $sid = $c->sessionid ) {
+        return $c->get_session_data("expires:$sid") || 0;
+    } else {
+        return 0;
+    }
+}
+
 sub initial_session_expires {
     my $c = shift;
     return ( time() + $c->_session_plugin_config->{expires} );
 }
 
 sub calculate_initial_session_expires {
-    my $c = shift;
-
-    my $initial_expires = $c->initial_session_expires;
-    my $stored_session_expires = 0;
-    if ( my $sid = $c->sessionid ) {
-        $stored_session_expires = $c->get_session_data("expires:$sid") || 0;
-    }
-    return ( $initial_expires > $stored_session_expires ) ? $initial_expires : $stored_session_expires;
+    my ($c) = @_;
+    return max( $c->initial_session_expires, $c->_get_stored_session_expires );
 }
 
 sub calculate_extended_session_expires {
@@ -425,6 +481,7 @@ sub _load_sessionid {
             $c->_sessionid($sid);
             return $sid;
         } else {
+            $sid = HTML::Entities::encode_entities($sid);
             my $err = "Tried to set invalid session ID '$sid'";
             $c->log->error($err);
             Catalyst::Exception->throw($err);
@@ -614,7 +671,7 @@ sub set_session_id { shift->maybe::next::method(@_) }
 sub delete_session_id { shift->maybe::next::method(@_) }
 sub extend_session_id { shift->maybe::next::method(@_) }
 
-__PACKAGE__;
+__PACKAGE__->meta->make_immutable;
 
 __END__
 
@@ -858,6 +915,8 @@ You can change the session expiration time for this session;
 
     $c->change_session_expires( 4000 );
 
+Note that this only works to set the session longer than the config setting.
+
 =back
 
 =head1 INTERNAL METHODS
@@ -999,6 +1058,8 @@ Note: this is *not* used to give an individual user a longer session. See
 
 =item set_session_id
 
+=item initial_session_expires
+
 =back
 
 =head1 USING SESSIONS DURING PREPARE
@@ -1037,16 +1098,26 @@ C<Plugin::Session> key in the configuration hash.
 The time-to-live of each session, expressed in seconds. Defaults to 7200 (two
 hours).
 
+=item expiry_threshold
+
+Only update the session expiry time if it would otherwise expire
+within this many seconds from now.
+
+The purpose of this is to keep the session store from being updated
+when nothing else in the session is updated.
+
+Defaults to 0 (in which case, the expiration will always be updated).
+
 =item verify_address
 
-When true, C<<$c->request->address>> will be checked at prepare time. If it is
+When true, C<< $c->request->address >> will be checked at prepare time. If it is
 not the same as the address that initiated the session, the session is deleted.
 
 Defaults to false.
 
 =item verify_user_agent
 
-When true, C<<$c->request->user_agent>> will be checked at prepare time. If it
+When true, C<< $c->request->user_agent >> will be checked at prepare time. If it
 is not the same as the user agent that initiated the session, the session is
 deleted.
 
@@ -1171,6 +1242,8 @@ And countless other contributers from #catalyst. Thanks guys!
 
 Devin Austin (dhoss) <dhoss@cpan.org>
 
+Robert Rothenberg <rrwo@cpan.org> (on behalf of Foxtons Ltd.)
+
 =head1 COPYRIGHT & LICENSE
 
     Copyright (c) 2005 the aforementioned authors. All rights