X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FPlugin%2FSession.pm;h=345297fde9d75db316c4c159a7fc5d1d815a1d9b;hb=005dfe4f232485eb89f321eefed95adf1eb60097;hp=c13297c0b2259a9dd0588a2bf9f0e699ea6c9a17;hpb=f4f73302c97ef22bf251c91508194b7ae2c4d9bd;p=catagits%2FCatalyst-Plugin-Session.git diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm index c13297c..345297f 100644 --- a/lib/Catalyst/Plugin/Session.pm +++ b/lib/Catalyst/Plugin/Session.pm @@ -9,11 +9,13 @@ use Catalyst::Exception (); use Digest (); use overload (); use Object::Signature (); +use HTML::Entities (); use Carp; +use List::Util qw/ max /; use namespace::clean -except => 'meta'; -our $VERSION = '0.31'; +our $VERSION = '0.41'; $VERSION = eval $VERSION; my @session_data_accessors; # used in delete_session @@ -33,6 +35,7 @@ __PACKAGE__->mk_accessors( _tried_loading_session_data _tried_loading_session_expires _tried_loading_flash_data + _needs_early_session_finalization / ); @@ -80,6 +83,7 @@ sub setup_session { expires => 7200, verify_address => 0, verify_user_agent => 0, + expiry_threshold => 0, %$cfg, ); @@ -105,6 +109,12 @@ sub finalize_headers { # fix cookie before we send headers $c->_save_session_expires; + # Force extension of session_expires before finalizing headers, so a pos + # up to date. First call to session_expires will extend the expiry, subs + # just return the previously extended value. + $c->session_expires; + $c->finalize_session if $c->_needs_early_session_finalization; + return $c->maybe::next::method(@_); } @@ -114,7 +124,8 @@ sub finalize_body { # We have to finalize our session *before* $c->engine->finalize_xxx is called, # because we do not want to send the HTTP response before the session is stored/committed to # the session database (or whatever Session::Store you use). - $c->finalize_session; + $c->finalize_session unless $c->_needs_early_session_finalization; + $c->_clear_session_instance_data; return $c->maybe::next::method(@_); } @@ -128,7 +139,27 @@ sub finalize_session { $c->_save_session; $c->_save_flash; - $c->_clear_session_instance_data; +} + +sub _session_updated { + my $c = shift; + + if ( my $session_data = $c->_session ) { + + no warnings 'uninitialized'; + if ( Object::Signature::signature($session_data) ne + $c->_session_data_sig ) + { + return $session_data; + } else { + return; + } + + } else { + + return; + + } } sub _save_session_id { @@ -142,26 +173,27 @@ sub _save_session_expires { my $c = shift; if ( defined($c->_session_expires) ) { - my $expires = $c->session_expires; # force extension - my $sid = $c->sessionid; - $c->store_session_data( "expires:$sid" => $expires ); + if (my $sid = $c->sessionid) { + + my $current = $c->_get_stored_session_expires; + my $extended = $c->session_expires; + if ($extended > $current) { + $c->store_session_data( "expires:$sid" => $extended ); + } + + } } } sub _save_session { my $c = shift; - if ( my $session_data = $c->_session ) { + if ( my $session_data = $c->_session_updated ) { - no warnings 'uninitialized'; - if ( Object::Signature::signature($session_data) ne - $c->_session_data_sig ) - { - $session_data->{__updated} = time(); - my $sid = $c->sessionid; - $c->store_session_data( "session:$sid" => $session_data ); - } + $session_data->{__updated} = time(); + my $sid = $c->sessionid; + $c->store_session_data( "session:$sid" => $session_data ); } } @@ -198,7 +230,7 @@ sub _load_session_expires { $c->_tried_loading_session_expires(1); if ( my $sid = $c->sessionid ) { - my $expires = $c->get_session_data("expires:$sid") || 0; + my $expires = $c->_get_stored_session_expires; if ( $expires >= time() ) { $c->_session_expires( $expires ); @@ -225,6 +257,7 @@ sub _load_session { no warnings 'uninitialized'; # ne __address if ( $c->_session_plugin_config->{verify_address} + && exists $session_data->{__address} && $session_data->{__address} ne $c->request->address ) { $c->log->warn( @@ -355,19 +388,66 @@ sub session_expires { sub extend_session_expires { my ( $c, $expires ) = @_; - $c->_extended_session_expires( my $updated = $c->calculate_extended_session_expires( $expires ) ); - $c->extend_session_id( $c->sessionid, $updated ); - return $updated; + + my $threshold = $c->_session_plugin_config->{expiry_threshold} || 0; + + if ( my $sid = $c->sessionid ) { + my $expires = $c->_get_stored_session_expires; + my $cutoff = $expires - $threshold; + + if (!$threshold || $cutoff <= time || $c->_session_updated) { + + $c->_extended_session_expires( my $updated = $c->calculate_initial_session_expires() ); + $c->extend_session_id( $sid, $updated ); + + return $updated; + + } else { + + return $expires; + + } + + } else { + + return; + + } + +} + +sub change_session_expires { + my ( $c, $expires ) = @_; + + $expires ||= 0; + my $sid = $c->sessionid; + my $time_exp = time() + $expires; + $c->store_session_data( "expires:$sid" => $time_exp ); } -sub calculate_initial_session_expires { +sub _get_stored_session_expires { + my ($c) = @_; + + if ( my $sid = $c->sessionid ) { + return $c->get_session_data("expires:$sid") || 0; + } else { + return 0; + } +} + +sub initial_session_expires { my $c = shift; return ( time() + $c->_session_plugin_config->{expires} ); } +sub calculate_initial_session_expires { + my ($c) = @_; + return max( $c->initial_session_expires, $c->_get_stored_session_expires ); +} + sub calculate_extended_session_expires { my ( $c, $prev ) = @_; - $c->calculate_initial_session_expires; + return ( time() + $prev ); } sub reset_session_expires { @@ -401,6 +481,7 @@ sub _load_sessionid { $c->_sessionid($sid); return $sid; } else { + $sid = HTML::Entities::encode_entities($sid); my $err = "Tried to set invalid session ID '$sid'"; $c->log->error($err); Catalyst::Exception->throw($err); @@ -590,7 +671,7 @@ sub set_session_id { shift->maybe::next::method(@_) } sub delete_session_id { shift->maybe::next::method(@_) } sub extend_session_id { shift->maybe::next::method(@_) } -__PACKAGE__; +__PACKAGE__->meta->make_immutable; __END__ @@ -703,16 +784,10 @@ hashref. =item session_expires -=item session_expires $reset - This method returns the time when the current session will expire, or 0 if there is no current session. If there is a session and it already expired, it will delete the session and return 0 as well. -If the C<$reset> parameter is true, and there is a session ID the expiry time -will be reset to the current time plus the time to live (see -L). This is used when creating a new session. - =item flash This is like Ruby on Rails' flash data structure. Think of it as a stash that @@ -723,6 +798,15 @@ $c->flash (thus allowing multiple redirections), and the policy is to delete all the keys which haven't changed since the flash data was loaded at the end of every request. +Note that use of the flash is an easy way to get data across requests, but +it's also strongly disrecommended, due it it being inherently plagued with +race conditions. This means that it's unlikely to work well if your +users have multiple tabs open at once, or if your site does a lot of AJAX +requests. + +L is the recommended alternative solution, +as this doesn't suffer from these issues. + sub moose : Local { my ( $self, $c ) = @_; @@ -788,7 +872,7 @@ expiry time for the whole session). For example: - __PACKAGE__->config('Plugin::Session' => { expires => 10000000000 }); # "forever" + __PACKAGE__->config('Plugin::Session' => { expires => 10000000000 }); # "forever" (NB If this number is too large, Y2K38 breakage could result.) # later @@ -825,6 +909,14 @@ you should call change_session_id in your login controller like this: ... } +=item change_session_expires $expires + +You can change the session expiration time for this session; + + $c->change_session_expires( 4000 ); + +Note that this only works to set the session longer than the config setting. + =back =head1 INTERNAL METHODS @@ -953,6 +1045,9 @@ dumped objects if session ID is defined. =item extend_session_expires +Note: this is *not* used to give an individual user a longer session. See +'change_session_expires'. + =item extend_session_id =item get_session_id @@ -963,6 +1058,8 @@ dumped objects if session ID is defined. =item set_session_id +=item initial_session_expires + =back =head1 USING SESSIONS DURING PREPARE @@ -1001,16 +1098,26 @@ C key in the configuration hash. The time-to-live of each session, expressed in seconds. Defaults to 7200 (two hours). +=item expiry_threshold + +Only update the session expiry time if it would otherwise expire +within this many seconds from now. + +The purpose of this is to keep the session store from being updated +when nothing else in the session is updated. + +Defaults to 0 (in which case, the expiration will always be updated). + =item verify_address -When true, C<<$c->request->address>> will be checked at prepare time. If it is +When true, C<< $c->request->address >> will be checked at prepare time. If it is not the same as the address that initiated the session, the session is deleted. Defaults to false. =item verify_user_agent -When true, C<<$c->request->user_agent>> will be checked at prepare time. If it +When true, C<< $c->request->user_agent >> will be checked at prepare time. If it is not the same as the user agent that initiated the session, the session is deleted. @@ -1131,6 +1238,12 @@ Kent Fredric (kentnl) And countless other contributers from #catalyst. Thanks guys! +=head1 Contributors + +Devin Austin (dhoss) + +Robert Rothenberg (on behalf of Foxtons Ltd.) + =head1 COPYRIGHT & LICENSE Copyright (c) 2005 the aforementioned authors. All rights