X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FPlugin%2FSession.pm;h=470fd113affb26155dcef9e0b3fec647689ab001;hb=refs%2Fremotes%2Fmirror%2Fpeople%2Fdhoss%2Ffix-rt-71142;hp=168b60f38ce69413053ef06e3b24d6bfd2adeace;hpb=20a21dc078b8d0db0865966d9166eb7fcf5423f7;p=catagits%2FCatalyst-Plugin-Session.git

diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm
index 168b60f..470fd11 100644
--- a/lib/Catalyst/Plugin/Session.pm
+++ b/lib/Catalyst/Plugin/Session.pm
@@ -13,7 +13,7 @@ use Carp;
 
 use namespace::clean -except => 'meta';
 
-our $VERSION = '0.31';
+our $VERSION = '0.33';
 $VERSION = eval $VERSION;
 
 my @session_data_accessors; # used in delete_session
@@ -102,8 +102,10 @@ sub prepare_action {
 sub finalize_headers {
     my $c = shift;
 
-    # fix cookie before we send headers
-    $c->_save_session_expires;
+    # Force extension of session_expires before finalizing headers, so a possible cookie will be
+    # up to date. First call to session_expires will extend the expiry, subsequent calls will
+    # just return the previously extended value.
+    $c->session_expires;
 
     return $c->maybe::next::method(@_);
 }
@@ -124,6 +126,7 @@ sub finalize_session {
 
     $c->maybe::next::method(@_);
 
+    $c->_save_session_expires;
     $c->_save_session_id;
     $c->_save_session;
     $c->_save_flash;
@@ -225,6 +228,7 @@ sub _load_session {
 
             no warnings 'uninitialized';    # ne __address
             if (   $c->_session_plugin_config->{verify_address}
+                && exists $session_data->{__address}
                 && $session_data->{__address} ne $c->request->address )
             {
                 $c->log->warn(
@@ -499,7 +503,8 @@ sub initialize_session_data {
 
     my $now = time;
 
-    my $session_data = {
+    return $c->_session(
+        {
             __created => $now,
             __updated => $now,
 
@@ -513,12 +518,8 @@ sub initialize_session_data {
                 ? ( __user_agent => $c->request->user_agent||'' )
                 : ()
             ),
-    };
-
-    # Only save this session if data is added by the application
-    $c->_session_data_sig( Object::Signature::signature($session_data) );
-
-    return $c->_session($session_data);
+        }
+    );
 }
 
 sub generate_session_id {
@@ -726,6 +727,15 @@ $c->flash (thus allowing multiple redirections), and the policy is to delete
 all the keys which haven't changed since the flash data was loaded at the end
 of every request.
 
+Note that use of the flash is an easy way to get data across requests, but
+it's also strongly disrecommended, due it it being inherently plagued with
+race conditions. This means that it's unlikely to work well if your
+users have multiple tabs open at once, or if your site does a lot of AJAX
+requests.
+
+L<Catalyst::Plugin::StatusMessage> is the recommended alternative solution,
+as this doesn't suffer from these issues.
+
     sub moose : Local {
         my ( $self, $c ) = @_;
 
@@ -791,7 +801,7 @@ expiry time for the whole session).
 
 For example:
 
-    __PACKAGE__->config('Plugin::Session' => { expires => 10000000000 }); # "forever" 
+    __PACKAGE__->config('Plugin::Session' => { expires => 10000000000 }); # "forever"
     (NB If this number is too large, Y2K38 breakage could result.)
 
     # later
@@ -1134,6 +1144,10 @@ Kent Fredric (kentnl)
 
 And countless other contributers from #catalyst. Thanks guys!
 
+=head1 Contributors
+
+Devin Austin (dhoss) <dhoss@cpan.org>
+
 =head1 COPYRIGHT & LICENSE
 
     Copyright (c) 2005 the aforementioned authors. All rights