X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=blobdiff_plain;f=lib%2FCatalyst%2FPlugin%2FSession.pm;h=e9c2a13572ca2c6b41c9302c797be5321446cf69;hb=2842d93853af927a543214ccbe17d659f5ecd181;hp=119567c08f66314101f020b436a55baf6ea8f2e3;hpb=2a323f6fc9f0eecb135d6008988af4a98d8f0572;p=catagits%2FCatalyst-Plugin-Session.git diff --git a/lib/Catalyst/Plugin/Session.pm b/lib/Catalyst/Plugin/Session.pm index 119567c..e9c2a13 100644 --- a/lib/Catalyst/Plugin/Session.pm +++ b/lib/Catalyst/Plugin/Session.pm @@ -13,7 +13,7 @@ use overload (); use Object::Signature (); use Carp; -our $VERSION = "0.14"; +our $VERSION = '0.19_01'; my @session_data_accessors; # used in delete_session BEGIN { @@ -89,12 +89,24 @@ sub prepare_action { $c->NEXT::prepare_action(@_); } -sub finalize { +sub finalize_headers { my $c = shift; + # fix cookie before we send headers + $c->_save_session_expires; + + return $c->NEXT::finalize_headers(@_); +} + +sub finalize_body { + my $c = shift; + + # We have to finalize our session *before* $c->engine->finalize_xxx is called, + # because we do not want to send the HTTP response before the session is stored/committed to + # the session database (or whatever Session::Store you use). $c->finalize_session; - - $c->NEXT::finalize(@_); + + return $c->NEXT::finalize_body(@_); } sub finalize_session { @@ -105,7 +117,6 @@ sub finalize_session { $c->_save_session_id; $c->_save_session; $c->_save_flash; - $c->_save_session_expires; $c->_clear_session_instance_data; } @@ -159,12 +170,15 @@ sub _save_flash { my $sid = $c->sessionid; + my $session_data = $c->_session; if (%$flash_data) { - $c->store_session_data( "flash:$sid", $flash_data ); + $session_data->{__flash} = $flash_data; } else { - $c->delete_session_data("flash:$sid"); + delete $session_data->{__flash}; } + $c->_session($session_data); + $c->_save_session; } } @@ -229,8 +243,11 @@ sub _load_flash { $c->_tried_loading_flash_data(1); if ( my $sid = $c->sessionid ) { - if ( my $flash_data = $c->_flash - || $c->_flash( $c->get_session_data("flash:$sid") ) ) + + my $session_data = $c->session; + $c->_flash($session_data->{__flash}); + + if ( my $flash_data = $c->_flash ) { $c->_flash_key_hashes({ map { $_ => Object::Signature::signature( \$flash_data->{$_} ) } keys %$flash_data }); @@ -401,8 +418,8 @@ sub _set_flash { sub flash { my $c = shift; $c->_flash_data; - $c->_set_flash(@_); - return $c->_flash; + $c->_set_flash(@_); + return $c->_flash; } sub clear_flash { @@ -521,8 +538,7 @@ __END__ =head1 NAME -Catalyst::Plugin::Session - Generic Session plugin - ties together server side -storage and client side state required to maintain session data. +Catalyst::Plugin::Session - Generic Session plugin - ties together server side storage and client side state required to maintain session data. =head1 SYNOPSIS @@ -534,11 +550,11 @@ storage and client side state required to maintain session data. Session::State::Cookie /; - # you can replace Store::FastMmap with Store::File - both have sensible - # default configurations (see their docs for details) + # you can replace Store::FastMmap with Store::File - both have sensible + # default configurations (see their docs for details) - # more complicated backends are available for other scenarios (DBI storage, - # etc) + # more complicated backends are available for other scenarios (DBI storage, + # etc) # after you've loaded the plugins you can save session data @@ -671,7 +687,7 @@ Zap all the keys in the flash regardless of their current state. =item keep_flash @keys -If you wawnt to keep a flash key for the next request too, even if it hasn't +If you want to keep a flash key for the next request too, even if it hasn't changed, call C and pass in the keys as arguments. =item delete_session REASON @@ -679,6 +695,8 @@ changed, call C and pass in the keys as arguments. This method is used to invalidate a session. It takes an optional parameter which will be saved in C if provided. +NOTE: This method will B delete your flash data. + =item session_delete_reason This accessor contains a string with the reason a session was deleted. Possible @@ -737,16 +755,21 @@ listed in L. =item prepare_action -This methoid is extended. +This method is extended. -It's only effect is if the (off by default) C configuration +Its only effect is if the (off by default) C configuration parameter is on - then it will copy the contents of the flash to the stash at prepare time. -=item finalize +=item finalize_headers + +This method is extended and will extend the expiry time before sending +the response. -This method is extended and will extend the expiry time, as well as persist the -session data if a session exists. +=item finalize_body + +This method is extended and will call finalize_session before the other +finalize_body methods run. Here we persist the session data if a session exists. =item initialize_session_data @@ -755,7 +778,7 @@ called by the C method if appropriate. =item create_session_id -Creates a new session id using C if there is no session ID +Creates a new session ID using C if there is no session ID yet. =item validate_session_id SID @@ -770,7 +793,7 @@ insensitive hexadecimal characters. This method will return a string that can be used as a session ID. It is supposed to be a reasonably random string with enough bits to prevent collision. It basically takes C and hashes it using SHA-1, -MD5 or SHA-256, depending on the availibility of these modules. +MD5 or SHA-256, depending on the availability of these modules. =item session_hash_seed @@ -781,29 +804,19 @@ Currently it returns a concatenated string which contains: =over 4 -=item * - -A counter - -=item * - -The current time +=item * A counter -=item * - -One value from C. +=item * The current time -=item * +=item * One value from C. -The stringified value of a newly allocated hash reference - -=item * +=item * The stringified value of a newly allocated hash reference -The stringified value of the Catalyst context object +=item * The stringified value of the Catalyst context object =back -In the hopes that those combined values are entropic enough for most uses. If +in the hopes that those combined values are entropic enough for most uses. If this is not the case you can replace C with e.g. sub session_hash_seed { @@ -836,6 +849,27 @@ This clears the various accessors after saving to the store. See L - ammends the session data structure to the list of dumped objects if session ID is defined. + +=item calculate_extended_session_expires + +=item calculate_initial_session_expires + +=item create_session_id_if_needed + +=item delete_session_id + +=item extend_session_expires + +=item extend_session_id + +=item get_session_id + +=item reset_session_expires + +=item session_is_valid + +=item set_session_id + =back =head1 USING SESSIONS DURING PREPARE @@ -847,16 +881,16 @@ State plugins must set $c->session ID before C, and during C L will actually load the data from the store. - sub prepare_action { - my $c = shift; + sub prepare_action { + my $c = shift; - # don't touch $c->session yet! + # don't touch $c->session yet! - $c->NEXT::prepare_action( @_ ); + $c->NEXT::prepare_action( @_ ); - $c->session; # this is OK - $c->sessionid; # this is also OK - } + $c->session; # this is OK + $c->sessionid; # this is also OK + } =head1 CONFIGURATION @@ -927,13 +961,13 @@ users' sessions cannot persist. To let these users access your site you can either disable address verification as a whole, or provide a checkbox in the login dialog that tells the server that it's OK for the address of the client to change. When the server sees that -this box is checked it should delete the C<__address> sepcial key from the +this box is checked it should delete the C<__address> special key from the session hash when the hash is first created. =head2 Race Conditions -In this day and age where cleaning detergents and dutch football (not the -american kind) teams roam the plains in great numbers, requests may happen +In this day and age where cleaning detergents and Dutch football (not the +American kind) teams roam the plains in great numbers, requests may happen simultaneously. This means that there is some risk of session data being overwritten, like this: @@ -941,7 +975,7 @@ overwritten, like this: =item 1. -request a starts, request b starts, with the same session id +request a starts, request b starts, with the same session ID =item 2. @@ -966,7 +1000,7 @@ changes by request a =back -If this is a concern in your application, a soon to be developed locking +If this is a concern in your application, a soon-to-be-developed locking solution is the only safe way to go. This will have a bigger overhead. For applications where any given user is only making one request at a time this @@ -974,25 +1008,25 @@ plugin should be safe enough. =head1 AUTHORS -=over 4 +Andy Grundman -=item Andy Grundman +Christian Hansen -=item Christian Hansen +Yuval Kogman, C -=item Yuval Kogman, C (current maintainer) +Sebastian Riedel -=item Sebastian Riedel +Tomas Doran (t0m) C (current maintainer) -=back +Sergio Salvi And countless other contributers from #catalyst. Thanks guys! =head1 COPYRIGHT & LICENSE - Copyright (c) 2005 the aforementioned authors. All rights - reserved. This program is free software; you can redistribute - it and/or modify it under the same terms as Perl itself. + Copyright (c) 2005 the aforementioned authors. All rights + reserved. This program is free software; you can redistribute + it and/or modify it under the same terms as Perl itself. =cut