[PATCH] RM#3508 - Ensure that all sessions expire

Tomáš Hrčka thrcka at redhat.com
Tue Aug 14 20:05:24 UTC 2012


---
 src/app/controllers/application_controller.rb |  9 ++++++-
 src/config/initializers/session_store.rb      |  2 +-
 src/public/javascripts/application.js         |  7 +++++-
 src/spec/controllers/pools_controller_spec.rb |  1 +
 src/spec/requests/sessions_spec.rb            | 34 +++++++++++++++++++++++++++
 5 files changed, 50 insertions(+), 3 deletions(-)
 create mode 100644 src/spec/requests/sessions_spec.rb

diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index be59245..a1561f5 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -25,7 +25,7 @@ class ApplicationController < ActionController::Base
   # FIXME: not sure what we're doing aobut service layer w/ deltacloud
   include ApplicationService
   helper_method :current_session, :current_user, :filter_view?
-  before_filter :read_breadcrumbs, :set_locale
+  before_filter :read_breadcrumbs, :set_locale, :check_session
 
   # General error handlers, must be in order from least specific
   # to most specific
@@ -422,4 +422,11 @@ class ApplicationController < ActionController::Base
     result
   end
 
+  #before filter to invalidate session for backbone
+  def check_session
+    return unless request.format == :json
+    logout if SessionEntity.find_by_session_id(current_session).present? &&
+        SessionEntity.find_by_session_id(current_session).created_at < 15.minutes.ago
+  end
+
 end
diff --git a/src/config/initializers/session_store.rb b/src/config/initializers/session_store.rb
index 8ff62fa..5fd69a1 100644
--- a/src/config/initializers/session_store.rb
+++ b/src/config/initializers/session_store.rb
@@ -28,4 +28,4 @@ Conductor::Application.config.session = {
 # Use the database for sessions instead of the cookie-based default,
 # which shouldn't be used to store highly confidential information
 # (create the session table with "rake db:sessions:create")
-Conductor::Application.config.session_store :active_record_store
+Conductor::Application.config.session_store :active_record_store, :expire_after => 15.minutes
diff --git a/src/public/javascripts/application.js b/src/public/javascripts/application.js
index 2162880..fa842b2 100644
--- a/src/public/javascripts/application.js
+++ b/src/public/javascripts/application.js
@@ -25,7 +25,12 @@ $.extend(Conductor, {
         $('#tab').html(data).show();
       })
       .error(function(data) {
-        $('#tab').html(data.responseText).show();
+        // If our session has timed out, redirect to the login page:
+        if(data.status == 401) {
+          window.location = Conductor.PATH_PREFIX + "login";
+        } else {
+          $('#tab').html(data.responseText).show();
+        }
       });
 
       Conductor.tabRemoveActiveClass();
diff --git a/src/spec/controllers/pools_controller_spec.rb b/src/spec/controllers/pools_controller_spec.rb
index ba68755..89f42de 100644
--- a/src/spec/controllers/pools_controller_spec.rb
+++ b/src/spec/controllers/pools_controller_spec.rb
@@ -95,6 +95,7 @@ describe PoolsController do
 
     it "should return 401" do
       get :index
+      puts response.body
       response.response_code.should == 401
     end
   end
diff --git a/src/spec/requests/sessions_spec.rb b/src/spec/requests/sessions_spec.rb
new file mode 100644
index 0000000..c93df9d
--- /dev/null
+++ b/src/spec/requests/sessions_spec.rb
@@ -0,0 +1,34 @@
+require 'spec_helper'
+
+describe "Sessions" do
+  describe "User not logged in" do
+
+    it "should not be authenticated" do
+      get pools_path
+      response.status.should be(302)
+    end
+  end
+
+  describe "User logged in" do
+    before do
+      @user = FactoryGirl.create :tuser
+      visit root_path
+      fill_in "Username", :with => @user.login
+      fill_in "password-input", :with => "secret"
+      click_button "Login"
+    end
+
+    it "should be authenticated" do
+      page.status_code.should be(200)
+    end
+
+    it "should have expired session" do
+      visit pools_path
+      Timecop.travel(Time.now+16.minutes)
+      visit pools_path
+      page.body.should include "#login"
+      Timecop.return
+    end
+
+    end
+end
-- 
1.7.11.2




More information about the aeolus-devel mailing list