[PATCH conductor] fix API bug introduced by user groups commit

Scott Seago sseago at redhat.com
Thu Jun 7 14:01:18 UTC 2012


On 06/07/2012 08:56 AM, Petr Blaho wrote:
> On Wednesday, June 06, 2012 10:03:32 AM Scott Seago wrote:
>> The user groups commit introduced a bug in http auth for the Conductor API
>> where we froze a hash that shouldn't have been frozen.
>>
>> With this commit we only duplicate and re-freeze if it's frozen to start with.
>> ---
>>   src/app/controllers/application_controller.rb |    5 +++--
>>   1 files changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
>> index 6f280be..559e127 100644
>> --- a/src/app/controllers/application_controller.rb
>> +++ b/src/app/controllers/application_controller.rb
>> @@ -179,9 +179,10 @@ class ApplicationController<  ActionController::Base
>>     def http_auth_user
>>       return unless request.authorization&&  request.authorization =~ /^Basic (.*)/m
>>       authenticate!(:scope =>  :api)
>> -    request.session_options = request.session_options.dup
>> +    frozen = request.session_options.frozen?
>> +    request.session_options = request.session_options.dup if frozen
>>       request.session_options[:expire_after] = 2.minutes
>> -    request.session_options.freeze
>> +    request.session_options.freeze if frozen
>>       # we use :api scope for authentication to avoid saving session.
>>       # But it's handy to set authenticated user in default scope, so we
>>       # can use current_user, instead of current_user(:api)
>>
> ACK - works for problem in master branch.
>
I've included these changes in the patch I just sent, since the above 
doesn't fully resolve the problem, even on master. The new patch should 
resolve it all.

Scott




More information about the aeolus-devel mailing list