The user groups commit introduced a bug in http auth for the Conductor API
where we froze a hash that shouldn't have been frozen.
With this commit we only duplicate and re-freeze if it's frozen to start with.
---
src/app/controllers/application_controller.rb | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/app/controllers/application_controller.rb
b/src/app/controllers/application_controller.rb
index 6f280be..559e127 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -179,9 +179,10 @@ class ApplicationController < ActionController::Base
def http_auth_user
return unless request.authorization && request.authorization =~ /^Basic
(.*)/m
authenticate!(:scope => :api)
- request.session_options = request.session_options.dup
+ frozen = request.session_options.frozen?
+ request.session_options = request.session_options.dup if frozen
request.session_options[:expire_after] = 2.minutes
- request.session_options.freeze
+ request.session_options.freeze if frozen
# we use :api scope for authentication to avoid saving session.
# But it's handy to set authenticated user in default scope, so we
# can use current_user, instead of current_user(:api)
--
1.7.6.5