On 06/07/2012 08:56 AM, Petr Blaho wrote:
On Wednesday, June 06, 2012 10:03:32 AM Scott Seago wrote:
> The user groups commit introduced a bug in http auth for the Conductor API
> where we froze a hash that shouldn't have been frozen.
>
> With this commit we only duplicate and re-freeze if it's frozen to start with.
> ---
> src/app/controllers/application_controller.rb | 5 +++--
> 1 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/src/app/controllers/application_controller.rb
b/src/app/controllers/application_controller.rb
> index 6f280be..559e127 100644
> --- a/src/app/controllers/application_controller.rb
> +++ b/src/app/controllers/application_controller.rb
> @@ -179,9 +179,10 @@ class ApplicationController< ActionController::Base
> def http_auth_user
> return unless request.authorization&& request.authorization =~ /^Basic
(.*)/m
> authenticate!(:scope => :api)
> - request.session_options = request.session_options.dup
> + frozen = request.session_options.frozen?
> + request.session_options = request.session_options.dup if frozen
> request.session_options[:expire_after] = 2.minutes
> - request.session_options.freeze
> + request.session_options.freeze if frozen
> # we use :api scope for authentication to avoid saving session.
> # But it's handy to set authenticated user in default scope, so we
> # can use current_user, instead of current_user(:api)
>
ACK - works for problem in master branch.
I've included these changes in the patch I just sent, since the above
doesn't fully resolve the problem, even on master. The new patch should
resolve it all.
Scott