[PATCH conductor] fix API bug introduced by user groups commit

Scott Seago sseago at redhat.com
Wed Jun 6 14:03:32 UTC 2012


The user groups commit introduced a bug in http auth for the Conductor API
where we froze a hash that shouldn't have been frozen.

With this commit we only duplicate and re-freeze if it's frozen to start with.
---
 src/app/controllers/application_controller.rb |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/app/controllers/application_controller.rb b/src/app/controllers/application_controller.rb
index 6f280be..559e127 100644
--- a/src/app/controllers/application_controller.rb
+++ b/src/app/controllers/application_controller.rb
@@ -179,9 +179,10 @@ class ApplicationController < ActionController::Base
   def http_auth_user
     return unless request.authorization && request.authorization =~ /^Basic (.*)/m
     authenticate!(:scope => :api)
-    request.session_options = request.session_options.dup
+    frozen = request.session_options.frozen?
+    request.session_options = request.session_options.dup if frozen
     request.session_options[:expire_after] = 2.minutes
-    request.session_options.freeze
+    request.session_options.freeze if frozen
     # we use :api scope for authentication to avoid saving session.
     # But it's handy to set authenticated user in default scope, so we
     # can use current_user, instead of current_user(:api)
-- 
1.7.6.5




More information about the aeolus-devel mailing list