r5474 - in trunk: cumin/python/cumin cumin/python/cumin/account wooly/python/wooly

tmckay at fedoraproject.org tmckay at fedoraproject.org
Wed Sep 26 11:57:07 UTC 2012


Author: tmckay
Date: 2012-09-26 11:57:06 +0000 (Wed, 26 Sep 2012)
New Revision: 5474

Modified:
   trunk/cumin/python/cumin/account/widgets.py
   trunk/cumin/python/cumin/widgets.py
   trunk/wooly/python/wooly/server.py
Log:
Session id regeneration fix
BZ840123


Modified: trunk/cumin/python/cumin/account/widgets.py
===================================================================
--- trunk/cumin/python/cumin/account/widgets.py	2012-09-26 11:52:54 UTC (rev 5473)
+++ trunk/cumin/python/cumin/account/widgets.py	2012-09-26 11:57:06 UTC (rev 5474)
@@ -147,7 +147,12 @@
                         if user is None:
                             user = name
                         login = LoginSession(self.app, user, roles)
-                        session.client_session.attributes["login_session"] = login
+                        
+                        # We want to generate a new session id and record the
+                        # login while keeping the rest of the session data.  
+                        # This is to protect against session fixation attacks.
+                        self.app.server.reset_client_session_id(session, login)
+
                         url = self.page.origin.get(session)
                         self.page.redirect.set(session, url)
                 else:

Modified: trunk/cumin/python/cumin/widgets.py
===================================================================
--- trunk/cumin/python/cumin/widgets.py	2012-09-26 11:52:54 UTC (rev 5473)
+++ trunk/cumin/python/cumin/widgets.py	2012-09-26 11:57:06 UTC (rev 5474)
@@ -1363,7 +1363,11 @@
                 if user is None:
                     user = username
                 login = LoginSession(self.app, user, roles)
-                session.client_session.attributes["login_session"] = login
+
+                # We want to generate a new session id and record the
+                # login while keeping the rest of the session data.  
+                # This is to protect against session fixation attacks.
+                self.app.server.reset_client_session_id(session, login)
                 return True
         return False
 

Modified: trunk/wooly/python/wooly/server.py
===================================================================
--- trunk/wooly/python/wooly/server.py	2012-09-26 11:52:54 UTC (rev 5473)
+++ trunk/wooly/python/wooly/server.py	2012-09-26 11:57:06 UTC (rev 5474)
@@ -200,12 +200,30 @@
             self.client_sessions_by_id[csession.id] = csession
             session.set_cookie("session", csession.id)
 
-            log.debug("Created %s", csession)
-
         csession.visited = datetime.now()
-
         return csession
 
+    def reset_client_session_id(self, session, login):
+
+        # Take the client session out of the dict.
+        # We're going to insert a new one.  Running threads that
+        # have a reference will continue to execute...
+        try:
+            del self.client_sessions_by_id[session.client_session.id]
+        except KeyError:
+            pass
+
+        nclient = ClientSession()
+        # we've already got copy.copy from wooly.util
+        nclient.attributes = copy(session.client_session.attributes)
+        nclient.attributes["login_session"] = login
+        nclient.visited = datetime.now()
+        self.client_sessions_by_id[nclient.id] = nclient
+            
+        # ...and reset the cookie for the broswer
+        session.client_session = nclient
+        session.set_cookie("session", session.client_session.id)
+
     def __repr__(self):
         return "%s(%s,%i)" % (self.__class__.__name__, self.host, self.port)
 
@@ -320,7 +338,11 @@
 
         for session in self.server.client_sessions_by_id.values():
             if session.visited is not None and session.visited < when:
-                del self.server.client_sessions_by_id[session.id]
-                count += 1
+                try:
+                    del self.server.client_sessions_by_id[session.id]
+                    count += 1
+                except KeyError:
+                    pass
 
+
         log.info("Expired %i client sessions", count)



More information about the cumin-developers mailing list