r5474 - in trunk: cumin/python/cumin cumin/python/cumin/account wooly/python/wooly
tmckay at fedoraproject.org
tmckay at fedoraproject.org
Wed Sep 26 11:57:07 UTC 2012
Author: tmckay
Date: 2012-09-26 11:57:06 +0000 (Wed, 26 Sep 2012)
New Revision: 5474
Modified:
trunk/cumin/python/cumin/account/widgets.py
trunk/cumin/python/cumin/widgets.py
trunk/wooly/python/wooly/server.py
Log:
Session id regeneration fix
BZ840123
Modified: trunk/cumin/python/cumin/account/widgets.py
===================================================================
--- trunk/cumin/python/cumin/account/widgets.py 2012-09-26 11:52:54 UTC (rev 5473)
+++ trunk/cumin/python/cumin/account/widgets.py 2012-09-26 11:57:06 UTC (rev 5474)
@@ -147,7 +147,12 @@
if user is None:
user = name
login = LoginSession(self.app, user, roles)
- session.client_session.attributes["login_session"] = login
+
+ # We want to generate a new session id and record the
+ # login while keeping the rest of the session data.
+ # This is to protect against session fixation attacks.
+ self.app.server.reset_client_session_id(session, login)
+
url = self.page.origin.get(session)
self.page.redirect.set(session, url)
else:
Modified: trunk/cumin/python/cumin/widgets.py
===================================================================
--- trunk/cumin/python/cumin/widgets.py 2012-09-26 11:52:54 UTC (rev 5473)
+++ trunk/cumin/python/cumin/widgets.py 2012-09-26 11:57:06 UTC (rev 5474)
@@ -1363,7 +1363,11 @@
if user is None:
user = username
login = LoginSession(self.app, user, roles)
- session.client_session.attributes["login_session"] = login
+
+ # We want to generate a new session id and record the
+ # login while keeping the rest of the session data.
+ # This is to protect against session fixation attacks.
+ self.app.server.reset_client_session_id(session, login)
return True
return False
Modified: trunk/wooly/python/wooly/server.py
===================================================================
--- trunk/wooly/python/wooly/server.py 2012-09-26 11:52:54 UTC (rev 5473)
+++ trunk/wooly/python/wooly/server.py 2012-09-26 11:57:06 UTC (rev 5474)
@@ -200,12 +200,30 @@
self.client_sessions_by_id[csession.id] = csession
session.set_cookie("session", csession.id)
- log.debug("Created %s", csession)
-
csession.visited = datetime.now()
-
return csession
+ def reset_client_session_id(self, session, login):
+
+ # Take the client session out of the dict.
+ # We're going to insert a new one. Running threads that
+ # have a reference will continue to execute...
+ try:
+ del self.client_sessions_by_id[session.client_session.id]
+ except KeyError:
+ pass
+
+ nclient = ClientSession()
+ # we've already got copy.copy from wooly.util
+ nclient.attributes = copy(session.client_session.attributes)
+ nclient.attributes["login_session"] = login
+ nclient.visited = datetime.now()
+ self.client_sessions_by_id[nclient.id] = nclient
+
+ # ...and reset the cookie for the broswer
+ session.client_session = nclient
+ session.set_cookie("session", session.client_session.id)
+
def __repr__(self):
return "%s(%s,%i)" % (self.__class__.__name__, self.host, self.port)
@@ -320,7 +338,11 @@
for session in self.server.client_sessions_by_id.values():
if session.visited is not None and session.visited < when:
- del self.server.client_sessions_by_id[session.id]
- count += 1
+ try:
+ del self.server.client_sessions_by_id[session.id]
+ count += 1
+ except KeyError:
+ pass
+
log.info("Expired %i client sessions", count)
More information about the cumin-developers
mailing list