Author: aaugustin
Date: 2011-11-27 09:52:24 -0800 (Sun, 27 Nov 2011)
New Revision: 17155
Modified:
django/trunk/django/contrib/sessions/backends/base.py
django/trunk/django/contrib/sessions/backends/cache.py
django/trunk/django/contrib/sessions/backends/cached_db.py
django/trunk/django/contrib/sessions/backends/db.py
django/trunk/django/contrib/sessions/backends/file.py
django/trunk/django/contrib/sessions/backends/signed_cookies.py
django/trunk/django/contrib/sessions/tests.py
django/trunk/tests/regressiontests/test_client_regress/session.py
Log:
Fixed #11555 -- Made SessionBase.session_key read-only. Cleaned up code
slightly. Refs #13478.
This also removes the implicit initialization of the session key on the first
access in favor of explicit initialization.
Modified: django/trunk/django/contrib/sessions/backends/base.py
===================================================================
--- django/trunk/django/contrib/sessions/backends/base.py 2011-11-27
13:00:56 UTC (rev 17154)
+++ django/trunk/django/contrib/sessions/backends/base.py 2011-11-27
17:52:24 UTC (rev 17155)
@@ -54,12 +54,6 @@
del self._session[key]
self.modified = True
- def keys(self):
- return self._session.keys()
-
- def items(self):
- return self._session.items()
-
def get(self, key, default=None):
return self._session.get(key, default)
@@ -116,9 +110,15 @@
def has_key(self, key):
return key in self._session
+ def keys(self):
+ return self._session.keys()
+
def values(self):
return self._session.values()
+ def items(self):
+ return self._session.items()
+
def iterkeys(self):
return self._session.iterkeys()
@@ -145,7 +145,7 @@
except AttributeError:
# No getpid() in Jython, for example
pid = 1
- while 1:
+ while True:
session_key = hashlib.md5("%s%s%s%s"
% (randrange(0, MAX_SESSION_KEY), pid, time.time(),
settings.SECRET_KEY)).hexdigest()
@@ -153,17 +153,15 @@
break
return session_key
- def _get_session_key(self):
- if self._session_key:
- return self._session_key
- else:
+ def _get_or_create_session_key(self):
+ if self._session_key is None:
self._session_key = self._get_new_session_key()
- return self._session_key
+ return self._session_key
- def _set_session_key(self, session_key):
- self._session_key = session_key
+ def _get_session_key(self):
+ return self._session_key
- session_key = property(_get_session_key, _set_session_key)
+ session_key = property(_get_session_key)
def _get_session(self, no_load=False):
"""
@@ -174,7 +172,7 @@
try:
return self._session_cache
except AttributeError:
- if self._session_key is None or no_load:
+ if self.session_key is None or no_load:
self._session_cache = {}
else:
self._session_cache = self.load()
Modified: django/trunk/django/contrib/sessions/backends/cache.py
===================================================================
--- django/trunk/django/contrib/sessions/backends/cache.py 2011-11-27
13:00:56 UTC (rev 17154)
+++ django/trunk/django/contrib/sessions/backends/cache.py 2011-11-27
17:52:24 UTC (rev 17155)
@@ -11,8 +11,12 @@
self._cache = cache
super(SessionStore, self).__init__(session_key)
+ @property
+ def cache_key(self):
+ return KEY_PREFIX + self._get_or_create_session_key()
+
def load(self):
- session_data = self._cache.get(KEY_PREFIX + self.session_key)
+ session_data = self._cache.get(self.cache_key)
if session_data is not None:
return session_data
self.create()
@@ -25,7 +29,7 @@
# and then raise an exception. That's the risk you shoulder if using
# cache backing.
for i in xrange(10000):
- self.session_key = self._get_new_session_key()
+ self._session_key = self._get_new_session_key()
try:
self.save(must_create=True)
except CreateError:
@@ -39,8 +43,9 @@
func = self._cache.add
else:
func = self._cache.set
- result = func(KEY_PREFIX + self.session_key,
self._get_session(no_load=must_create),
- self.get_expiry_age())
+ result = func(self.cache_key,
+ self._get_session(no_load=must_create),
+ self.get_expiry_age())
if must_create and not result:
raise CreateError
@@ -49,8 +54,7 @@
def delete(self, session_key=None):
if session_key is None:
- if self._session_key is None:
+ if self.session_key is None:
return
- session_key = self._session_key
+ session_key = self.session_key
self._cache.delete(KEY_PREFIX + session_key)
-
Modified: django/trunk/django/contrib/sessions/backends/cached_db.py
===================================================================
--- django/trunk/django/contrib/sessions/backends/cached_db.py 2011-11-27
13:00:56 UTC (rev 17154)
+++ django/trunk/django/contrib/sessions/backends/cached_db.py 2011-11-27
17:52:24 UTC (rev 17155)
@@ -16,12 +16,15 @@
def __init__(self, session_key=None):
super(SessionStore, self).__init__(session_key)
+ @property
+ def cache_key(self):
+ return KEY_PREFIX + self._get_or_create_session_key()
+
def load(self):
- data = cache.get(KEY_PREFIX + self.session_key, None)
+ data = cache.get(self.cache_key, None)
if data is None:
data = super(SessionStore, self).load()
- cache.set(KEY_PREFIX + self.session_key, data,
- settings.SESSION_COOKIE_AGE)
+ cache.set(self.cache_key, data, settings.SESSION_COOKIE_AGE)
return data
def exists(self, session_key):
@@ -29,12 +32,15 @@
def save(self, must_create=False):
super(SessionStore, self).save(must_create)
- cache.set(KEY_PREFIX + self.session_key, self._session,
- settings.SESSION_COOKIE_AGE)
+ cache.set(self.cache_key, self._session, settings.SESSION_COOKIE_AGE)
def delete(self, session_key=None):
super(SessionStore, self).delete(session_key)
- cache.delete(KEY_PREFIX + (session_key or self.session_key))
+ if session_key is None:
+ if self.session_key is None:
+ return
+ session_key = self.session_key
+ cache.delete(KEY_PREFIX + session_key)
def flush(self):
"""
Modified: django/trunk/django/contrib/sessions/backends/db.py
===================================================================
--- django/trunk/django/contrib/sessions/backends/db.py 2011-11-27 13:00:56 UTC
(rev 17154)
+++ django/trunk/django/contrib/sessions/backends/db.py 2011-11-27 17:52:24 UTC
(rev 17155)
@@ -32,7 +32,7 @@
def create(self):
while True:
- self.session_key = self._get_new_session_key()
+ self._session_key = self._get_new_session_key()
try:
# Save immediately to ensure we have a unique entry in the
# database.
@@ -52,9 +52,9 @@
entry).
"""
obj = Session(
- session_key = self.session_key,
- session_data = self.encode(self._get_session(no_load=must_create)),
- expire_date = self.get_expiry_date()
+ session_key=self._get_or_create_session_key(),
+ session_data=self.encode(self._get_session(no_load=must_create)),
+ expire_date=self.get_expiry_date()
)
using = router.db_for_write(Session, instance=obj)
sid = transaction.savepoint(using=using)
@@ -68,9 +68,9 @@
def delete(self, session_key=None):
if session_key is None:
- if self._session_key is None:
+ if self.session_key is None:
return
- session_key = self._session_key
+ session_key = self.session_key
try:
Session.objects.get(session_key=session_key).delete()
except Session.DoesNotExist:
Modified: django/trunk/django/contrib/sessions/backends/file.py
===================================================================
--- django/trunk/django/contrib/sessions/backends/file.py 2011-11-27
13:00:56 UTC (rev 17154)
+++ django/trunk/django/contrib/sessions/backends/file.py 2011-11-27
17:52:24 UTC (rev 17155)
@@ -33,7 +33,7 @@
Get the file associated with this session key.
"""
if session_key is None:
- session_key = self.session_key
+ session_key = self._get_or_create_session_key()
# Make sure we're not vulnerable to directory traversal. Session keys
# should always be md5s, so they should never contain directory
@@ -135,9 +135,9 @@
def delete(self, session_key=None):
if session_key is None:
- if self._session_key is None:
+ if self.session_key is None:
return
- session_key = self._session_key
+ session_key = self.session_key
try:
os.unlink(self._key_to_file(session_key))
except OSError:
Modified: django/trunk/django/contrib/sessions/backends/signed_cookies.py
===================================================================
--- django/trunk/django/contrib/sessions/backends/signed_cookies.py
2011-11-27 13:00:56 UTC (rev 17154)
+++ django/trunk/django/contrib/sessions/backends/signed_cookies.py
2011-11-27 17:52:24 UTC (rev 17155)
@@ -30,7 +30,7 @@
raises BadSignature if signature fails.
"""
try:
- return signing.loads(self._session_key,
+ return signing.loads(self.session_key,
serializer=PickleSerializer,
max_age=settings.SESSION_COOKIE_AGE,
salt='django.contrib.sessions.backends.signed_cookies')
Modified: django/trunk/django/contrib/sessions/tests.py
===================================================================
--- django/trunk/django/contrib/sessions/tests.py 2011-11-27 13:00:56 UTC
(rev 17154)
+++ django/trunk/django/contrib/sessions/tests.py 2011-11-27 17:52:24 UTC
(rev 17155)
@@ -136,6 +136,7 @@
self.assertTrue(self.session.exists(self.session.session_key))
def test_delete(self):
+ self.session.save()
self.session.delete(self.session.session_key)
self.assertFalse(self.session.exists(self.session.session_key))
@@ -175,6 +176,11 @@
# session key; make sure that entry is manually deleted
session.delete('1')
+ def test_session_key_is_read_only(self):
+ def set_session_key(session):
+ session.session_key = session._get_new_session_key()
+ self.assertRaises(AttributeError, set_session_key, self.session)
+
# Custom session expiry
def test_default_expiry(self):
# A normal session has a max age equal to settings
@@ -360,7 +366,7 @@
response = middleware.process_response(request, response)
self.assertTrue(
response.cookies[settings.SESSION_COOKIE_NAME]['httponly'])
- self.assertIn('httponly',
+ self.assertIn('httponly',
str(response.cookies[settings.SESSION_COOKIE_NAME]))
@override_settings(SESSION_COOKIE_HTTPONLY=False)
@@ -375,12 +381,12 @@
# Handle the response through the middleware
response = middleware.process_response(request, response)
- #if it isn't in the cookie, that's fine (Python 2.5).
+ # If it isn't in the cookie, that's fine (Python 2.5)
if 'httponly' in settings.SESSION_COOKIE_NAME:
self.assertFalse(
response.cookies[settings.SESSION_COOKIE_NAME]['httponly'])
- self.assertNotIn('httponly',
+ self.assertNotIn('httponly',
str(response.cookies[settings.SESSION_COOKIE_NAME]))
class CookieSessionTests(SessionTestsMixin, TestCase):
Modified: django/trunk/tests/regressiontests/test_client_regress/session.py
===================================================================
--- django/trunk/tests/regressiontests/test_client_regress/session.py
2011-11-27 13:00:56 UTC (rev 17154)
+++ django/trunk/tests/regressiontests/test_client_regress/session.py
2011-11-27 17:52:24 UTC (rev 17155)
@@ -14,13 +14,13 @@
return False
def create(self):
- self.session_key = self.encode({})
+ self._session_key = self.encode({})
def save(self, must_create=False):
- self.session_key = self.encode(self._session)
+ self._session_key = self.encode(self._session)
def delete(self, session_key=None):
- self.session_key = self.encode({})
+ self._session_key = self.encode({})
def load(self):
try:
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/django-updates?hl=en.
