On Feb 21, 12:20 pm, Christoph Zwerschke <[email protected]> wrote:
>
> If it's only a session cookie then it's not so serious a problem.
Do the cookie types differ in more than their lifetimes then? Either
way, you can keep your browser open indefinitely, and potentially gain
access to controllers that the developer might thing you shouldn't be
able to.
> if not credentials or credentials.get('repoze.what.userid') is None
>
> instead of only
>
> if not credentials
I don't know if that queries the identity dict or does something
deeper, but 'repoze.what.userid' in the identity dict is indeed set to
the user name as you would expect. It's just that no user exists by
that name any more!
--
Ben Sizer
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"TurboGears" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/turbogears?hl=en
-~----------~----~----~----~------~----~------~--~---
