diff options
| author | shugo <shugo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2004-08-24 07:59:50 +0000 |
|---|---|---|
| committer | shugo <shugo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2004-08-24 07:59:50 +0000 |
| commit | ef79c91721f6174b55bad6a4aa0701dae1aece6e (patch) | |
| tree | 79aa1bb6b1abb9477576ee6d2c3c1d6330686db8 /lib/cgi | |
| parent | a2aca50af0a3fd98f520895374d1ab7911a4ad81 (diff) | |
| download | ruby-ef79c91721f6174b55bad6a4aa0701dae1aece6e.tar.gz ruby-ef79c91721f6174b55bad6a4aa0701dae1aece6e.tar.xz ruby-ef79c91721f6174b55bad6a4aa0701dae1aece6e.zip | |
* lib/cgi/session.rb (CGI::Session::FileStore#initialize): do not
use a session id as a filename.
* lib/cgi/session/pstore.rb (CGI::Session::PStore#initialize): ditto.
* lib/cgi/session/pstore.rb (CGI::Session::PStore#initialize): use
Dir::tmpdir.
git-svn-id: http://svn.ruby-lang.org/repos/ruby/trunk@6815 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib/cgi')
| -rw-r--r-- | lib/cgi/session.rb | 11 | ||||
| -rw-r--r-- | lib/cgi/session/pstore.rb | 13 |
2 files changed, 7 insertions, 17 deletions
diff --git a/lib/cgi/session.rb b/lib/cgi/session.rb index a5afb7e3e..c320ac9c4 100644 --- a/lib/cgi/session.rb +++ b/lib/cgi/session.rb @@ -331,10 +331,6 @@ class CGI # user is responsible for converting other types to Strings when # storing and from Strings when retrieving. class FileStore - def check_id(id) #:nodoc: - /[^0-9a-zA-Z]/ =~ id.to_s ? false : true - end - # Create a new FileStore instance. # # This constructor is used internally by CGI::Session. The @@ -361,10 +357,9 @@ class CGI dir = option['tmpdir'] || Dir::tmpdir prefix = option['prefix'] || '' id = session.session_id - unless check_id(id) - raise ArgumentError, "session_id `%s' is invalid" % id - end - @path = dir+"/"+prefix+id.dup.untaint + require 'digest/md5' + md5 = Digest::MD5.hexdigest(id)[0,16] + @path = dir+"/"+prefix+md5 unless File::exist? @path @hash = {} end diff --git a/lib/cgi/session/pstore.rb b/lib/cgi/session/pstore.rb index f46dd5739..033acc324 100644 --- a/lib/cgi/session/pstore.rb +++ b/lib/cgi/session/pstore.rb @@ -31,10 +31,6 @@ class CGI # library file pstore.rb. Session data is marshalled and stored # in a file. File locking and transaction services are provided. class PStore - def check_id(id) #:nodoc: - /[^0-9a-zA-Z]/ =~ id.to_s ? false : true - end - # Create a new CGI::Session::PStore instance # # This constructor is used internally by CGI::Session. The @@ -58,13 +54,12 @@ class CGI # This session's PStore file will be created if it does # not exist, or opened if it does. def initialize session, option={} - dir = option['tmpdir'] || ENV['TMP'] || '/tmp' + dir = option['tmpdir'] || Dir::tmpdir prefix = option['prefix'] || '' id = session.session_id - unless check_id(id) - raise ArgumentError, "session_id `%s' is invalid" % id - end - path = dir+"/"+prefix+id + require 'digest/md5' + md5 = Digest::MD5.hexdigest(id)[0,16] + path = dir+"/"+prefix+md5 path.untaint unless File::exist? path @hash = {} |