Changeset 226

Timestamp:

09/26/2007 14:14:55 (14 months ago)

Author:

zimbatm

Message:

Okay, SQL injection of [225] was fun but didn't work as expected. rdebug showed
me the light and gave me a good solution.

Files:

• trunk/lib/camping/session.rb (modified) (2 diffs)

trunk/lib/camping/session.rb

@@ -19 +19 @@
 class Session < Base
     serialize :ivars
-    # SQL injection to bypass id field checks
-    set_primary_key '"="" OR "'
+    set_primary_key :hashid
 
     def []=(k, v) # :nodoc:
@@ -29 +28 @@
     end
 
+  protected
     RAND_CHARS = [*'A'..'Z'] + [*'0'..'9'] + [*'a'..'z']
+    def before_create
+      rand_max = RAND_CHARS.size
+      sid = (0...32).inject("") { |ret,_| ret << RAND_CHARS[rand(rand_max)] }
+      write_attribute('hashid', sid)
+    end
 
     # Generates a new session ID and creates a row for the new session in the database.
     def self.generate cookies
-        rand_max = RAND_CHARS.size
-        sid = (0...32).inject("") { |ret,_| ret << RAND_CHARS[rand(rand_max)] }
-        sess = Session.create :hashid => sid, :ivars => Camping::H[]
+        sess = Session.create :ivars => Camping::H[]
         cookies.camping_sid = sess.hashid
         sess