[Ruby-session-devel-cvs] CVS: ruby-session/src/apache session.rb,1.4,1.5

[Sean C. <the...@us...>]

Update of /cvsroot/ruby-session/ruby-session/src/apache
In directory usw-pr-cvs1:/tmp/cvs-serv5376

Modified Files:
	session.rb 
Log Message:
*) I'm not even going to venture to guess what it was that I didn't change,
   but suffice it to say that a lot changed and this is only a snapshot for
   backup purposes only.


Index: session.rb
===================================================================
RCS file: /cvsroot/ruby-session/ruby-session/src/apache/session.rb,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- session.rb	20 Jun 2002 13:46:50 -0000	1.4
+++ session.rb	25 Jun 2002 01:53:45 -0000	1.5
@@ -5,42 +5,281 @@
 # $Id$
 
 require 'session'
+require 'apache/cookie'
+
+class Session
+  public
+
+  # Ugly hack-ish method for extending Session to include various
+  # routines not included in the base class and are special to
+  # Apache::Session
+
+  def apache_session_setup()
+    # Boolean values for where we fetched our session data from
+    @uri_session    = nil
+    @cookie_session = nil
+  end # def apache_session_setup
+end # module Session
+
+
 
 module Apache
+  class Request
+    attr_accessor(:cookie_session, :uri_session, :uri_session_place)
+    def setup_session_state()
+      @cookie_session ||= nil
+      @uri_session ||= nil
+      @uri_session_place ||= nil
+    end # def setup_session_state()
+  end # class Request
+
   class Session
+    NONE = 1
+    OPTIONAL = 2
+    REQUIRED = 3
+    URI_ARG = 4
+    URI_END = 5
+    URI_SESSION = 6
+    URI_START = 7
+
     @@html_session_re_a = nil
     @@html_session_re_form = nil
     @@html_session_re_img = nil
-    @@uri_session_ri = nil
+    @@uri_session_re = nil
+
+
+    def Session.check_access(r)
+      return_code = Apache::DECLINED
+
+      # This is likely going to bite people who have their apache
+      # config screwed up, but, we're going to check/refresh that
+      # people ar visiting the vhost that the server is setup to
+      # handle.  It's done for security reasons... sorry.
+      r.headers_in.each_key do |header|
+	if header.downcase == 'host' and
+	    r.headers_in['Host'].downcase != r.server_name.downcase
+	  r.headers_out['Location'] = r.construct_url(r.unparsed_uri)
+	  return(Apache::HTTP_MOVED_TEMPORARILY)
+	end # if header.downcase
+      end # r.headers_in...
+
+
+      # Setup the session environment now that the request has a URI
+      if ENV.has_key?('COOKIE_SESSION')
+	case ENV['COOKIE_SESSION']
+	when 'required'
+	  r.cookie_session = REQUIRED
+	when 'optional'
+	  r.cookie_session = OPTIONAL
+	when 'none'
+	  r.cookie_sessoin = NONE
+	else
+	  r.cookie_session = OPTIONAL
+	end # case ENV['COOKIE_SESSION']
+      end # if ENV.has_key?('COOKIE_SESSION')
+
+      if ENV.has_key?('URI_SESSION')
+	case ENV['URI_SESSION']
+	when 'required'
+	  r.uri_session = REQUIRED
+	when 'optional'
+	  r.uri_session = OPTIONAL
+	when 'none'
+	  r.uri_session = NONE
+	else
+	  r.uri_session = OPTIONAL
+	end # case ENV['URI_SESSION']
+      end # if ENV.has_key?('URI_SESSION')
+
+      if ENV.has_key?('URI_SESSION_PLACE')
+	case ENV['URI_SESSION_PLACE']
+	when 'arg'
+	  r.uri_session_place = URI_ARG
+	when 'end'
+	  r.uri_session_place = URI_END
+	when 'start'
+	  r.uri_session_place = URI_START
+	else
+	  r.uri_session_place = URI_START
+	end # case ENV['URI_SESSION_PLACE']
+      end # if ENV.has_key?('URI_SESSION_PLACE')
+
+      case r.uri_session
+      when REQUIRED
+	# Send user a 302 with session in URI
+	if $session.session_id.nil?
+	  $session.generate()
+
+	  args = r.args || ''
+	  path_info = r.path_info || ''
+
+	  case r.uri_session_place
+	  when URI_ARG
+	    if r.args.nil?
+	      r.headers_out['Location'] = "#{r.uri}#{path_info}?sess=#{$session.session_id}"
+	    else
+	      r.headers_out['Location'] = "#{r.uri}#{path_info}#{args}&sess=#{$session.session_id}"
+	    end
+	  when URI_END
+	    r.headers_out['Location'] = "#{File.dirname(r.uri)}/sess=#{$session.session_id}/#{File.basename(r.uri)}#{path_info}#{args}"
+	  when URI_START
+	    r.headers_out['Location'] = "/sess=#{$session.session_id}#{r.uri}#{path_info}#{args}"
+	  end # case r.uri_session_place
+	  return(Apache::HTTP_MOVED_TEMPORARILY)
+	end
+	return_code = Apache::OK
+      when OPTIONAL
+	# If session exists, don't destroy it
+	# Pass user along regardless of whether they have one or not
+	return_code = Apache::OK
+      when NONE
+	# Remove any session data found in the env
+	# Pass the user along with an empty session id/data
+	$session = nil
+	return_code = Apache::DECLINED
+      end # case r.uri_session
+
+
+      # XXXX
+      case r.cookie_session
+      when REQUIRED
+
+	# If required and we don't have any cookies, 302 the user to
+	# our URL again, but send out a test cookie in the 302.  If we
+	# catch a cookie in the response, then let the user through.
+	# If the user doesn't allow cookies, and r.uri_session is set
+	# to OPTIONAL, then bounce the user a URI session.  This
+	# allows for cookied sessions by default, but if the user is
+	# smart and has turned off cookies, then we still let them
+	# through the site.
+
+	if $session.session_id.nil?
+	  $session.generate()
+
+	  args = r.args || ''
+	  path_info = r.path_info || ''
+
+	  case r.uri_session_place
+	  when URI_ARG
+	    if r.args.nil?
+	      r.headers_out['Location'] = "#{r.uri}#{path_info}?sess=#{$session.session_id}"
+	    else
+	      r.headers_out['Location'] = "#{r.uri}#{path_info}#{args}&sess=#{$session.session_id}"
+	    end
+	  when URI_END
+	    r.headers_out['Location'] = "#{File.dirname(r.uri)}/sess=#{$session.session_id}/#{File.basename(r.uri)}#{path_info}#{args}"
+	  when URI_START
+	    r.headers_out['Location'] = "/sess=#{$session.session_id}#{r.uri}#{path_info}#{args}"
+	  end # case r.uri_session_place
+	  return(Apache::HTTP_MOVED_TEMPORARILY)
+	end
+	return_code = Apache::OK
+      when OPTIONAL
+	# If session exists, don't destroy it
+	# Pass user along regardless of whether they have one or not
+	return_code = Apache::OK
+      when NONE
+	# Remove any session data found in the env
+	# Pass the user along with an empty session id/data
+	$session = nil
+	return_code = Apache::DECLINED
+      end # case r.uri_session
+
+      $session.load() unless $session.session_id.nil?
+
+      return(return_code)
+    end # def Session.check_access()
+
 
     def Session.cleanup(r)
-      s = nil
+      $session = nil
+      return(Apache::OK)
     end # def Session.cleanup()
 
 
     def Session.init(r)
-      s = Session.new()
+      r.setup_session_state()
+      s = Kernel.const_get('Session').new()
+      s.apache_session_setup()
 
-      # One time init junk
+      # One time init foo
       @@html_session_re_a    ||= Regexp.new('(<\s*[Aa].*?[Hh][Rr][Ee][Ff]\s*=\s*)(([\'\"])((?:[^#]|[Mm][Aa][Ii][Ll][Tt][Oo]).*?[^\?]*?){0,1}(\?.*?){0,1}\3)(.*?>)')
       @@html_session_re_form ||= Regexp.new('(<\s*[Ff][Oo][Rr][Mm].*?[Aa][Cc][Tt][Ii][Oo][Nn]\s*=\s*)(([\'"])([^\?]*?){0,1}(\?.*?){0,1}\3)(.*?>)')
       @@html_session_re_img  ||= Regexp.new('(<\s*[Ii][Mm][Gg].*?[Ss][Rr][Cc]\s*=\s*)(([\'"])([^\?]*?){0,1}(\?.*?){0,1}\3)(.*?>)')
-      @@uri_session_re       ||= Regexp.new('/sess=([A-Fa-f0-9]{32})/')
+      @@uri_session_re       ||= Regexp.new('([\/\?\&])sess=([A-Fa-f0-9]{32})([\&\/]?)')
+
+      return(Apache::DECLINED)
     end # def Session.init()
 
 
+    def Session.rewrite_output(r)
+      if !$session.session_id.nil? and r.uri_session != NONE
+	# Rewrite the HTML
+	#
+	# Need to make sure that we only rewrite URLs for the current
+	# VHOST (ie: relative and fully qualified)
+
+	return(Apache::OK)
+      else
+	return(Apache::DECLINED)
+      end
+    end # def Session.rewrite_output()
+
+
+    def html_sessionize_str(str, re)
+      str_orig = str.dup
+
+      while (md = re.match(str_orig)) do
+	tag = md.to_a[1] + md.to_a[3] + md.to_a[4]
+
+	if md.to_a[4].index('mailto') == 0
+	  tag = md.to_a[0]
+	elsif md.to_a[5]
+	  if md.to_a[5].index(Regexp.new('[\/\?\+]sess='))
+	    tag <<= md.to_a[5] + md.to_a[3] + md.to_a[6]
+	  else
+	    tag <<= md.to_a[5] + '+sess=' + @session_id + md.to_a[3] + md.to_a[6]
+	  end
+	else 
+	  tag <<= '?sess=' + @session_id + md.to_a[3] + md.to_a[6]
+	end
+
+	str.gsub!(Regexp.escape(md.to_a[0]), tag)
+	str_orig = md.post_match
+      end # while loop
+
+      return(tmpl)
+    end # def sessionize_str()
+
+
+    # Translate URI is responsible for nabbing the session out of the URI
+    # or out of the cookie.
     def Session.translate_uri(r)
-      md = @@uri_session_re.match(r.uri)
+      md = @@uri_session_re.match(r.unparsed_uri)
       if !md.nil?
-	$session.session_id = md[1]
-	r.uri = uri.sub(md[0], '/')
+	$session.uri_session = true
+	$session.session_id = md[2]
+	case md[1]
+	when '/'
+	  r.uri = r.uri.sub(Regexp.escape(md[0]), md[1])
+	when '?'
+	  if md[3].nil?
+	    r.args = r.args.sub(Regexp.escape(md[0]), '')
+	  else
+	    r.args = r.args.sub(Regexp.escape(md[0]), md[1])
+	  end
+	when  '&'
+	  if md[3].nil?
+	    r.args = r.args.sub(Regexp.escape(md[0]), '')
+	  else
+	    r.args = r.args.sub(Regexp.escape(md[0]), md[1])
+	  end
+	end # case md[1]
 
-	$session.generate() unless $session.load()
-	r.notes['session_id'] = $session.session_id
+	# $session.generate() unless $session.load()
       else
 	# No Session or invalid session found in the URI
-	#
-	# XXX Need to incorporate checking for cookies here
+	$session.uri_session = false
       end # if md.nil?
 
       # Let another handler map this request to a file