[WebMacro-user] Session integrity issue?

[Keats K. <ke...@xa...>]

It's not possible to tell from the code snippet what is going wrong.  
The concurrency issue that Lane is referring to is fairly obscure (only 
affecting the #include directive with dynamic template names if I recall 
correctly) and not relevant here.

The code as shown looks OK, but we can't see how the USERID is stored in 
the session, or how the user data is stored and retrieved based on this 
USERID.  The bug could be in the data access layer or the session 
management subsystem (which depends on your Servlet container), or in 
some caching mechanism.  It is unlikely, but not impossible that this 
could be a WebMacro bug.  If I had to guess, I would suspect that the 
code which actually retrieves the user data is not properly synchronized.

Send us a bit more information about your application, and maybe we can 
help you track this down.

Keats

Lane Sharman wrote:

> Hi Nikolaos.
>
> This is most disturbing to hear about.
>
> First, there is a known concurrency issue with WM in 2.0 and possibly 
> in prior releases. If you look at the mail thread dating back for 45 
> days, you will definitely see it.
>
> My concern is that the webmacro instance, shared, and the context, not 
> shared, is improperly orchestrated for concurrency. The webmacro 
> instance is local to WMServlet. You might consider synchronizing 
> access to this variable as a trial fix in your local calls below. This 
> will introduce some serialization of web processing but it might help 
> to verify the solution.
>
> One thing you might consider trying is to use a different cache 
> handler. A few years ago, I wrote one and it is a part of the distro. 
> I have never had a problem using this cache handler.
>
> Lane
>
> --- Nikolaos Papadakis <nk...@cc...> wrote:
>
> From: Nikolaos Papadakis <nk...@cc...>
> Date: Sat, 18 Feb 2006 10:50:33 +0200
> To: web...@li...
> Subject: [WebMacro-user] [WebMacro-user
>
> Hi all,
>
> I am using webmacro to develop a web-based application.
> Things seemed to work fine till yesterday. A customer complained that he
> managed to “see” the account of another customer when he logged-in using
> his own credentials (he send me a screen shot of the “view”).
> By inspecting the log file I found that both users have been logged-in
> at the same time (the second customer logged in 3 sec after the first
> customer).
> The system has more than 1000 customers but this inconvenience happened
> for the first time yesterday (?).
> It seems that different sessions have been mixed up.
> The servlet includes a handle method and uses several other methods
> (methods that write and read from a database).
> All methods are defined in the same class (that extends WMServlet).
> As far as I know servlets must not have instance variables (only local
> variables -inside methods- to prevent data corruption and
> inconsistencies). However in my servlet I use only one non local
> variable (a Logger) and I don't think this is the cause of the problem.
> As an attached file I send you a fragment of the before mentioned 
> servlet.
> Can instance variables be defined in the case of a servlet that extends
> WMServlet? (I mean is it safe? or its not a good practice without
> keeping precautions?)
> Do you have any idea what can have caused this inconvenience ?
> Is the use of methods inside the servlet thread-safe ?
>
> Please help!!!
> Nikolaos Papadakis
> ------------------------------------------------------- This SF.net 
> email is sponsored by: Splunk Inc. Do you grep through log files for 
> problems? Stop! Download the new AJAX search engine that makes 
> searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! 
> http://sel.as-us.falkag.net/sel?cmd=k&kid3432&bid#0486&dat1642 
> _______________________________________________ Webmacro-user mailing 
> list Web...@li... 
> https://lists.sourceforge.net/lists/listinfo/webmacro-user