[ http://issues.apache.org/jira/browse/MODPYTHON-59?page=comments#action_12316578 ]
Graham Dumpleton commented on MODPYTHON-59: ------------------------------------------- There is a potential issue with the way that PYSID is stored in the subprocess_env table and then used to reconstruct the session object after an internal redirect. I can see two problems here. The first is that if the target of the internal redirect is a part of the URL namespace which is under the control of a different handler, or where ApplicationPath option was set explicitly to be different, the PYSID would potentially override a valid pysid for the alternate SID context provided by the browser. The second problem is that an internal redirect could redirect to a different part of the URL namespace where the PythonOption for "session" is set differently. This could for example result in an instance of Session being created initially but an attempt to create a FileSession object after the redirect. In the second case, if the redirect was to a part of the URL namespace notionally under the same ApplicationPath (implicit or explicit), it is probably a mistake on the part of the programmer to have specified different session types within the same SID context. It still could occur in conjunction with the first case though. Is my analysis here correct? Along with PYSID it may be necessary to save away the equivalent of the ApplicationPath (implicit or explicit) and for the PYSID to be ignored if the target of the internal redirect is within a different SID context. It would get harder to protect if there were multiple nested applications of internal redirect. Ie., where you end up with REDIRECT_PYSID, REDIRECT_REDIRECT_PYSID etc. > Add get_session() method to request object > ------------------------------------------ > > Key: MODPYTHON-59 > URL: http://issues.apache.org/jira/browse/MODPYTHON-59 > Project: mod_python > Type: New Feature > Components: core > Versions: 3.2.0 > Environment: All > Reporter: Jim Gallacher > > Users will get session instances by calling req.get_session(). If a session > already exists it will be returned, otherwise a new session instance will be > created. Session configuration will be handled using apache directives rather > than within their code. > Using this scheme means only one session instance will be created per > request, which will eliminate the deadlock problems many people experience. > Also, using this scheme makes it possible for sessions to be properly handled > within psp pages and across req.internal_redirect() calls. > Code will be commited to svn shortly. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira
