Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow subclasses of session store to override session_class #204

Merged
merged 1 commit into from
Aug 15, 2023
Merged

Allow subclasses of session store to override session_class #204

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions lib/action_dispatch/session/active_record_store.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ module Session
class ActiveRecordStore < ActionDispatch::Session::AbstractSecureStore
# The class used for session storage. Defaults to
# ActiveRecord::SessionStore::Session
cattr_accessor :session_class
class_attribute :session_class

SESSION_RECORD_KEY = 'rack.session.record'
ENV_SESSION_OPTIONS_KEY = Rack::RACK_SESSION_OPTIONS
Expand All @@ -67,7 +67,7 @@ def get_session(request, sid)
# If the sid was nil or if there is no pre-existing session under the sid,
# force the generation of a new sid and associate a new session associated with the new sid
sid = generate_sid
session = @@session_class.new(:session_id => sid.private_id, :data => {})
session = session_class.new(:session_id => sid.private_id, :data => {})
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

session_class is a cattr_accessor, meaning subclasses will fight over that variable. You want class_attribute.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cattr_accessor actually generates https://apidock.com/rails/Class/cattr_accessor but agreed, I will change it to self.class.session_class

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated it

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cattr_accessor actually generates

That's not the problem, the problem is that it is backed by a class variable (@@) https://github.com/rails/rails/blob/522c86f35ccc80453ed9fb6ca8b394db321f9a69/activesupport/lib/active_support/core_ext/module/attribute_accessors.rb#L124

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated it

I didn't mean to chance for self.class.... calls, but to declare the variable with class_attribute.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, never ran across class_attribute before

end
request.env[SESSION_RECORD_KEY] = session
[sid, session.data]
Expand Down Expand Up @@ -106,7 +106,7 @@ def delete_session(request, session_id, options)
new_sid = generate_sid

if options[:renew]
new_model = @@session_class.new(:session_id => new_sid.private_id, :data => data)
new_model = session_class.new(:session_id => new_sid.private_id, :data => data)
new_model.save
request.env[SESSION_RECORD_KEY] = new_model
end
Expand All @@ -120,7 +120,7 @@ def get_session_model(request, id)
model = get_session_with_fallback(id)
unless model
id = generate_sid
model = @@session_class.new(:session_id => id.private_id, :data => {})
model = session_class.new(:session_id => id.private_id, :data => {})
model.save
end
if request.env[ENV_SESSION_OPTIONS_KEY][:id].nil?
Expand All @@ -134,9 +134,9 @@ def get_session_model(request, id)

def get_session_with_fallback(sid)
if sid && !self.class.private_session_id?(sid.public_id)
if (secure_session = @@session_class.find_by_session_id(sid.private_id))
if (secure_session = session_class.find_by_session_id(sid.private_id))
secure_session
elsif (insecure_session = @@session_class.find_by_session_id(sid.public_id))
elsif (insecure_session = session_class.find_by_session_id(sid.public_id))
insecure_session.session_id = sid.private_id # this causes the session to be secured
insecure_session
end
Expand Down
Loading