actionpack 2.3.18 → 3.0.0.beta

data/lib/{action_controller → action_dispatch/middleware}/session/cookie_store.rb

@@ -1,4 +1,7 @@
-module ActionController
+require 'active_support/core_ext/hash/keys'
+require 'rack/request'
+
+module ActionDispatch
   module Session
     # This cookie-based session store is the Rails default. Sessions typically
     # contain at most a user_id and flash message; both fit within the 4K cookie
@@ -36,8 +39,6 @@ module ActionController
     #
     # Note that changing digest or secret invalidates all existing sessions!
     class CookieStore
-      include AbstractStore::SessionUtils
-      
       # Cookies can typically store 4096 bytes.
       MAX = 4096
       SECRET_MIN_LENGTH = 30 # characters
@@ -50,8 +51,20 @@ module ActionController
         :httponly     => true
       }.freeze
 
+      class OptionsHash < Hash
+        def initialize(by, env, default_options)
+          @session_data = env[CookieStore::ENV_SESSION_KEY]
+          default_options.each { |key, value| self[key] = value }
+        end
+
+        def [](key)
+          key == :id ? @session_data[:session_id] : super(key)
+        end
+      end
+
       ENV_SESSION_KEY = "rack.session".freeze
       ENV_SESSION_OPTIONS_KEY = "rack.session.options".freeze
+      HTTP_SET_COOKIE = "Set-Cookie".freeze
 
       # Raised when storing more than 4K of session data.
       class CookieOverflow < StandardError; end
@@ -60,18 +73,12 @@ module ActionController
         # Process legacy CGI options
         options = options.symbolize_keys
         if options.has_key?(:session_path)
-          ActiveSupport::Deprecation.warn "Giving :session_path to SessionStore is deprecated, " <<
-            "please use :path instead", caller
           options[:path] = options.delete(:session_path)
         end
         if options.has_key?(:session_key)
-          ActiveSupport::Deprecation.warn "Giving :session_key to SessionStore is deprecated, " <<
-            "please use :key instead", caller
           options[:key] = options.delete(:session_key)
         end
         if options.has_key?(:session_http_only)
-          ActiveSupport::Deprecation.warn "Giving :session_http_only to SessionStore is deprecated, " <<
-            "please use :httponly instead", caller
           options[:httponly] = options.delete(:session_http_only)
         end
 
@@ -94,81 +101,74 @@ module ActionController
       end
 
       def call(env)
-        prepare!(env)
-        
+        env[ENV_SESSION_KEY] = AbstractStore::SessionHash.new(self, env)
+        env[ENV_SESSION_OPTIONS_KEY] = OptionsHash.new(self, env, @default_options)
+
         status, headers, body = @app.call(env)
 
         session_data = env[ENV_SESSION_KEY]
         options = env[ENV_SESSION_OPTIONS_KEY]
-        request = ActionController::Request.new(env)
-        
-        if !(options[:secure] && !request.ssl?) && (!session_data.is_a?(AbstractStore::SessionHash) || session_data.loaded? || options[:expire_after])
-          session_data.send(:load!) if session_data.is_a?(AbstractStore::SessionHash) && !session_data.loaded?
 
-          persistent_session_id!(session_data)
+        if !session_data.is_a?(AbstractStore::SessionHash) || session_data.send(:loaded?) || options[:expire_after]
+          session_data.send(:load!) if session_data.is_a?(AbstractStore::SessionHash) && !session_data.send(:loaded?)
           session_data = marshal(session_data.to_hash)
 
           raise CookieOverflow if session_data.size > MAX
+
           cookie = Hash.new
           cookie[:value] = session_data
           unless options[:expire_after].nil?
             cookie[:expires] = Time.now + options[:expire_after]
           end
 
-          Rack::Utils.set_cookie_header!(headers, @key, cookie.merge(options))
+          cookie = build_cookie(@key, cookie.merge(options))
+          unless headers[HTTP_SET_COOKIE].blank?
+            headers[HTTP_SET_COOKIE] << "\n#{cookie}"
+          else
+            headers[HTTP_SET_COOKIE] = cookie
+          end
         end
 
         [status, headers, body]
       end
 
       private
-      
-        def prepare!(env)
-          env[ENV_SESSION_KEY] = AbstractStore::SessionHash.new(self, env)
-          env[ENV_SESSION_OPTIONS_KEY] = AbstractStore::OptionsHash.new(self, env, @default_options)
-        end
-
-        def load_session(env)
-          data = unpacked_cookie_data(env)
-          data = persistent_session_id!(data)
-          [data[:session_id], data]
-        end
-        
-        def extract_session_id(env)
-          if data = unpacked_cookie_data(env)
-            persistent_session_id!(data) unless data.empty?
-            data[:session_id]
-          else
-            nil
+        # Should be in Rack::Utils soon
+        def build_cookie(key, value)
+          case value
+          when Hash
+            domain  = "; domain="  + value[:domain] if value[:domain]
+            path    = "; path="    + value[:path]   if value[:path]
+            # According to RFC 2109, we need dashes here.
+            # N.B.: cgi.rb uses spaces...
+            expires = "; expires=" + value[:expires].clone.gmtime.
+              strftime("%a, %d-%b-%Y %H:%M:%S GMT") if value[:expires]
+            secure = "; secure" if value[:secure]
+            httponly = "; HttpOnly" if value[:httponly]
+            value = value[:value]
           end
+          value = [value] unless Array === value
+          cookie = Rack::Utils.escape(key) + "=" +
+            value.map { |v| Rack::Utils.escape(v) }.join("&") +
+            "#{domain}#{path}#{expires}#{secure}#{httponly}"
         end
 
-        def current_session_id(env)
-          env[ENV_SESSION_OPTIONS_KEY][:id]
-        end
-
-        def exists?(env)
-          current_session_id(env).present?
-        end
-
-        def unpacked_cookie_data(env)
-          env["action_dispatch.request.unsigned_session_cookie"] ||= begin
-            stale_session_check! do
-              request = Rack::Request.new(env)
-              session_data = request.cookies[@key]
-              unmarshal(session_data) || {}
-            end
-          end
+        def load_session(env)
+          request = Rack::Request.new(env)
+          session_data = request.cookies[@key]
+          data = unmarshal(session_data) || persistent_session_id!({})
+          data.stringify_keys!
+          [data["session_id"], data]
         end
 
         # Marshal a session hash into safe cookie data. Include an integrity hash.
         def marshal(session)
-          @verifier.generate(session)
+          @verifier.generate(persistent_session_id!(session))
         end
 
         # Unmarshal cookie data to a hash and verify its integrity.
         def unmarshal(cookie)
-          @verifier.verify(cookie) if cookie
+          persistent_session_id!(@verifier.verify(cookie)) if cookie
         rescue ActiveSupport::MessageVerifier::InvalidSignature
           nil
         end
@@ -179,7 +179,7 @@ module ActionController
               'cookie containing the session data. Use ' +
               'config.action_controller.session = { :key => ' +
               '"_myapp_session", :secret => "some secret phrase" } in ' +
-              'config/environment.rb'
+              'config/application.rb'
           end
         end
 
@@ -216,21 +216,17 @@ module ActionController
           ActiveSupport::SecureRandom.hex(16)
         end
 
-        def destroy(env)
-          # session data is stored on client; nothing to do here
-        end
-
         def persistent_session_id!(data)
           (data ||= {}).merge!(inject_persistent_session_id(data))
         end
 
         def inject_persistent_session_id(data)
-          requires_session_id?(data) ? { :session_id => generate_sid } : {}
+          requires_session_id?(data) ? { "session_id" => generate_sid } : {}
         end
 
         def requires_session_id?(data)
           if data
-            data.respond_to?(:key?) && !data.key?(:session_id)
+            data.respond_to?(:key?) && !data.key?("session_id")
           else
             true
           end

data/lib/action_dispatch/middleware/session/mem_cache_store.rb

@@ -0,0 +1,47 @@
+module ActionDispatch
+  module Session
+    class MemCacheStore < AbstractStore
+      def initialize(app, options = {})
+        require 'memcache'
+
+        # Support old :expires option
+        options[:expire_after] ||= options[:expires]
+
+        super
+
+        @default_options = {
+          :namespace => 'rack:session',
+          :memcache_server => 'localhost:11211'
+        }.merge(@default_options)
+
+        @pool = options[:cache] || MemCache.new(@default_options[:memcache_server], @default_options)
+        unless @pool.servers.any? { |s| s.alive? }
+          raise "#{self} unable to find server during initialization."
+        end
+        @mutex = Mutex.new
+
+        super
+      end
+
+      private
+        def get_session(env, sid)
+          sid ||= generate_sid
+          begin
+            session = @pool.get(sid) || {}
+          rescue MemCache::MemCacheError, Errno::ECONNREFUSED
+            session = {}
+          end
+          [sid, session]
+        end
+
+        def set_session(env, sid, session_data)
+          options = env['rack.session.options']
+          expiry  = options[:expire_after] || 0
+          @pool.set(sid, session_data, expiry)
+          return true
+        rescue MemCache::MemCacheError, Errno::ECONNREFUSED
+          return false
+        end
+    end
+  end
+end

data/lib/action_dispatch/middleware/show_exceptions.rb

@@ -0,0 +1,173 @@
+require 'active_support/core_ext/exception'
+require 'active_support/notifications'
+require 'action_dispatch/http/request'
+
+module ActionDispatch
+  # This middleware rescues any exception returned by the application and renders
+  # nice exception pages if it's being rescued locally.
+  #
+  # Every time an exception is caught, a notification is published, becoming a good API
+  # to deal with exceptions. So, if you want send an e-mail through ActionMailer
+  # everytime this notification is published, you just need to do the following:
+  #
+  #   ActiveSupport::Notifications.subscribe "action_dispatch.show_exception" do |name, start, end, instrumentation_id, payload|
+  #     ExceptionNotifier.deliver_exception(start, payload)
+  #   end
+  #
+  # The payload is a hash which has two pairs:
+  #
+  # * :env - Contains the rack env for the given request;
+  # * :exception - The exception raised;
+  #
+  class ShowExceptions
+    LOCALHOST = ['127.0.0.1', '::1'].freeze
+
+    RESCUES_TEMPLATE_PATH = File.join(File.dirname(__FILE__), 'templates')
+
+    cattr_accessor :rescue_responses
+    @@rescue_responses = Hash.new(:internal_server_error)
+    @@rescue_responses.update({
+      'ActionController::RoutingError'             => :not_found,
+      'AbstractController::ActionNotFound'         => :not_found,
+      'ActiveRecord::RecordNotFound'               => :not_found,
+      'ActiveRecord::StaleObjectError'             => :conflict,
+      'ActiveRecord::RecordInvalid'                => :unprocessable_entity,
+      'ActiveRecord::RecordNotSaved'               => :unprocessable_entity,
+      'ActionController::MethodNotAllowed'         => :method_not_allowed,
+      'ActionController::NotImplemented'           => :not_implemented,
+      'ActionController::InvalidAuthenticityToken' => :unprocessable_entity
+    })
+
+    cattr_accessor :rescue_templates
+    @@rescue_templates = Hash.new('diagnostics')
+    @@rescue_templates.update({
+      'ActionView::MissingTemplate'         => 'missing_template',
+      'ActionController::RoutingError'      => 'routing_error',
+      'AbstractController::ActionNotFound'  => 'unknown_action',
+      'ActionView::Template::Error'         => 'template_error'
+    })
+
+    FAILSAFE_RESPONSE = [500, {'Content-Type' => 'text/html'},
+      ["<html><body><h1>500 Internal Server Error</h1>" <<
+       "If you are the administrator of this website, then please read this web " <<
+       "application's log file and/or the web server's log file to find out what " <<
+       "went wrong.</body></html>"]]
+
+    def initialize(app, consider_all_requests_local = false)
+      @app = app
+      @consider_all_requests_local = consider_all_requests_local
+    end
+
+    def call(env)
+      @app.call(env)
+    rescue Exception => exception
+      raise exception if env['action_dispatch.show_exceptions'] == false
+      render_exception(env, exception)
+    end
+
+    private
+      def render_exception(env, exception)
+        log_error(exception)
+
+        request = Request.new(env)
+        if @consider_all_requests_local || local_request?(request)
+          rescue_action_locally(request, exception)
+        else
+          rescue_action_in_public(exception)
+        end
+      rescue Exception => failsafe_error
+        $stderr.puts "Error during failsafe response: #{failsafe_error}"
+        FAILSAFE_RESPONSE
+      end
+
+      # Render detailed diagnostics for unhandled exceptions rescued from
+      # a controller action.
+      def rescue_action_locally(request, exception)
+        template = ActionView::Base.new([RESCUES_TEMPLATE_PATH],
+          :request => request,
+          :exception => exception,
+          :application_trace => application_trace(exception),
+          :framework_trace => framework_trace(exception),
+          :full_trace => full_trace(exception)
+        )
+        file = "rescues/#{@@rescue_templates[exception.class.name]}.erb"
+        body = template.render(:file => file, :layout => 'rescues/layout.erb')
+        render(status_code(exception), body)
+      end
+
+      # Attempts to render a static error page based on the
+      # <tt>status_code</tt> thrown, or just return headers if no such file
+      # exists. At first, it will try to render a localized static page.
+      # For example, if a 500 error is being handled Rails and locale is :da,
+      # it will first attempt to render the file at <tt>public/500.da.html</tt>
+      # then attempt to render <tt>public/500.html</tt>. If none of them exist,
+      # the body of the response will be left empty.
+      def rescue_action_in_public(exception)
+        status = status_code(exception)
+        locale_path = "#{public_path}/#{status}.#{I18n.locale}.html" if I18n.locale
+        path = "#{public_path}/#{status}.html"
+
+        if locale_path && File.exist?(locale_path)
+          render(status, File.read(locale_path))
+        elsif File.exist?(path)
+          render(status, File.read(path))
+        else
+          render(status, '')
+        end
+      end
+
+      # True if the request came from localhost, 127.0.0.1.
+      def local_request?(request)
+        LOCALHOST.any?{ |local_ip| request.remote_addr == local_ip && request.remote_ip == local_ip }
+      end
+
+      def status_code(exception)
+        Rack::Utils.status_code(@@rescue_responses[exception.class.name])
+      end
+
+      def render(status, body)
+        [status, {'Content-Type' => 'text/html', 'Content-Length' => body.length.to_s}, [body]]
+      end
+
+      def public_path
+        defined?(Rails.public_path) ? Rails.public_path : 'public_path'
+      end
+
+      def log_error(exception)
+        return unless logger
+
+        ActiveSupport::Deprecation.silence do
+          if ActionView::Template::Error === exception
+            logger.fatal(exception.to_s)
+          else
+            logger.fatal(
+              "\n#{exception.class} (#{exception.message}):\n  " +
+              clean_backtrace(exception).join("\n  ") + "\n\n"
+            )
+          end
+        end
+      end
+
+      def application_trace(exception)
+        clean_backtrace(exception, :silent)
+      end
+
+      def framework_trace(exception)
+        clean_backtrace(exception, :noise)
+      end
+
+      def full_trace(exception)
+        clean_backtrace(exception, :all)
+      end
+
+      def clean_backtrace(exception, *args)
+        defined?(Rails) && Rails.respond_to?(:backtrace_cleaner) ?
+          Rails.backtrace_cleaner.clean(exception.backtrace, *args) :
+          exception.backtrace
+      end
+
+      def logger
+        defined?(Rails.logger) ? Rails.logger : Logger.new($stderr)
+      end
+  end
+end

data/lib/{action_controller/middleware_stack.rb → action_dispatch/middleware/stack.rb}

@@ -1,4 +1,6 @@
-module ActionController
+require "active_support/inflector/methods"
+
+module ActionDispatch
   class MiddlewareStack < Array
     class Middleware
       def self.new(klass, *args, &block)
@@ -27,15 +29,13 @@ module ActionController
       end
 
       def klass
-        if @klass.respond_to?(:call)
-          @klass.call
-        elsif @klass.is_a?(Class)
+        if @klass.respond_to?(:new)
           @klass
+        elsif @klass.respond_to?(:call)
+          @klass.call
         else
-          @klass.to_s.constantize
+          ActiveSupport::Inflector.constantize(@klass.to_s)
         end
-      rescue NameError
-        @klass
       end
 
       def active?
@@ -55,14 +55,16 @@ module ActionController
         when Class
           klass == middleware
         else
-          klass == middleware.to_s.constantize
+          if lazy_compare?(@klass) && lazy_compare?(middleware)
+            normalize(@klass) == normalize(middleware)
+          else
+            klass == ActiveSupport::Inflector.constantize(middleware.to_s)
+          end
         end
       end
 
       def inspect
-        str = klass.to_s
-        args.each { |arg| str += ", #{arg.inspect}" }
-        str
+        klass.to_s
       end
 
       def build(app)
@@ -74,6 +76,13 @@ module ActionController
       end
 
       private
+        def lazy_compare?(object)
+          object.is_a?(String) || object.is_a?(Symbol)
+        end
+
+        def normalize(object)
+          object.to_s.strip.sub(/^::/, '')
+        end
 
         def build_args
           Array(args).map { |arg| arg.respond_to?(:call) ? arg.call : arg }
@@ -94,8 +103,9 @@ module ActionController
     alias_method :insert_before, :insert
 
     def insert_after(index, *args, &block)
-      index = self.index(index) unless index.is_a?(Integer)
-      insert(index + 1, *args, &block)
+      i = index.is_a?(Integer) ? index : self.index(index)
+      raise "No such middleware to insert after: #{index.inspect}" unless i
+      insert(i + 1, *args, &block)
     end
 
     def swap(target, *args, &block)