flash_cookie_session 1.1.3 → 1.1.4

Sign up to get free protection for your applications and to get access to all the features.
@@ -82,25 +82,29 @@ Let's break this down a little so you understand it better:
82
82
  "<%= key = Rails.application.config.session_options[:key] %>" : "<%= cookies[key] %>",
83
83
  "<%= request_forgery_protection_token %>" : "<%= form_authenticity_token %>",
84
84
  },
85
-
85
+
86
86
  The first key is your cookie session key which is passed along with every request when the user changes pages. If the server does not know about this session key then it cannot authenticate the user properly and therefore thinks you are not logged in. Since Flash has it's own set of cookies separate from the browser and effectively acts as it's own web browser when making requests to your app, we need to explicitly pass along the web browsersession key along with the Flash request so that the Rails server has all the info it needs to authenticate the user.
87
87
 
88
- The second key is the standard authentication token that is passed along to prevent cross-site request forgeries.
88
+ The second key is the standard authentication token that is passed along to prevent cross-site request forgeries.
89
+
90
+ If CSRF issues persist, try url_encoding the form_authenticity_token to make this work properly (<%= u form_authenticity_token %>). You might want to rename the request_forgery_protection_token to authenticity_token as well.
89
91
 
90
92
  === Optional Parameters
91
93
 
92
94
  - If you are using a "remember" cookie to keep a user logged in any time they come back to your website, you can pass this in through the params. If this does not get passed in, the server will not be able to authenticate the user properly and you will be scratching your head again wondering what went wrong:
93
-
95
+
94
96
  "remember_token" : "<%= cookies[:remember_token] %>"
95
-
97
+
96
98
  The key has to be named `remember_token` but your cookie may be named something other than `:remember_token` so change that accordingly based on your implementation.
97
-
99
+
98
100
  - If you are getting a "406 Not Acceptable" error on trying to upload, you might need to setup an extra set of params. Try adding '+_http_accept+': '+text+/+html+' (or any other appropriate media type that your respond_to block in your controller action needs - 'text/javascript' for format.js, etc) to post_params above.
99
101
 
100
102
  === Additional info
101
103
 
102
104
  This is frustrating and annoying stuff, and I'm sorry that we have to deal with it. If you have an idea about how to improve the situation or example for additional Flash uploaders, pull requests that expand on the README and/or Rails 3 gem are more than welcome.
103
105
 
106
+ In additional frustration, Chrome now sandboxes the Flash player and the HTTP_USER_AGENT does not correctly come across as Adobe/Shockwave Flash. This gem now includes an additional check on the HTTP_REFERER to see if it is a SWF file.
107
+
104
108
  === License
105
109
 
106
110
  Released under the MIT License: http://en.wikipedia.org/wiki/MIT_License
@@ -6,16 +6,23 @@ module FlashCookieSession
6
6
  end
7
7
 
8
8
  def call(env)
9
- if env['HTTP_USER_AGENT'] =~ /^(Adobe|Shockwave) Flash/
9
+ if env['HTTP_USER_AGENT'] =~ /^(Adobe|Shockwave) Flash/ or env['HTTP_REFERER'] =~ /.swf/
10
10
  req = Rack::Request.new(env)
11
11
  the_session_key = [ @session_key, req.params[@session_key] ].join('=').freeze if req.params[@session_key]
12
- the_remember_token = [ 'remember_token', req.params['remember_token'] ].join('=').freeze if req.params['remember_token']
13
- cookie_with_remember_token_and_session_key = [ the_remember_token, the_session_key ].compact.join(';').freeze
12
+
13
+ if req.params['remember_token'] && req.params['remember_token'] != 'null'
14
+ the_remember_token = [ 'remember_token', req.params['remember_token'] ].join('=').freeze
15
+ else
16
+ the_remember_token = nil
17
+ end
18
+
19
+ cookie_with_remember_token_and_session_key = [ the_remember_token, the_session_key ].compact.join('\;').freeze
20
+
14
21
  env['HTTP_COOKIE'] = cookie_with_remember_token_and_session_key
15
22
  env['HTTP_ACCEPT'] = "#{req.params['_http_accept']}".freeze if req.params['_http_accept']
16
23
  end
17
-
24
+
18
25
  @app.call(env)
19
26
  end
20
27
  end
21
- end
28
+ end
@@ -1,3 +1,3 @@
1
1
  module FlashCookieSession
2
- VERSION = "1.1.3"
2
+ VERSION = "1.1.4"
3
3
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: flash_cookie_session
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.1.3
4
+ version: 1.1.4
5
5
  prerelease:
6
6
  platform: ruby
7
7
  authors:
@@ -9,11 +9,11 @@ authors:
9
9
  autorequire:
10
10
  bindir: bin
11
11
  cert_chain: []
12
- date: 2012-02-27 00:00:00.000000000 Z
12
+ date: 2013-01-21 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: rails
16
- requirement: &70273139878220 !ruby/object:Gem::Requirement
16
+ requirement: !ruby/object:Gem::Requirement
17
17
  none: false
18
18
  requirements:
19
19
  - - ~>
@@ -21,7 +21,12 @@ dependencies:
21
21
  version: '3.0'
22
22
  type: :runtime
23
23
  prerelease: false
24
- version_requirements: *70273139878220
24
+ version_requirements: !ruby/object:Gem::Requirement
25
+ none: false
26
+ requirements:
27
+ - - ~>
28
+ - !ruby/object:Gem::Version
29
+ version: '3.0'
25
30
  description: Useful for Flash-based file uploaders (SWFUpload, Uploadify, Plupload,
26
31
  etc)
27
32
  email:
@@ -59,7 +64,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
59
64
  version: '0'
60
65
  requirements: []
61
66
  rubyforge_project: flash_cookie_session
62
- rubygems_version: 1.8.11
67
+ rubygems_version: 1.8.23
63
68
  signing_key:
64
69
  specification_version: 3
65
70
  summary: Rails 3 cookie sessions can cooperate with Flash