flash_cookie_session 1.1.3 → 1.1.4

data/Readme.rdoc

@@ -82,25 +82,29 @@ Let's break this down a little so you understand it better:
       "<%= key = Rails.application.config.session_options[:key] %>" : "<%= cookies[key] %>",
       "<%= request_forgery_protection_token %>" : "<%= form_authenticity_token %>",
     },
-    
+
 The first key is your cookie session key which is passed along with every request when the user changes pages. If the server does not know about this session key then it cannot authenticate the user properly and therefore thinks you are not logged in. Since Flash has it's own set of cookies separate from the browser and effectively acts as it's own web browser when making requests to your app, we need to explicitly pass along the web browsersession key along with the Flash request so that the Rails server has all the info it needs to authenticate the user.
 
-The second key is the standard authentication token that is passed along to prevent cross-site request forgeries.  
+The second key is the standard authentication token that is passed along to prevent cross-site request forgeries.
+
+If CSRF issues persist, try url_encoding the form_authenticity_token to make this work properly (<%= u form_authenticity_token %>). You might want to rename the request_forgery_protection_token to authenticity_token as well.
 
 === Optional Parameters
 
 - If you are using a "remember" cookie to keep a user logged in any time they come back to your website, you can pass this in through the params.  If this does not get passed in, the server will not be able to authenticate the user properly and you will be scratching your head again wondering what went wrong:
-    
+
     "remember_token" : "<%= cookies[:remember_token] %>"
-    
+
 The key has to be named `remember_token` but your cookie may be named something other than `:remember_token` so change that accordingly based on your implementation.
-    
+
 - If you are getting a "406 Not Acceptable" error on trying to upload, you might need to setup an extra set of params. Try adding '+_http_accept+': '+text+/+html+' (or any other appropriate media type that your respond_to block in your controller action needs - 'text/javascript' for format.js, etc) to post_params above.
 
 === Additional info
 
 This is frustrating and annoying stuff, and I'm sorry that we have to deal with it. If you have an idea about how to improve the situation or example for additional Flash uploaders, pull requests that expand on the README and/or Rails 3 gem are more than welcome.
 
+In additional frustration, Chrome now sandboxes the Flash player and the HTTP_USER_AGENT does not correctly come across as Adobe/Shockwave Flash. This gem now includes an additional check on the HTTP_REFERER to see if it is a SWF file.
+
 === License
 
 Released under the MIT License: http://en.wikipedia.org/wiki/MIT_License

data/lib/flash_cookie_session/middleware.rb

@@ -6,16 +6,23 @@ module FlashCookieSession
     end
 
     def call(env)
-      if env['HTTP_USER_AGENT'] =~ /^(Adobe|Shockwave) Flash/
+      if env['HTTP_USER_AGENT'] =~ /^(Adobe|Shockwave) Flash/ or env['HTTP_REFERER'] =~ /.swf/
         req = Rack::Request.new(env)
         the_session_key = [ @session_key, req.params[@session_key] ].join('=').freeze if req.params[@session_key]
-        the_remember_token = [ 'remember_token', req.params['remember_token'] ].join('=').freeze if req.params['remember_token']
-        cookie_with_remember_token_and_session_key = [ the_remember_token, the_session_key ].compact.join(';').freeze
+
+        if req.params['remember_token'] && req.params['remember_token'] != 'null'
+          the_remember_token = [ 'remember_token', req.params['remember_token'] ].join('=').freeze
+        else
+          the_remember_token = nil
+        end
+
+        cookie_with_remember_token_and_session_key = [ the_remember_token, the_session_key ].compact.join('\;').freeze
+
         env['HTTP_COOKIE'] = cookie_with_remember_token_and_session_key
         env['HTTP_ACCEPT'] = "#{req.params['_http_accept']}".freeze if req.params['_http_accept']
       end
-      
+
       @app.call(env)
     end
   end
-end
+end

data/lib/flash_cookie_session/version.rb

@@ -1,3 +1,3 @@
 module FlashCookieSession
-  VERSION = "1.1.3"
+  VERSION = "1.1.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: flash_cookie_session
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: 1.1.4
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-02-27 00:00:00.000000000 Z
+date: 2013-01-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
-  requirement: &70273139878220 !ruby/object:Gem::Requirement
+  requirement: !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,7 +21,12 @@ dependencies:
         version: '3.0'
   type: :runtime
   prerelease: false
-  version_requirements: *70273139878220
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '3.0'
 description: Useful for Flash-based file uploaders (SWFUpload, Uploadify, Plupload,
   etc)
 email:
@@ -59,7 +64,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: flash_cookie_session
-rubygems_version: 1.8.11
+rubygems_version: 1.8.23
 signing_key: 
 specification_version: 3
 summary: Rails 3 cookie sessions can cooperate with Flash