merb 0.3.7 → 0.4.0

data/lib/merb/session.rb

@@ -2,16 +2,16 @@ module Merb
   module SessionMixin
     
     def rand_uuid
-      sid = "%04x%04x%04x%04x%04x%06x%06x" % [
-                                            rand(0x0010000),
-                                            rand(0x0010000),
-                                            rand(0x0010000),
-                                            rand(0x0010000),
-                                            rand(0x0010000),
-                                            rand(0x1000000),
-                                            rand(0x1000000),
-                                           ]
-      sid                                     
+      values = [
+        rand(0x0010000),
+        rand(0x0010000),
+        rand(0x0010000),
+        rand(0x0010000),
+        rand(0x0010000),
+        rand(0x1000000),
+        rand(0x1000000),
+      ]
+      "%04x%04x%04x%04x%04x%06x%06x" % values
     end
     
     def needs_new_cookie!

data/lib/merb/session/cookie_store.rb

@@ -0,0 +1,125 @@
+require 'base64'        # to convert Marshal.dump to ASCII
+require 'openssl'       # to generate the HMAC message digest
+
+# Most of this code is taken from bitsweat's implementation in rails
+
+module Merb
+  
+  module SessionMixin
+    def setup_session
+      MERB_LOGGER.info("Setting Cookie Store Sessions")
+      unless secret = Merb::Server.config[:session_secret_key]
+        raise 'You must set :session_secret_key in config/merb.yml for cookie sessions'
+      end
+      request.session = Merb::CookieStore.new(cookies[_session_id_key], secret)
+    end
+    
+    def finalize_session      
+      MERB_LOGGER.info("Finalize Cookie Store Session")
+      if request.session.modified?
+        set_cookie(_session_id_key, request.session.read_cookie, _session_expiry) 
+      end
+    end
+    
+    def session_store_type
+      "cookie"
+    end
+  end
+  
+  # If you have more than 4K of session data or don't want your data to be
+  # visible to the user, pick another session store.
+  #
+  # CookieOverflow is raised if you attempt to store more than 4K of data.
+  # TamperedWithCookie is raised if the data integrity check fails.
+  #
+  # A message digest is included with the cookie to ensure data integrity:
+  # a user cannot alter his user_id without knowing the secret key included in
+  # the hash. 
+  # 
+  # To use Cookie Sessions, set in config/merb.yml
+  #  :session_secret_key - your secret digest key
+  #  :cookie_store_session - to true
+  class CookieStore
+    # TODO (maybe):
+    # include request ip address
+    # AES encrypt marshaled data
+    
+    # Raised when storing more than 4K of session data.
+    class CookieOverflow < StandardError; end
+    
+    # Raised when the cookie fails its integrity check.
+    class TamperedWithCookie < StandardError; end
+    
+    # Cookies can typically store 4096 bytes.
+    MAX = 4096
+    DIGEST = OpenSSL::Digest::Digest.new('SHA1') # or MD5, RIPEMD160, SHA256?
+    
+    attr_reader :data
+    
+    def initialize(cookie, secret)
+      if secret.nil? or secret.blank?
+        raise ArgumentError, 'A secret is required to generate an integrity hash for cookie session data.'
+      end
+      @secret = secret
+      @data = unmarshal(cookie) || Hash.new
+      @modified = false
+    end
+    
+    # return a cookie value. raises CookieOverflow if session contains too
+    # much information
+    def read_cookie
+      unless @data.nil? or @data.empty? 
+        updated = marshal(@data)
+        raise CookieOverflow if updated.size > MAX
+        updated
+      end
+    end
+    
+    # returns true if the session has been modified since initialization
+    def modified?; @modified; end
+    
+    # assigns a key value pair
+    def []=(k, v)
+      unless @data[k]==v
+        @modified = true
+        @data[k] = v
+      end
+    end
+    
+    def [](k)
+      @data[k]
+    end
+    
+    # delete a key
+    def delete(key)
+      if @data.has_key(key)
+        @modified = true
+        @data.delete(key)
+      end
+    end
+    
+    private
+    
+    # Generate the HMAC keyed message digest. Uses SHA1.
+    def generate_digest(data)
+      OpenSSL::HMAC.hexdigest(DIGEST, @secret, data)
+    end
+    
+    # Marshal a session hash into safe cookie data. Include an integrity hash.
+    def marshal(session)
+      data = Base64.encode64(Marshal.dump(session)).chop
+      Mongrel::HttpRequest.escape "#{data}--#{generate_digest(data)}"
+    end
+    
+    # Unmarshal cookie data to a hash and verify its integrity.
+    def unmarshal(cookie)
+      if cookie
+        data, digest = Mongrel::HttpRequest.unescape(cookie).split('--')
+        unless digest == generate_digest(data)
+          raise TamperedWithCookie, "Maybe the site's session_secret_key has changed?"
+        end
+        Marshal.load(Base64.decode64(data))
+      end
+    end
+  end
+end

data/lib/merb/session/{merb_mem_cache_session.rb → mem_cache_session.rb}

@@ -6,18 +6,23 @@ module Merb
 
     def setup_session
       MERB_LOGGER.info("Setting up session")
-      before = @_cookies[_session_id_key]
-      @_session, @_cookies[_session_id_key] = Merb::MemCacheSession.persist(@_cookies[_session_id_key])
-      @_fingerprint = Marshal.dump(@_session.data).hash
+      before = cookies[_session_id_key]
+      request.session, cookies[_session_id_key] = Merb::MemCacheSession.persist(cookies[_session_id_key])
+      @_fingerprint = Marshal.dump(request.session.data).hash
       @_new_cookie = cookies[_session_id_key] != before
     end
 
     def finalize_session
       MERB_LOGGER.info("Finalize session")
-      ::Cache.put("session:#{@_session.session_id}", @_session) if @_fingerprint != Marshal.dump(@_session.data).hash
-      set_cookie(_session_id_key, @_session.session_id, _session_expiry) if (@_new_cookie || @_session.needs_new_cookie)
+      if @_fingerprint != Marshal.dump(request.session.data).hash
+        ::Cache.put("session:#{@_session.session_id}", request.session.data)
+      end
+      set_cookie(_session_id_key, request.session.session_id, _session_expiry) if (@_new_cookie || request.session.needs_new_cookie)
     end
 
+    def session_store_type
+      "memcache"
+    end
   end
 
   ##
@@ -25,12 +30,12 @@ module Merb
   #
   # Requires setup in your +merb_init.rb+:
   #
-  #   require 'memcache_util'
+  #   require 'memcache'
   #   CACHE = MemCache.new('127.0.0.1:11211', { :namespace => 'my_app' })
   #
   # And a setting in +merb.yml+:
   #
-  #   :mem_cache_session: true
+  #   :session_store: mem_cache
 
   class MemCacheSession
 
@@ -53,7 +58,7 @@ module Merb
       # Gets the existing session based on the <tt>session_id</tt> available in cookies.
       # If none is found, generates a new session.
       def persist(session_id)
-        if session_id
+        unless session_id.blank?
           session = ::Cache.get("session:#{session_id}")
           if session.nil?
             # Not in memcached, but assume that cookie exists
@@ -63,7 +68,15 @@ module Merb
           # No cookie...make a new session_id
           session = generate
         end
-        [session, session.session_id]
+        if session.is_a?( MemCacheSession )
+          [session, session.session_id]
+        else
+          # recreate using the rails session as the data
+          session_object = MemCacheSession.new(session_id)
+          session_object.data = session
+          [session_object, session_object.session_id]
+        end
+
       end
 
       # Don't try to reload in dev mode.

data/lib/merb/session/{merb_memory_session.rb → memory_session.rb}

@@ -4,16 +4,19 @@ module Merb
 
     def setup_session
       MERB_LOGGER.info("Setting up session")
-      before = @_cookies[_session_id_key]
-      @_session , @_cookies[_session_id_key] = Merb::MemorySession.persist(@_cookies[_session_id_key])
-      @_new_cookie = @_cookies[_session_id_key] != before
+      before = cookies[_session_id_key]
+      request.session , cookies[_session_id_key] = Merb::MemorySession.persist(cookies[_session_id_key])
+      @_new_cookie = cookies[_session_id_key] != before
     end
 
     def finalize_session
       MERB_LOGGER.info("Finalize session")
-      set_cookie(_session_id_key, @_session.session_id, _session_expiry) if (@_new_cookie || @_session.needs_new_cookie)
-    end 
-
+      set_cookie(_session_id_key, request.session.session_id, _session_expiry) if (@_new_cookie || request.session.needs_new_cookie)
+    end
+     
+    def session_store_type
+      "memory"
+    end
   end
   
   class MemorySession
@@ -38,7 +41,7 @@ module Merb
       # If none is found, generates a new session.
       def persist(session_id)
         if session_id
-          session = session = MemorySessionContainer[session_id]
+          session = MemorySessionContainer[session_id]
         end
         unless session
           session = generate
@@ -87,12 +90,11 @@ module Merb
   class MemorySessionContainer
     class << self
       
-      def setup(opts={})
-        @opts = opts
+      def setup(ttl=nil)
         @sessions = Hash.new
         @timestamps = Hash.new
         @mutex = Mutex.new
-        @session_ttl = opts.fetch(:session_ttl, 60*60) # default 1 hour
+        @session_ttl = ttl || 60*60 # default 1 hour
         start_timer
         self
       end
@@ -148,4 +150,6 @@ module Merb
     end # end singleton class
 
   end # end MemorySessionContainer
-end
+end
+
+Merb::MemorySessionContainer.setup(Merb::Server.config[:memory_session_ttl])

data/lib/merb/template.rb

@@ -1,10 +1,37 @@
 module Merb
   module Template
-    # TODO : pull up common methods from template engines.
-  end  
-end  
-
-template = __DIR__+'/merb/template'
-
-%w[ erubis markaby xml_builder haml
-  ].each {|fn| require File.join(template, fn)}
+    autoload :Erubis,  'merb/template/erubis'
+    autoload :Haml,  'merb/template/haml'    
+    autoload :Markaby,  'merb/template/markaby'    
+    autoload :XMLBuilder,  'merb/template/xml_builder'      
+    
+    EXTENSIONS = {} unless defined?(EXTENSIONS)
+    
+    # lookup the template_extensions for the extname of the filename
+    # you pass. Answers with the engine that matches the extension
+    def self.engine_for(file)
+      engine_for_extension(File.extname(file)[1..-1])
+    end
+    
+    def self.engine_for_extension(ext)
+      const_get EXTENSIONS[ext]
+    end
+    
+    def self.register_extensions(engine,extensions)
+      raise ArgumentError unless engine.is_a?(Symbol) && extensions.is_a?(Array)
+      extensions.each{ |ext| EXTENSIONS[ext] = engine }
+    end
+    
+    # Register the default extensions.  They must be here
+    # since the template engines will not be loaded until they
+    # are directly referenced, or a file with their extension is found.
+    # If these are declared inside the template engine then
+    # they will never be found :(
+    register_extensions( :Erubis, %w[erb herb jerb rhtml])
+    register_extensions( :Haml, %w[haml])
+    register_extensions( :Markaby, %w[mab])
+    register_extensions( :XMLBuilder, %w[builder rxml xerb])
+    
+  end
+  
+end

data/lib/merb/template/erubis.rb

@@ -1,10 +1,13 @@
 module Merb # :nodoc:
   module Template # :nodoc:
 
+    class ErubisViewContext < ViewContext
+      include ::Merb::ErubisCaptureMixin
+    end
+    
     # Module to allow you to use Embedded Ruby templates through Erubis["http://www.kuwata-lab.com/erubis/"].
     # Your template must end in .herb (HTML and ERb), .jerb (JavaScript ERb), .erb (Embedded Ruby), or .rhtml (Ruby HTML) for Merb to use it.
     module Erubis
-      ::Merb::AbstractController.register_engine self, %w[ herb jerb erb rhtml html.erb js.erb ]
       class << self
         
         @@erbs = {}
@@ -21,24 +24,27 @@ module Merb # :nodoc:
         # by calling <tt>new_eruby_obj</tt>, which will compile the template and return an Erubis
         # object holding the parsed template.
         def transform(options = {})
-          opts, file, view_context = options.values_at(:opts, :file, :view_context)
-          eruby = new_eruby_obj(file)
-          view_context.extend(::Merb::ErubisCaptureMixin)
+          opts, text, file, view_context = options.values_at(:opts, :text, :file, :view_context)
+          eruby = text ? ::Erubis::MEruby.new(text) : new_eruby_obj(file)
           eruby.evaluate(view_context)
         end
         
+        def view_context_klass
+          ErubisViewContext
+        end
+        
         # Creates a new Erubis object to parse the template given in +path+.
         def new_eruby_obj(path)
           if @@erbs[path] && !cache_template?(path)
             return @@erbs[path]
           else  
             begin
-              returning ::Erubis::MEruby.new(IO.read(path)) do |eruby|
-                eruby.init_evaluator :filename => path
-                if cache_template?(path)
-                  @@erbs[path], @@mtimes[path] = eruby, Time.now
-                end  
-              end
+              eruby = ::Erubis::MEruby.new(IO.read(path))
+              eruby.init_evaluator :filename => path
+              if cache_template?(path)
+                @@erbs[path], @@mtimes[path] = eruby, Time.now
+              end  
+              eruby
             rescue Errno::ENOENT
               raise "No template found at path: #{path}"
             end

data/lib/merb/template/haml.rb

@@ -1,18 +1,27 @@
-
-
 begin
   require 'haml/engine'
 rescue LoadError
   puts "you must install the haml gem to use .haml templates"
 end
+require File.join( File.dirname(__FILE__), "..", "template")
 
+module Haml
+  module Helpers
+    
+    def _buffer( binding )
+      @_buffer ||= eval( "_erbout", binding )
+    end
+
+    alias_method :capture, :capture_haml
+
+  end
+end
 
 module Merb
   module Template
-    module Haml
-    
-       ::Merb::AbstractController.register_engine self, %w[ haml ]
     
+    module Haml
+      
       class << self
         
         @@hamls ||= {}
@@ -23,23 +32,27 @@ module Merb
         end
         
         def transform(options = {})
-          opts, file, view_context = options.values_at(:opts, :file, :view_context)
+          opts, text, file, view_context = options.values_at(:opts, :text, :file, :view_context)
           
-         	begin 
-         	  locals_code = build_locals(opts[:locals])
-         	  opts[:locals] = {}
-         	  
-         	  template = load_template(file)
-         	  
-         	  haml = ::Haml::Engine.new("#{locals_code}#{template}", opts) 
-         	  haml.to_html(view_context) 
-         	rescue 
-         	  # ::Haml::Engine often inserts a bogus "(haml):#{line_number}" entry in the backtrace. 
-         	  # Let's replace it with the path of the actual template 
-         	  $@[0].sub! /\(haml\)/, file  
-         	  raise # Raise the exception again
+          begin 
+            locals_code = build_locals(opts[:locals])
+            opts[:locals] = {}
+            
+            template = text ? text : load_template(file)
+            
+            haml = ::Haml::Engine.new("#{locals_code}#{template}", opts) 
+            haml.to_html(view_context) 
+          rescue 
+            # ::Haml::Engine often inserts a bogus "(haml):#{line_number}" entry in the backtrace. 
+            # Let's replace it with the path of the actual template 
+            $@[0].sub! /\(haml\)/, file  
+            raise # Raise the exception again
           end
         end
+        
+        def view_context_klass
+          ::Merb::ViewContext
+        end
       
         private
           def load_template(file)
@@ -57,7 +70,7 @@ module Merb
           
           def build_locals(locals)
             locals_code = ""
-         	  if locals
+            if locals
               locals.keys.each do |key|
                 locals_code << "- #{key} = @_merb_partial_locals[:#{key}]\n"
               end