panda_pal 5.0.0.beta.1 → 5.0.0.beta.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 417de10d63af26bbeadb9b1fa5d57f74fad8070dec477ecf42f7ba914c46be4e
-  data.tar.gz: '0268833a242fda47935ec01207644c3a74daaa31b37b311401ac216b9e34f9bf'
+  metadata.gz: 71c014369a46408099c365ffcaf1c28364b741ad04debd70a8578781e282910f
+  data.tar.gz: 51799f778547d13a38c21eca3c1469bde737b769bad706655782aba2e86a4344
 SHA512:
-  metadata.gz: 1093764dca3b51778eb98cf8c8ce64bc88af73fb970e9f61597c3f71c92761729ad636ea156da7f2aad7d656ca2f35311f4cce72a338c3eb49f8cb85b788f229
-  data.tar.gz: ee960dc3a06b1da790af9ce3f9a7e6bb76bb06e75a2645097654833226ed84f1f9655455c396607b74981879bed44029147b55ead6efc6437b4abe1c9feb4699
+  metadata.gz: b60d3aa8b0a9448977fd510a998f9c486d64b09d78f9f82d18aca8c2b415a76075735e14a2e7d619677757200082191051b1cca30df7102dacc307e112aacd6b
+  data.tar.gz: 3f42d6f23b1d0e77a53cce6ce4d1dabf60bf0fbb35fc5557ed46cd797c954728d226f42674301a4a0f97913511f17d6b11c54c1a5c44510459ab8c6f42e1b07c

data/lib/panda_pal/helpers/controller_helper.rb

@@ -129,6 +129,10 @@ module PandaPal::Helpers::ControllerHelper
   end
 
   def session_key
+    if params[:encrypted_session_key]
+      crypt = ActiveSupport::MessageEncryptor.new(Rails.application.secrets.secret_key_base[0..31])
+      return crypt.decrypt_and_verify(params[:encrypted_session_key])
+    end
     params[:session_key] || session_key_header || flash[:session_key] || session[:session_key]
   end
 
@@ -139,7 +143,8 @@ module PandaPal::Helpers::ControllerHelper
   end
 
   # Redirect with the session key intact. In production,
-  # handle this by saving it to the flash. In dev,
+  # handle this by encrypting the session key.  That way if the
+  # url is logged anywhere, it will all be encrypted data.   In dev,
   # just put it in the URL. Putting it in the URL
   # is insecure, but is fine in development.
   # Keeping it in the URL in development means that it plays
@@ -162,8 +167,10 @@ module PandaPal::Helpers::ControllerHelper
   end
 
   def redirect_production_mode(location, params)
-    flash['session_key'] = current_session.session_key
+    crypt = ActiveSupport::MessageEncryptor.new(Rails.application.secrets.secret_key_base[0..31])
+    encrypted_data = crypt.encrypt_and_sign(current_session.session_key)
     redirect_to send(location, {
+      encrypted_session_key: encrypted_data,
       organization_id: current_organization.id
     }.merge(params))
   end

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "5.0.0.beta.1"
+  VERSION = "5.0.0.beta.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.0.0.beta.1
+  version: 5.0.0.beta.2
 platform: ruby
 authors:
 - Instructure ProServe
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-20 00:00:00.000000000 Z
+date: 2020-05-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails