tzispa 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0d1e2f805b398259308d37b08aaf4b1afe9d2537
-  data.tar.gz: 751ff37e20bdb8f0c0fc27a12aa7250523b80c99
+  metadata.gz: 1e7d9bdf85429d1bbe0fd303daff3853049aa4f6
+  data.tar.gz: 61aecb036fb1501b56572e8f5504ed9911e51242
 SHA512:
-  metadata.gz: c98965cffb98d15718affc2fa467a9cd6fce46c9033bfcdbdaf1fc55849679708e75fa6db836e735be380d3af9cb8e2f71a753c1dbc92d47ffef0cfb8af43069
-  data.tar.gz: a38443bda7a70802a8baf6d946a5c5293576dcdf8742f5afaf04f658154017454a06c34c71add5324796ab3f5fc9b6b6850ba9a6aff22c39035d2ff29fa4932a
+  metadata.gz: 79493c3072124348bc1e9458615da7a75665c4a9ee6f29ef138ede3df6bdae48648402c7ecfb3058fc93357905717ed034f6e17b4f0929d18993603927981560
+  data.tar.gz: f38fabe97d6d006bfde4e0e2d9f2349d96a428c68f7fa818e38e33cb836b8f8a04257b7cd4137d06f69206e48c03f1d20610eba913411a61f2d45edf6081a435

data/CHANGELOG.md

@@ -2,6 +2,10 @@ Tzispa
 
 General purpose web framework
 
+## v0.6.1
+- sessions security improvements
+- added "x-frame-option: sameorigin" header to security improvement
+
 ## v0.6.0
 - code refactoring & templates namespace simplification
 - added auth_layout controller

data/lib/tzispa/controller/auth_layout.rb

@@ -12,7 +12,7 @@ module Tzispa
       include Tzispa::Helpers::Response
 
       def render!
-        if (layout_name == login_layout) || context.login
+        if (layout_name == login_layout) || context.logged?
           rig = Tzispa::Rig::Engine.layout name: layout_name, domain: application.domain, content_type: context.router_params[:format] || config.default_format
           response.body << rig.render(context)
           content_type rig.content_type

data/lib/tzispa/http/context.rb

@@ -17,9 +17,10 @@ module Tzispa
       include Tzispa::Helpers::Security
 
       attr_reader    :request, :response
-      def_delegators :@request, :session, :browser
+      def_delegators :@request, :session
 
       SESSION_LAST_ACCESS   = :__last_access
+      SESSION_ID            = :__session_id
       SESSION_AUTH_USER     = :__auth__user
       GLOBAL_MESSAGE_FLASH  = :__global_message_flash
 
@@ -28,7 +29,7 @@ module Tzispa
         super(app, environment)
         @request = Tzispa::Http::Request.new(environment)
         @response = Tzispa::Http::Response.new
-        session[:id] ||= SecureRandom.uuid if app&.config&.sessions&.enabled
+        generate_session_id unless session[SESSION_ID]
       end
 
       def router_params
@@ -48,15 +49,19 @@ module Tzispa
       end
 
       def flash
-        SessionFlashBag.new(session, GLOBAL_MESSAGE_FLASH)
+        @flash ||= SessionFlashBag.new(session, GLOBAL_MESSAGE_FLASH)
+      end
+
+      def session?
+        (not session[SESSION_ID].nil?) and (session[SESSION_ID] == session.id)
       end
 
       def logged?
-        not session[SESSION_AUTH_USER].nil?
+        session? and (not session[SESSION_AUTH_USER].nil?)
       end
 
       def login=(user)
-        session[SESSION_AUTH_USER] = user if not user.nil?
+        session[SESSION_AUTH_USER] = user unless user.nil?
       end
 
       def login
@@ -131,6 +136,13 @@ module Tzispa
 
       private
 
+      def generate_session_id
+        SecureRandom.uuid.tap { |uuid|
+          session.id = uuid
+          session[SESSION_ID] = uuid
+        }
+      end
+
       def normalize_format(params)
         params.tap { |pmm|
           pmm[:format] = config.default_format unless pmm[:format]

data/lib/tzispa/http/response.rb

@@ -41,7 +41,8 @@ module Tzispa
           # currently, this would be the static file-handler
           headers["Content-Length"] = body.inject(0) { |l, p| l + p.bytesize }.to_s
         end
-        headers['X-Powered-By'] = "#{Tzispa::FRAMEWORK_NAME}"
+        headers['X-Frame-Options'] = 'SAMEORIGIN'
+        headers['X-Powered-By'] = "#{Tzispa::FRAMEWORK_NAME} #{Tzispa::VERSION}"        
         [status.to_i, headers, result]
       end
 

data/lib/tzispa/http/session_flash_bag.rb

@@ -20,7 +20,7 @@ module Tzispa
         load!
       end
 
-      def << (value)
+      def <<(value)
         if not value.nil?
           @bag << value
           store

data/lib/tzispa/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Tzispa
-  VERSION = '0.6.0'
+  VERSION = '0.6.1'
   FRAMEWORK_NAME = 'Tzispa'
   GEM_NAME = 'tzispa'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tzispa
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Juan Antonio Piñero
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-13 00:00:00.000000000 Z
+date: 2017-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack