##// END OF EJS Templates
Reset session on login/logout (#4248)....
Jean-Philippe Lang -
r2966:0485d3a52408
parent child
Show More
@@ -61,12 +61,12 class ApplicationController < ActionController::Base
61
61
62 # Sets the logged in user
62 # Sets the logged in user
63 def logged_user=(user)
63 def logged_user=(user)
64 reset_session
64 if user && user.is_a?(User)
65 if user && user.is_a?(User)
65 User.current = user
66 User.current = user
66 session[:user_id] = user.id
67 session[:user_id] = user.id
67 else
68 else
68 User.current = User.anonymous
69 User.current = User.anonymous
69 session[:user_id] = nil
70 end
70 end
71 end
71 end
72
72
@@ -182,6 +182,24 class AccountTest < ActionController::IntegrationTest
182 assert user.hashed_password.blank?
182 assert user.hashed_password.blank?
183 end
183 end
184
184
185 def test_login_and_logout_should_clear_session
186 get '/login'
187 sid = session[:session_id]
188
189 post '/login', :username => 'admin', :password => 'admin'
190 assert_redirected_to 'my/page'
191 assert_not_equal sid, session[:session_id], "login should reset session"
192 assert_equal 1, session[:user_id]
193 sid = session[:session_id]
194
195 get '/'
196 assert_equal sid, session[:session_id]
197
198 get '/logout'
199 assert_not_equal sid, session[:session_id], "logout should reset session"
200 assert_nil session[:user_id]
201 end
202
185 else
203 else
186 puts 'Mocha is missing. Skipping tests.'
204 puts 'Mocha is missing. Skipping tests.'
187 end
205 end
General Comments 0
You need to be logged in to leave comments. Login now