Ticket #11555: 11555.diff

django/contrib/sessions/tests.py

@@ -170 +170 @@
             # session key; make sure that entry is manually deleted
             session.delete('1')
 
+    def test_session_key_is_read_only(self):
+        def set_session_key(session):
+            session.session_key = session._get_new_session_key()
+        self.assertRaises(AttributeError, set_session_key, self.session)
+
     # Custom session expiry
     def test_default_expiry(self):
         # A normal session has a max age equal to settings

django/contrib/sessions/backends/base.py

@@ -168 +168 @@
                 break
         return session_key
 
-    def _get_session_key(self):
+    def _get_or_create_session_key(self):
         if self._session_key:
             return self._session_key
         else:
             self._session_key = self._get_new_session_key()
             return self._session_key
 
-    def _set_session_key(self, session_key):
-        self._session_key = session_key
+    def _get_session_key(self):
+        return self._session_key
 
-    session_key = property(_get_session_key, _set_session_key)
+    session_key = property(_get_session_key)
 
     def _get_session(self, no_load=False):
         """

django/contrib/sessions/backends/file.py

@@ -33 +33 @@
         Get the file associated with this session key.
         """
         if session_key is None:
-            session_key = self.session_key
+            session_key = self._get_or_create_session_key()
 
         # Make sure we're not vulnerable to directory traversal. Session keys
         # should always be md5s, so they should never contain directory

django/contrib/sessions/backends/cache.py

@@ -23 +23 @@
         # and then raise an exception. That's the risk you shoulder if using
         # cache backing.
         for i in xrange(10000):
-            self.session_key = self._get_new_session_key()
+            self._session_key = self._get_new_session_key()
             try:
                 self.save(must_create=True)
             except CreateError:
@@ -37 +37 @@
             func = self._cache.add
         else:
             func = self._cache.set
-        result = func(self.session_key, self._get_session(no_load=must_create),
+        result = func(self._get_or_create_session_key(),
+                self._get_session(no_load=must_create),
                 self.get_expiry_age())
         if must_create and not result:
             raise CreateError

django/contrib/sessions/backends/db.py

@@ -33 +33 @@
 
     def create(self):
         while True:
-            self.session_key = self._get_new_session_key()
+            self._session_key = self._get_new_session_key()
             try:
                 # Save immediately to ensure we have a unique entry in the
                 # database.
@@ -53 +53 @@
         entry).
         """
         obj = Session(
-            session_key = self.session_key,
+            session_key = self._get_or_create_session_key(),
             session_data = self.encode(self._get_session(no_load=must_create)),
             expire_date = self.get_expiry_date()
         )

tests/regressiontests/test_client_regress/session.py

@@ -14 +14 @@
         return False
 
     def create(self):
-        self.session_key = self.encode({})
+        self._session_key = self.encode({})
 
     def save(self, must_create=False):
-        self.session_key = self.encode(self._session)
+        self._session_key = self.encode(self._session)
 
     def delete(self, session_key=None):
-        self.session_key = self.encode({})
+        self._session_key = self.encode({})
 
     def load(self):
         try: