Ticket #18194: files-sessions-server-expiry-3.patch

django/contrib/sessions/backends/base.py

@@ -12 +12 @@
 from django.utils.crypto import get_random_string
 from django.utils.crypto import salted_hmac
 from django.utils import timezone
+from django.core import signing
 
 class CreateError(Exception):
     """
@@ -31 +32 @@
         self._session_key = session_key
         self.accessed = False
         self.modified = False
+        self.signer = signing.TimestampSigner()
 
     def __contains__(self, key):
         return key in self._session
@@ -76 +78 @@
 
     def encode(self, session_dict):
         "Returns the given session dictionary pickled and encoded as a string."
-        pickled = pickle.dumps(session_dict, pickle.HIGHEST_PROTOCOL)
-        hash = self._hash(pickled)
-        return base64.encodestring(hash + ":" + pickled)
+        serialized = pickle.dumps(session_dict)
+        return self.signer.sign(serialized)
 
     def decode(self, session_data):
-        encoded_data = base64.decodestring(session_data)
         try:
-            # could produce ValueError if there is no ':'
-            hash, pickled = encoded_data.split(':', 1)
-            expected_hash = self._hash(pickled)
-            if not constant_time_compare(hash, expected_hash):
-                raise SuspiciousOperation("Session data corrupted")
-            else:
-                return pickle.loads(pickled)
+            serialized = str(self.signer.unsign(session_data,
+                                                settings.SESSION_COOKIE_AGE))
+            return pickle.loads(serialized)
+
+        except signing.BadSignature:
+            self.create()
+
+        # Signing framework handles any possiblity of ValueError and
+        # SuspiciousOperation. So, this exception block will handle unpickling
+        # exceptions only.
         except Exception:
             # ValueError, SuspiciousOperation, unpickling exceptions. If any of
             # these happen, just return an empty dictionary (an empty session).

django/contrib/sessions/tests.py

@@ -345 +345 @@
         self.assertRaises(SuspiciousOperation,
                           self.backend("a/b/c").load)
 
+    # This test fails with cookie (which is fine I suppose) and cache backends,
+    # thats why added it to file tests only.
+    @override_settings(SESSION_COOKIE_AGE=0)
+    def test_onload_expiry_check(self):
+        """
+        Test to ensure that expiry of session is checked on-load
+        """
+
+        self.session['test-data'] = True
+        old_key = self.session.session_key
+        self.session.save()
+        self.assertTrue(self.session.get('test-data'))
+        self.session.load()
+        new_key = self.session.session_key
+
+        # Make sure a new key was generated after the invalidation of the old
+        # one.
+        self.assertNotEqual(old_key, new_key)
+        # The key test-data should not be present in the session.
+        self.assertFalse(self.session.get('test-data'))
 
 class CacheSessionTests(SessionTestsMixin, unittest.TestCase):