From: "Ara.T.Howard" <Ara.T.Howard@...>
Date: 2005-09-14T12:00:21+09:00
Subject: [BUG/PATCH] cgi/session.rb


the following program with fail both the way it is, and using the commented
section:


   ~ > cat a.cgi
   #! /usr/local/bin/ruby

   require 'cgi'
   require 'cgi/session'

   cgi = CGI::new

   database_manager = CGI::Session::FileStore

   session =
   =begin
     begin
       s = CGI::Session::new cgi, 'database_manager' => database_manager, 'new_session' => false
       s.delete
       s
     rescue ArgumentError
       CGI::Session::new cgi, 'database_manager' => database_manager, 'new_session' => true
     end
   =end
       CGI::Session::new cgi, 'database_manager' => database_manager

   session.close

   this_time = Time::now
   last_time = session['last_time'] || this_time
   session['last_time'] = this_time
   session.close

   content = ''
   content << "<hr> THIS_TIME @ <b>#{ this_time }</b> <hr>"
   content << "<hr> LAST_TIME @ <b>#{ last_time }</b> <hr>"

   cgi.out{ content }


in either case a new session is __always__ created.  the docs say:

...
   # A CGI::Session instance is created from a CGI object.  By default,
   # this CGI::Session instance will start a new session if none currently
   # exists, or continue the current session for this client if one does
   # exist.  The +new_session+ option can be used to either always or
   # never create a new session.  See #new() for more details.
...

so there is no way to re-use a session attm.  this seems serious.  i think this
patch addresses the issue:


[ahoward@localhost build/ruby-1.8.2/lib/] diff -u -b -B cgi/session.rb.org cgi/session.rb
--- cgi/session.rb.org  2005-09-13 20:52:14.000000000 -0600
+++ cgi/session.rb      2005-09-13 20:53:32.000000000 -0600
@@ -244,7 +244,7 @@
      #   end
      #
      def initialize(request, option={})
-      @new_session = false
+      @new_session = nil
        session_key = option['session_key'] || '_session_id'
        session_id = option['session_id']
        unless session_id
@@ -381,10 +381,11 @@
          md5 = Digest::MD5.hexdigest(id)[0,16]
         @path = dir+"/"+prefix+md5+suffix
         unless File::exist? @path
-          unless session.new_session
+          unless session.new_session.nil?
              raise CGI::Session::NoSession, "uninitialized session"
            end
           @hash = {}
+          update
         end
        end


and, indeed, with the change the following works as expected/doccumented:

   #! /usr/local/bin/ruby
   require 'cgi'
   require './cgi/session'

   cgi = CGI::new
   content = ''
   database_manager = CGI::Session::FileStore
   this_time = Time::now

   begin
     session = CGI::Session::new cgi, 'database_manager' => database_manager
     last_time = session['last_time'] || this_time
     session['last_time'] = this_time
     session.close

     content << "<hr> THIS_TIME @ <b>#{ this_time }</b> <hr>"
     content << "<hr> LAST_TIME @ <b>#{ last_time }</b> <hr>"
   rescue Exception => e
     m, c, b = e.message, e.class, e.backtrace.join("\n")
     content << "<pre>#{ m } (#{ c })\n#{ b }</pre>"
   end
   cgi.out{ content }


hopefully this hasn't already been fixed - i searched for a while....

regards.


-a
-- 
===============================================================================
| email :: ara [dot] t [dot] howard [at] noaa [dot] gov
| phone :: 303.497.6469
| Your life dwells amoung the causes of death
| Like a lamp standing in a strong breeze.  --Nagarjuna
===============================================================================