0
@@ -1 +1,12 @@
0
+==== Configuration options
0
+:session_id_cookie_only<Boolean>::
0
+  If true, sessions may be passed only through cookies. If false, they may also
0
+  be passed through the session_id_key query param. This might be necessary for
0
+  flash uploaders, which do not pass cookies with file uploads. This can be
0
+  used in conjunction with :query_string_whitelist.
0
+:query_string_whitelist<Array[String]>::
0
+  A list of "controller/action" URLs that should allow session IDs to be passed
0
+  through the query string even if :session_id_cookie_only is set to true. We
0
+  recommend using session.regenerate after any controller making use of this
0
+  in case someone is trying a session fixation attack.

0
@@ -1,6 +1,6 @@
0
 class Merb::Controller < AbstractController
0
   
0
-  class_inheritable_accessor :_session_id_key, :_session_expiry
0
+  class_inheritable_accessor :_session_id_key, :_session_expiry, :_hidden_actions
0
   cattr_accessor :_subclasses, :_session_secret_key
0
   self._subclasses = Set.new
0
   self.session_secret_key = nil
0
@@ -10,6 +10,111 @@
0
   include Merb::ResponderMixin
0
   include Merb::ControllerExceptions
0
   
0
-  
0
+  class << self
0
+    
0
+    # ==== Parameters
0
+    # klass<Merb::Controller>:: The Merb::Controller inheriting from the
0
+    #                           base class
0
+    def inherited(klass)
0
+      _subclasses << klass.to_s
0
+      klass._hidden_actions = Merb::Controller.public_instance_methods
0
+      super
0
+    end
0
+
0
+    # A list of actions that should not be available as callable actions
0
+    def hidden_actions
0
+      _hidden_actions
0
+    end
0
+    
0
+    # Hide each of the given methods from being callable as actions.
0
+    #
0
+    # ==== Parameters
0
+    # *names<~to-s>:: Actions that should be added to the list 
0
+    def hide_action(*names)
0
+      _hidden_actions = _hidden_actions | names.collect { |n| n.to_s })
0
+    end
0
+    
0
+    # Build a new controller.
0
+    #
0
+    # ==== Parameters
0
+    # request<Merb::Request>:: The Merb::Request that came in from Mongrel
0
+    # response<IO>:: 
0
+    #   The response IO object to write the response to. This could be any
0
+    #   IO object, but is probably an HTTPResponse
0
+    # status<Integer>:: An integer code for the status
0
+    # headers<Hash{header => value}>:: 
0
+    #   A hash of headers to start the controller with. These headers
0
+    #   can be overridden later by the #headers method
0
+    def build(request, response = StringIO.new, status=200, headers={'Content-Type' => 'text/html; charset=utf-8'})
0
+      cont = new
0
+      cont.set_dispatch_variables(request, response, status, headers)
0
+      cont
0
+    end
0
+    
0
+    # Sets the variables that came in through the dispatch as available to
0
+    # the controller. This is called by .build, so see it for more
0
+    # information.
0
+    #
0
+    # This method uses the :session_id_cookie_only and :query_string_whitelist
0
+    # configuration options. See CONFIG for more details.
0
+    #
0
+    # ==== Parameters
0
+    # request<Merb::Request>:: The Merb::Request that came in from Mongrel
0
+    # response<IO>:: 
0
+    #   The response IO object to write the response to. This could be any
0
+    #   IO object, but is probably an HTTPResponse
0
+    # status<Integer>:: An integer code for the status
0
+    # headers<Hash{header => value}>:: 
0
+    #   A hash of headers to start the controller with. These headers
0
+    #   can be overridden later by the #headers method
0
+    def set_dispatch_variables(request, response, status, headers)
0
+      if request.params.key?(_session_id_key)
0
+        if Merb::Config[:session_id_cookie_only]
0
+          # This condition allows for certain controller/action paths to allow
0
+          # a session ID to be passed in a query string. This is needed for
0
+          # Flash Uploads to work since flash will not pass a Session Cookie
0
+          # Recommend running session.regenerate after any controller taking
0
+          # advantage of this in case someone is attempting a session fixation
0
+          # attack
0
+          if Merb::Config[:query_string_whitelist].include?("#{request.controller_name}/#{request.action}")
0
+          # FIXME to use routes not controller and action names -----^
0
+            request.cookies[_session_id_key] = request.params[_session_id_key]
0
+          end
0
+        else
0
+          request.cookies[_session_id_key] = request.params[_session_id_key]
0
+        end
0
+      end
0
+      @_request  = request
0
+      @_response = response
0
+      @_status   = status
0
+      @_headers  = headers
0
+    end
0
+    
0
+    # Dispatch the action
0
+    #
0
+    # ==== Parameters
0
+    def dispatch(action=:index)
0
+      start = Time.now    
0
+      if self.class.callable_actions[action.to_s]
0
+        params[:action] ||= action
0
+        setup_session
0
+        super(action)
0
+        finalize_session
0
+      else
0
+        raise ActionNotFound, "Action '#{action}' was not found in #{self.class}"
0
+      end
0
+      @_benchmarks[:action_time] = Time.now - start
0
+      Merb.logger.info("Time spent in #{self.class}##{action} action: #{@_benchmarks[:action_time]} seconds")
0
+    end
0
+    
0
+    _attr_reader :body, :status, :request, :params, :headers, :response
0
+    def params()  request.params  end
0
+    def cookies() request.cookies end
0
+    def session() request.session end
0
+    def route()   request.route   end
0
+    
0
+    
0
+    
0
+  end
0
 end

0
@@ -3,6 +3,34 @@
0
 # to, for example, an array without those additions being shared with either their parent, siblings, or
0
 # children, which is unlike the regular class-level attributes that are shared across the entire hierarchy.
0
 class Class # :nodoc:
0
+  
0
+  def _attr_reader(*syms)
0
+    syms.flatten.each do |sym|
0
+      class_eval <<-EOS
0
+        def #{sym}
0
+          @_sym
0
+        end
0
+      EOS
0
+    end
0
+  end
0
+
0
+  def _attr_writer(*syms)
0
+    syms.flatten.each do |sym|
0
+      class_eval <<-EOS
0
+        def #{sym}=(val)
0
+          @_sym = val
0
+        end
0
+      EOS
0
+    end
0
+  end
0
+  
0
+  def _attr_accessor(*syms)
0
+    syms.flatten.each do |sym|
0
+      _attr_reader sym
0
+      _attr_writer sym
0
+    end
0
+  end
0
+  
0
   def cattr_reader(*syms)
0
     syms.flatten.each do |sym|
0
       next if sym.is_a?(Hash)