Roundup Tracker - Issues

Issue 1691708

classification
Roundup doesn't co-exist well with malformed cookies
Type: Severity: normal
Components: Web interface Versions:
process
Status: closed accepted
:
: jpend : jpend, sbwoodside
Priority: normal :

Created on 2007-03-30 23:47 by sbwoodside, last changed 2007-09-22 21:21 by jpend.

Files
File name Uploaded Description Edit Remove
patch-cookies.txt sbwoodside, 2007-03-30 23:48 patch to co-exist with broken cookies
patch-cookies-2.txt sbwoodside, 2007-06-18 06:00 patch to co-exist with other apps' cookies on the same domain
Messages
msg2412 Author: [hidden] (sbwoodside) Date: 2007-03-30 23:47
Roundup isn't happy when another app on the same server is setting cookies that have names/values out of spec.

Trac had the same problem, so I adopted their solution. From http://trac.edgewall.org/ticket/2256 and http://trac.edgewall.org/changeset/3734

Here's the patch:

--- client.py.orig      2007-03-30 13:46:07.000000000 -0400
+++ client.py   2007-03-30 19:47:07.000000000 -0400
@@ -7,6 +7,7 @@
 import base64, binascii, cgi, codecs, mimetypes, os
 import random, re, rfc822, stat, time, urllib, urlparse
 import Cookie
+from Cookie import CookieError, BaseCookie, SimpleCookie
 
 from roundup import roundupdb, date, hyperdb, password
 from roundup.cgi import templating, cgitb, TranslationService
@@ -43,6 +44,28 @@
         return match.group(1)
     return '<%s>'%match.group(2)
 
+
+class Cookie(SimpleCookie): 
+    def load(self, rawdata, ignore_parse_errors=False): 
+        if ignore_parse_errors: 
+            self.bad_cookies = [] 
+            self._BaseCookie__set = self._loose_set 
+        SimpleCookie.load(self, rawdata) 
+        if ignore_parse_errors: 
+            self._BaseCookie__set = self._strict_set 
+            for key in self.bad_cookies: 
+                del self[key] 
+ 
+    _strict_set = BaseCookie._BaseCookie__set 
+ 
+    def _loose_set(self, key, real_value, coded_value): 
+        try: 
+            self._strict_set(key, real_value, coded_value) 
+        except CookieError: 
+            self.bad_cookies.append(key) 
+            dict.__setitem__(self, key, None)
+
+
 class Client:
     '''Instantiate to handle one CGI request.
 
@@ -154,7 +177,10 @@
         self.charset = self.STORAGE_CHARSET
 
         # parse cookies (used in charset and session lookups)
-        self.cookie = Cookie.SimpleCookie(self.env.get('HTTP_COOKIE', ''))
+        cookie = self.env.get('HTTP_COOKIE', '')
+        self.cookie = Cookie()
+        if cookie:
+            self.cookie.load(cookie, ignore_parse_errors=True)
 
         self.user = None
         self.userid = None
msg2413 Author: [hidden] (sbwoodside) Date: 2007-03-30 23:48
File Added: patch-cookies.txt
msg2414 Author: [hidden] (sbwoodside) Date: 2007-03-30 23:49
Added patch file since the spaces didn't come out when I pasted it in. I have this patch installed on my own 0.8 system and it works fine. (I was getting the bad cookies from Wikka.)
msg2415 Author: [hidden] (sbwoodside) Date: 2007-06-18 06:00
New patch compatible with Roundup 1.2.1 (python 2.4.4). Please put this into the build!!!!!!
File Added: patch-cookies-2.txt
msg2416 Author: [hidden] (sbwoodside) Date: 2007-06-18 06:02
New patch is for roundup 1.2.1 (python 2.4.4).
msg2417 Author: [hidden] (jpend) Date: 2007-09-22 21:21
Committed to CVS (cgi/client.py 1.238). Thanks!
History
Date User Action Args
2007-03-30 23:47:28sbwoodsidecreate