OSDN Git Service

Prevented referrer leak. Renew session ID in action_url. Closes #11663
authormorimoto <morimoto@180c8125-5b33-4295-ad04-72a68a15b4cc>
Tue, 15 Jan 2008 12:21:00 +0000 (12:21 +0000)
committermorimoto <morimoto@180c8125-5b33-4295-ad04-72a68a15b4cc>
Tue, 15 Jan 2008 12:21:00 +0000 (12:21 +0000)
lib/Keitairc/SessionManager.pm
lib/plugins/10url
lib/templates/url.html

index 1386553..9cd64dd 100644 (file)
@@ -1,6 +1,6 @@
 # -*-perl-*-
 # Keitairc::SessionManager
-# $Id: SessionManager.pm,v 1.2 2008-01-13 14:00:14 morimoto Exp $
+# $Id: SessionManager.pm,v 1.3 2008-01-15 12:21:00 morimoto Exp $
 # $Source: /home/ishikawa/work/keitairc/tmp/keitairc/lib/Keitairc/SessionManager.pm,v $
 #
 # Copyright (c) 2008 Jun Morimoto <morimoto@mrmt.net>
@@ -166,6 +166,13 @@ sub garbage_collect{
 }
 
 ################################################################
+sub delete{
+       my $me = shift;
+       my $session_id = shift;
+       delete $me->{sessions}->{$session_id};
+}
+
+################################################################
 # USER_AGENTʸ»úÎ󤫤顢¥»¥Ã¥·¥ç¥óȽÄê¤Î˸¤²¤È¤Ê¤ëÍ×ÁǤò¼è¤ë
 sub normalize_user_agent{
        my $me = shift;
index b836ba4..7c0e34a 100644 (file)
@@ -1,7 +1,7 @@
 # -*-perl-*-
 # keitairc/lib/plugins/10url
 # URL\8f\88\97\9d
-# $Id: 10url,v 1.2 2008-01-13 12:12:55 morimoto Exp $
+# $Id: 10url,v 1.3 2008-01-15 12:21:00 morimoto Exp $
 # $Source: /home/ishikawa/work/keitairc/tmp/keitairc/lib/plugins/10url,v $
 
 $plugin = {
@@ -20,12 +20,14 @@ $plugin = {
                my ($request, $name, $session_id, $param_string) = @_;
                my $ci = new Keitairc::ClientInfo($request);
                my $view = new Keitairc::View($::cf, $ci);
+
+               # \90V\82µ\82¢ session_id \82ð\8dì\82Á\82Ä\8cÃ\82¢\82Ì\82Í\8fÁ\82·
+               $::sm->delete($session_id);
+               my $new_session = $::sm->add($ci->{header}->{user_agent}, $ci->serial_key());
                return $view->render('url.html', {
-                       session_id => $session_id,
                        url => $param_string,
+                       session_id => $new_session->{id},
                        escaped_url => ::uri_escape($param_string),
-                       ezweb => $ci->is_ezweb(),
-                       sid => $session_id,
                             });
        }
 };
index 0c73757..7b423ef 100644 (file)
@@ -11,7 +11,7 @@
   <body>
     <!-- tmpl_var url -->
     <hr />
-
+    <font color="#f3333">\82±\82ÌÍß-¼Þ\82Å\82Í[\96ß\82é]ÎÞÀÝ\82Í\8eg\82¦\82Ü\82¹\82ñ</font><br />
     <form method="post" action="/<!-- tmpl_var session_id -->/postme">
       <a accesskey="1" href="<!-- tmpl_var url -->">
        [1] \92¼\90Ú±¸¾½</a><br />
@@ -19,7 +19,7 @@
        [2] Îß¹¯Ä\82Í\82Ä\82È\82ű¸¾½</a><br />
       <a accesskey="3" href="http://p.m.livedoor.com/?__u=<!-- tmpl_var escaped_url -->">
        [3] ÓÊÞ³»Þ-\83À\82ű¸¾½</a><br />
-      <tmpl_if ezweb>
+      <tmpl_if is_ezweb>
        <a accesskey="4" href="device:pcsiteviewer?url=<!-- tmpl_var url -->">
          [4] PC»²ÄËÞ­-±\82ű¸¾½</a><br />
       </tmpl_if>