You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@turbine.apache.org by gk...@apache.org on 2026/09/11 12:16:45 UTC
(turbine-core) branch trunk updated: Refresh sessionid when processing logging in request
This is an automated email from the ASF dual-hosted git repository.
gmkll pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/turbine-core.git
The following commit(s) were added to refs/heads/trunk by this push:
new c4b3f082 Refresh sessionid when processing logging in request
c4b3f082 is described below
commit c4b3f082cd79b7ad7636bf5ce6fe197a9f7f815a
Author: Georg Kallidis <gk...@apache.org>
AuthorDate: Wed Sep 9 16:16:46 2026 +0200
Refresh sessionid when processing logging in request
---
src/java/org/apache/turbine/modules/actions/LoginUser.java | 3 ++-
src/java/org/apache/turbine/pipeline/DefaultLoginValve.java | 7 +++++++
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/java/org/apache/turbine/modules/actions/LoginUser.java b/src/java/org/apache/turbine/modules/actions/LoginUser.java
index 1f3d4ba9..a98029da 100644
--- a/src/java/org/apache/turbine/modules/actions/LoginUser.java
+++ b/src/java/org/apache/turbine/modules/actions/LoginUser.java
@@ -95,10 +95,11 @@ public class LoginUser implements Action
try
{
- if (username.equals(security.getAnonymousUser().getName()))
+ if (username.equals(security.getAnonymousUser().getName()))
{
throw new TurbineException("Anonymous user cannot login");
}
+ // sessionid is already refreshed in pipeline by default.
// Authenticate the user and get the object.
User user = security.getAuthenticatedUser(username, password);
diff --git a/src/java/org/apache/turbine/pipeline/DefaultLoginValve.java b/src/java/org/apache/turbine/pipeline/DefaultLoginValve.java
index ba2c956b..cbf6bb8e 100644
--- a/src/java/org/apache/turbine/pipeline/DefaultLoginValve.java
+++ b/src/java/org/apache/turbine/pipeline/DefaultLoginValve.java
@@ -113,9 +113,16 @@ public class DefaultLoginValve
// associated with the previous User. Currently the
// only keys stored in the session are "turbine.user"
// and "turbine.acl".
+ // Since Servlet spec 3.1 request.changeSessionId does change
+ // the session id of the current session associated with this
+ // request, which disallows passing the sessionId.
if (actionName.equalsIgnoreCase(actionLogin))
{
+ // this fetches or creates session
Enumeration<String> names = data.getSession().getAttributeNames();
+
+ data.getRequest().changeSessionId();
+
if (names != null)
{
// copy keys into a new list, so we can clear the session