[Django] #28066: SessionBase.cycle_key may discard session data
Django
--------------------------------------------+------------------------
Reporter: InvalidInterrupt | Owner: nobody
Type: Bug | Status: new
Component: contrib.sessions | Version: 1.11
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
--------------------------------------------+------------------------
The `cycle_key()` method will use an empty `dict` for session data if it
had not previously been loaded. The docstring says the function is there
specifically to avoid losing sesison data, and the behavior feels
inconsistent. This won't be noticed on most sites, as the
`AuthenticationMiddleware` accesses the session on every request. However,
it did cause problems for me in unittests for some views.
--
Ticket URL: <https://code.djangoproject.com/ticket/28066>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
Reporter: InvalidInterrupt | Owner: nobody
Type: Bug | Status: new
Component: contrib.sessions | Version: 1.11
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
----------------------------------+--------------------------------------
Changes (by Tim Graham):
* easy: 1 => 0
Comment:
Could you please give an example test that demonstrates the issue?
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:1>
Django
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Type: Bug | Status: assigned
Component: contrib.sessions | Version: 1.11
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Changes (by InvalidInterrupt):
* owner: nobody => InvalidInterrupt
* status: new => assigned
Comment:
The first commit in
[https://github.com/InvalidInterrupt/django/tree/ticket_28066] modifies an
existing check for this situation to fail if data is lost. I also went
ahead and quickly wrote a patch for the issue. I'll submit a pull request
if you also believe this is a bug.
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:2>
Django
populated
-------------------------------------+-------------------------------------
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Type: Bug | Status: assigned
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
* stage: Unreviewed => Accepted
Comment:
Looks okay at first glance. The previous change
(887f3d3219b9f8192d27314eceee27ab1f89c5cc) was new in 1.11 so this could
be backported.
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:3>
Django
populated
-------------------------------------+-------------------------------------
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Type: Bug | Status: assigned
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
* has_patch: 0 => 1
Comment:
[https://github.com/django/django/pull/8353 PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:4>
Django
populated
-------------------------------------+-------------------------------------
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Component: contrib.sessions | Version: 1.11
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
* status: assigned => closed
* resolution: => fixed
Comment:
In [changeset:"dda596ca3296f5b2574cf4876a4e176594f52834" dda596c]:
{{{
#!CommitTicketReference repository=""
revision="dda596ca3296f5b2574cf4876a4e176594f52834"
Fixed #28066 -- Prevented SessionBase.cycle_key() from discarding data.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:5>
Django
populated
-------------------------------------+-------------------------------------
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Type: Bug | Status: closed
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Comment (by Tim Graham <timograham@…>):
In [changeset:"5d556d2aaf64a4181b121e3cb51009d59f02869e" 5d556d2a]:
{{{
#!CommitTicketReference repository=""
revision="5d556d2aaf64a4181b121e3cb51009d59f02869e"
[1.11.x] Fixed #28066 -- Prevented SessionBase.cycle_key() from discarding
data.
Backport of dda596ca3296f5b2574cf4876a4e176594f52834 from master
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:6>
Django
populated
-------------------------------------+-------------------------------------
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Type: Bug | Status: closed
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Comment (by GitHub <noreply@…>):
In [changeset:"81f844940279140d27578fc6a5b134763ffcceb6" 81f84494]:
{{{
#!CommitTicketReference repository=""
revision="81f844940279140d27578fc6a5b134763ffcceb6"
Refs #28066 -- Fixed nondeterministic ordering test failure in
sessions_tests.
Thanks Tim Graham for the review.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:7>
Django
populated
-------------------------------------+-------------------------------------
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Type: Bug | Status: closed
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Comment (by Mariusz Felisiak <felisiak.mariusz@…>):
In [changeset:"3173d9a850043b31eefbb8b1dbc1e66cbdf31a15" 3173d9a]:
{{{
#!CommitTicketReference repository=""
revision="3173d9a850043b31eefbb8b1dbc1e66cbdf31a15"
[1.11.x] Refs #28066 -- Fixed nondeterministic ordering test failure in
sessions_tests.
Thanks Tim Graham for the review.
Backport of 81f844940279140d27578fc6a5b134763ffcceb6 from master
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:8>
Django
populated
-------------------------------------+-------------------------------------
Reporter: InvalidInterrupt | Owner:
| InvalidInterrupt
Type: Bug | Status: closed
Severity: Normal | Resolution: fixed
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Comment (by Tim Graham <timograham@…>):
In [changeset:"d6524088a85a3b6ee4216c46a2d847eb6500decd" d6524088]:
{{{
#!CommitTicketReference repository=""
revision="d6524088a85a3b6ee4216c46a2d847eb6500decd"
[1.11.x] Refs #28066 -- Fixed Python 2 failures in sessions_tests.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/28066#comment:9>