SONAR-3230 Stolen user session

diff --git a/sonar-server/src/dev/web.xml b/sonar-server/src/dev/web.xml
index cca6dc5d8a9c5c51680f933a6d90773cc1e4499b..a613bea2a3c13f7124d0b835a3e34721e95ba34c 100644 (file)
--- a/sonar-server/src/dev/web.xml
+++ b/sonar-server/src/dev/web.xml
@@ -78,6 +78,11 @@
     <url-pattern>/batch/*</url-pattern>
   </servlet-mapping>
 
+  <session-config>
+    <!-- in minutes -->
+    <session-timeout>20</session-timeout>
+  </session-config>
+
   <listener>
     <listener-class>org.sonar.server.platform.PlatformLifecycleListener</listener-class>
   </listener>

diff --git a/sonar-server/src/main/webapp/WEB-INF/config/environment.rb b/sonar-server/src/main/webapp/WEB-INF/config/environment.rb
index 5ee8f927a3b7f51788ab7c602c30cd69177b5ad3..5d3bcbf5bc2f39858eb1cc1a52a1372d075f262e 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/config/environment.rb
+++ b/sonar-server/src/main/webapp/WEB-INF/config/environment.rb
@@ -38,10 +38,8 @@ Rails::Initializer.run do |config|
   
   config.i18n.default_locale = :en
 
-  # Use the database for sessions instead of the cookie-based default,
-  # which shouldn't be used to store highly confidential information
-  # (create the session table with "rake db:sessions:create")
-  # config.action_controller.session_store = :active_record_store
+  # Provided by JRuby-Rack
+  config.action_controller.session_store = :java_servlet_store
 
   # Use SQL instead of Active Record's schema dumper when creating the test database.
   # This is necessary if your schema can't be completely dumped by the schema dumper,

diff --git a/sonar-server/src/main/webapp/WEB-INF/config/initializers/session_store.rb b/sonar-server/src/main/webapp/WEB-INF/config/initializers/session_store.rb
deleted file mode 100644 (file)
index ce9f00f..0000000
--- a/sonar-server/src/main/webapp/WEB-INF/config/initializers/session_store.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-# Your secret key for verifying cookie session data integrity.
-# If you change this key, all old sessions will become invalid!
-# Make sure the secret is at least 30 characters and all random,
-# no regular words or you'll be exposed to dictionary attacks.
-ActionController::Base.session = {
-  :key         => '_sonar_session',
-  :secret      => 'bc2d855f87a32c43ce7c302b074b4271c58d024420437d6d85d03b19319e659f0c5bf3486b30480df43cda10bd95ad012956d77d3d35fc38edc639c232aacc11',
-  :expire_after => 20.minutes
-}
-
-# Use the database for sessions instead of the cookie-based default,
-# which shouldn't be used to store highly confidential information
-# (create the session table with "rake db:sessions:create")
-# ActionController::Base.session_store = :active_record_store

diff --git a/sonar-server/src/main/webapp/WEB-INF/web.xml b/sonar-server/src/main/webapp/WEB-INF/web.xml
index 23172c43dbe48fe6ddfc826a798652cad82e2a05..db10b309cac06d4720c5f5171b0041969f2f3fbb 100644 (file)
--- a/sonar-server/src/main/webapp/WEB-INF/web.xml
+++ b/sonar-server/src/main/webapp/WEB-INF/web.xml
@@ -113,6 +113,11 @@
     <url-pattern>/batch/*</url-pattern>
   </servlet-mapping>
 
+  <session-config>
+    <!-- in minutes -->
+    <session-timeout>20</session-timeout>
+  </session-config>
+
   <listener>
     <listener-class>org.sonar.server.platform.PlatformLifecycleListener</listener-class>
   </listener>