Einav Cohen has submitted this change and it was merged.
Change subject: webadmin,root: Prevent JSESSIONID cookie for root path
......................................................................
webadmin,root: Prevent JSESSIONID cookie for root path
Engine "root" web application containing various utility
servlets sets JSESSIONID cookie for / (root path) upon
following occasions:
a. when requesting document file for a missing language,
DocsServlet ensures HttpSession -> JSESSIONID cookie
in order to read/store "langPageShown" attribute:
"Show missing language page only for the first time"
b. when processing any JSP page, since each JSP gets
HttpSession -> JSESSIONID cookie created eagerly:
- ovirt-engine.jsp (splash page)
- no_lang.jsp (missing language page)
However, setting cookie X for path=/ essentially shadows
any other cookie(s) with same name (X) set for path=/foo
Consider following example:
1. User visits WebAdmin:
- new cookie JSESSIONID for path=/webadmin
- WebAdmin JavaScript reads JSESSIONID cookie,
correct value is returned
2. User visits "root" web application:
- new cookie JSESSIONID for path=/
- WebAdmin JavaScript reads JSESSIONID cookie,
wrong value is returned because there are two
JSESSIONID cookies and path=/ takes precedence
This patch prevents "root" web application from using
JSESSIONID cookie (see occasions a. and b. above), which
prevents cookie shadowing for WebAdmin.
In future, we should consider using different "session"
cookie names for different web applications in order to
avoid such problems.
Change-Id: I3b4c95f0a716bf3cc05d102a1026b3c6aee5879c
Bug-Url: https://bugzilla.redhat.com/966525
Signed-off-by: Vojtech Szocs <vsz...@redhat.com>
---
M
backend/manager/modules/root/src/main/java/org/ovirt/engine/core/DocsServlet.java
M backend/manager/modules/root/src/main/webapp/WEB-INF/help/no_lang.jsp
M backend/manager/modules/root/src/main/webapp/WEB-INF/ovirt-engine.jsp
3 files changed, 26 insertions(+), 5 deletions(-)
Approvals:
Einav Cohen: Verified; Looks good to me, approved
--
To view, visit http://gerrit.ovirt.org/15057
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I3b4c95f0a716bf3cc05d102a1026b3c6aee5879c
Gerrit-PatchSet: 2
Gerrit-Project: ovirt-engine
Gerrit-Branch: master
Gerrit-Owner: Vojtech Szocs <vsz...@redhat.com>
Gerrit-Reviewer: Alexander Wels <aw...@redhat.com>
Gerrit-Reviewer: Einav Cohen <eco...@redhat.com>
Gerrit-Reviewer: Juan Hernandez <juan.hernan...@redhat.com>
Gerrit-Reviewer: Oved Ourfali <oourf...@redhat.com>
Gerrit-Reviewer: Vojtech Szocs <vsz...@redhat.com>
_______________________________________________
Engine-patches mailing list
Engine-patches@ovirt.org
http://lists.ovirt.org/mailman/listinfo/engine-patches
