I''ve search this group for reports of this problem but didn''t find anything useful. I am doing the following with plain vanilla Rails 1.1.6 running WEBrick. View: <form action="/home/post_photo" method="POST" enctype="multipart/form-data"> <p>Upload photo<br /> <input id="_photo" name="photo" type="file" /><br /> <input name="commit" type="submit" value="Upload" /></p> <input name="obj_id" type="hidden" value="2" /> <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> </form> Controller: def post_photo session[:photo_original_filename] = params[:photo][:original_filename] redirect_to :controller => ''home'', :action => ''index'' end Problem: I login with a user account and have access to all member-only pages. Then I access the file upload view, select a local file and press the [Upload] button. I was supposed to be redirected to /home/index where session[:photo_original_filename] is displayed. However I was redirected to the Login page instead. This was because my authenticate user filter had failed when it shouldn''t. I figure the session may have changed so I recorded the session_id before and after [Upload] button was pressed. They were indeed different. Next, I remove the enctype="multipart/form-data" part from the form declaration. I perform the steps again and was redirected /home/index, as expected (with my current session remained in tact). So, I don''t know what the problem is and do hope someone could provide some insight. Much appreciated, -- Long --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---
Well, I tried a few more things and found the culprit: <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> I removed the above line and the file upload work as expected (well almost). It seems there is something quirky with enctype= and _session_id processing. Bug: params[:photo][:original_filename] should be params[:photo].original_filename Hope this will be useful to some for reference. Cheers, -- Long ----- Original Message ----- From: "Long" <long755-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> To: <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> Sent: Friday, August 31, 2007 12:04 AM Subject: [Rails] Lost session with file upload> > I''ve search this group for reports of this problem but didn''t find anything useful. > > I am doing the following with plain vanilla Rails 1.1.6 running WEBrick. > > View: > <form action="/home/post_photo" method="POST" enctype="multipart/form-data"> > <p>Upload photo<br /> > <input id="_photo" name="photo" type="file" /><br /> > <input name="commit" type="submit" value="Upload" /></p> > <input name="obj_id" type="hidden" value="2" /> > <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> > </form> > > Controller: > def post_photo > session[:photo_original_filename] = params[:photo][:original_filename] > redirect_to :controller => ''home'', :action => ''index'' > end > > Problem: > I login with a user account and have access to all member-only pages. > Then I access the file upload view, select a local file and press the [Upload] button. > I was supposed to be redirected to /home/index where session[:photo_original_filename] isdisplayed.> However I was redirected to the Login page instead. This was because my authenticate user filterhad> failed when it shouldn''t. > > I figure the session may have changed so I recorded the session_id before and after [Upload]button> was pressed. They were indeed different. > > Next, I remove the enctype="multipart/form-data" part from the form declaration. I perform thesteps> again and was redirected /home/index, as expected (with my current session remained in tact). > > So, I don''t know what the problem is and do hope someone could provide some insight. > > Much appreciated, > > -- Long >--~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---
Hi Long,
this is my personal experience, even if you don''t put _session_id in
any of your form, still the _session_id will be sent as part of each
request
which is stored in the browser side cookies, and these values are of
32-character length, and randomly generated by rails for each success-
full
authorization and they will be used for serialization of "session"
attribute of action_controller under the directory "tmp/sessions/".
This folder contains "ruby-session-#{_session_id}" files which will be
red at each request and de-serialized to populate session hash.
So, since you hard-coded the value of _session_id in your form it
always goto that file which contains this value as part of file name,
which obviously
takes you to a different session than what you usually expect.
On Sep 1, 4:36 am, "Long"
<long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org>
wrote:> Well, I tried a few more things and found the culprit:
>
> <input name="_session_id" type="hidden"
value="f1d1e1d3d6378fdaf05e9dad87c168cf" />
>
> I removed the above line and the file upload work as expected (well
almost). It seems there is
> something quirky with enctype= and _session_id processing.
>
> Bug: params[:photo][:original_filename] should be
params[:photo].original_filename
>
> Hope this will be useful to some for reference.
>
> Cheers,
>
> -- Long
>
>
>
> ----- Original Message -----
> From: "Long"
<long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org>
> To: <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org>
> Sent: Friday, August 31, 2007 12:04 AM
> Subject: [Rails] Lost session with file upload
>
> > I''ve search this group for reports of this problem but
didn''t find anything useful.
>
> > I am doing the following with plain vanilla Rails 1.1.6 running
WEBrick.
>
> > View:
> > <form action="/home/post_photo" method="POST"
enctype="multipart/form-data">
> > <p>Upload photo<br />
> > <input id="_photo" name="photo"
type="file" /><br />
> > <input name="commit" type="submit"
value="Upload" /></p>
> > <input name="obj_id" type="hidden"
value="2" />
> > <input name="_session_id" type="hidden"
value="f1d1e1d3d6378fdaf05e9dad87c168cf" />
> > </form>
>
> > Controller:
> > def post_photo
> > session[:photo_original_filename] =
params[:photo][:original_filename]
> > redirect_to :controller => ''home'', :action
=> ''index''
> > end
>
> > Problem:
> > I login with a user account and have access to all member-only pages.
> > Then I access the file upload view, select a local file and press the
[Upload] button.
> > I was supposed to be redirected to /home/index where
session[:photo_original_filename] is
> displayed.
> > However I was redirected to the Login page instead. This was because
my authenticate user filter
> had
> > failed when it shouldn''t.
>
> > I figure the session may have changed so I recorded the session_id
before and after [Upload]
> button
> > was pressed. They were indeed different.
>
> > Next, I remove the enctype="multipart/form-data" part from
the form declaration. I perform the
> steps
> > again and was redirected /home/index, as expected (with my current
session remained in tact).
>
> > So, I don''t know what the problem is and do hope someone
could provide some insight.
>
> > Much appreciated,
>
> > -- Long
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---
rein.henrichs-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org
2007-Sep-01 18:22 UTC
Re: Lost session with file upload - resolved
If the user agent disables cookies, there''s not much point to trying to use session, is there? Rein On Sep 1, 2:17 pm, "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> wrote:> Hi, > > Sorry I should have written ''Generated View'' instead since it was copied from my Browser using view > source. > > I agree with your point, for browsers with default settings (cookies enabled). However, I don''t > think we can (should) trust browsers to pass cookies in all cases. That was my reason for including > the session id in a hidden field. It works fine for regular forms on browsers with and without > cookies support, and not just with Rails. > > I believe this is a Rails bug (at least in 1.1.6) and hope someone from Rails Core can use what I''ve > document here to investigate further. > > Regards, > > -- Long > > > > ----- Original Message ----- > From: "raghukumar" <raghukumar.r...-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> > To: "Ruby on Rails: Talk" <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> > Sent: Saturday, September 01, 2007 9:30 AM > Subject: [Rails] Re: Lost session with file upload - resolved > > > Hi Long, > > this is my personal experience, even if you don''t put _session_id in > > any of your form, still the _session_id will be sent as part of each > > request > > which is stored in the browser side cookies, and these values are of > > 32-character length, and randomly generated by rails for each success- > > full > > authorization and they will be used for serialization of "session" > > attribute of action_controller under the directory "tmp/sessions/". > > This folder contains "ruby-session-#{_session_id}" files which will be > > red at each request and de-serialized to populate session hash. > > So, since you hard-coded the value of _session_id in your form it > > always goto that file which contains this value as part of file name, > > which obviously > > takes you to a different session than what you usually expect. > > > On Sep 1, 4:36 am, "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> wrote: > > > Well, I tried a few more things and found the culprit: > > > > <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> > > > > I removed the above line and the file upload work as expected (well almost). It seems there is > > > something quirky with enctype= and _session_id processing. > > > > Bug: params[:photo][:original_filename] should be params[:photo].original_filename > > > > Hope this will be useful to some for reference. > > > > Cheers, > > > > -- Long > > > > ----- Original Message ----- > > > From: "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> > > > To: <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> > > > Sent: Friday, August 31, 2007 12:04 AM > > > Subject: [Rails] Lost session with file upload > > > > > I''ve search this group for reports of this problem but didn''t find anything useful. > > > > > I am doing the following with plain vanilla Rails 1.1.6 running WEBrick. > > > > > View: > > > > <form action="/home/post_photo" method="POST" enctype="multipart/form-data"> > > > > <p>Upload photo<br /> > > > > <input id="_photo" name="photo" type="file" /><br /> > > > > <input name="commit" type="submit" value="Upload" /></p> > > > > <input name="obj_id" type="hidden" value="2" /> > > > > <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> > > > > </form> > > > > > Controller: > > > > def post_photo > > > > session[:photo_original_filename] = params[:photo][:original_filename] > > > > redirect_to :controller => ''home'', :action => ''index'' > > > > end > > > > > Problem: > > > > I login with a user account and have access to all member-only pages. > > > > Then I access the file upload view, select a local file and press the [Upload] button. > > > > I was supposed to be redirected to /home/index where session[:photo_original_filename] is > > > displayed. > > > > However I was redirected to the Login page instead. This was because my authenticate user > filter > > > had > > > > failed when it shouldn''t. > > > > > I figure the session may have changed so I recorded the session_id before and after [Upload] > > > button > > > > was pressed. They were indeed different. > > > > > Next, I remove the enctype="multipart/form-data" part from the form declaration. I perform the > > > steps > > > > again and was redirected /home/index, as expected (with my current session remained in tact). > > > > > So, I don''t know what the problem is and do hope someone could provide some insight. > > > > > Much appreciated, > > > > > -- Long--~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---
Hi, Sorry I should have written ''Generated View'' instead since it was copied from my Browser using view source. I agree with your point, for browsers with default settings (cookies enabled). However, I don''t think we can (should) trust browsers to pass cookies in all cases. That was my reason for including the session id in a hidden field. It works fine for regular forms on browsers with and without cookies support, and not just with Rails. I believe this is a Rails bug (at least in 1.1.6) and hope someone from Rails Core can use what I''ve document here to investigate further. Regards, -- Long ----- Original Message ----- From: "raghukumar" <raghukumar.rags-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> To: "Ruby on Rails: Talk" <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> Sent: Saturday, September 01, 2007 9:30 AM Subject: [Rails] Re: Lost session with file upload - resolved> > Hi Long, > this is my personal experience, even if you don''t put _session_id in > any of your form, still the _session_id will be sent as part of each > request > which is stored in the browser side cookies, and these values are of > 32-character length, and randomly generated by rails for each success- > full > authorization and they will be used for serialization of "session" > attribute of action_controller under the directory "tmp/sessions/". > This folder contains "ruby-session-#{_session_id}" files which will be > red at each request and de-serialized to populate session hash. > So, since you hard-coded the value of _session_id in your form it > always goto that file which contains this value as part of file name, > which obviously > takes you to a different session than what you usually expect. > > > > On Sep 1, 4:36 am, "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> wrote: > > Well, I tried a few more things and found the culprit: > > > > <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> > > > > I removed the above line and the file upload work as expected (well almost). It seems there is > > something quirky with enctype= and _session_id processing. > > > > Bug: params[:photo][:original_filename] should be params[:photo].original_filename > > > > Hope this will be useful to some for reference. > > > > Cheers, > > > > -- Long > > > > > > > > ----- Original Message ----- > > From: "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> > > To: <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> > > Sent: Friday, August 31, 2007 12:04 AM > > Subject: [Rails] Lost session with file upload > > > > > I''ve search this group for reports of this problem but didn''t find anything useful. > > > > > I am doing the following with plain vanilla Rails 1.1.6 running WEBrick. > > > > > View: > > > <form action="/home/post_photo" method="POST" enctype="multipart/form-data"> > > > <p>Upload photo<br /> > > > <input id="_photo" name="photo" type="file" /><br /> > > > <input name="commit" type="submit" value="Upload" /></p> > > > <input name="obj_id" type="hidden" value="2" /> > > > <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> > > > </form> > > > > > Controller: > > > def post_photo > > > session[:photo_original_filename] = params[:photo][:original_filename] > > > redirect_to :controller => ''home'', :action => ''index'' > > > end > > > > > Problem: > > > I login with a user account and have access to all member-only pages. > > > Then I access the file upload view, select a local file and press the [Upload] button. > > > I was supposed to be redirected to /home/index where session[:photo_original_filename] is > > displayed. > > > However I was redirected to the Login page instead. This was because my authenticate userfilter> > had > > > failed when it shouldn''t. > > > > > I figure the session may have changed so I recorded the session_id before and after [Upload] > > button > > > was pressed. They were indeed different. > > > > > Next, I remove the enctype="multipart/form-data" part from the form declaration. I perform the > > steps > > > again and was redirected /home/index, as expected (with my current session remained in tact). > > > > > So, I don''t know what the problem is and do hope someone could provide some insight. > > > > > Much appreciated, > > > > > -- Long >--~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---
Sure, if there is a will there is a way... ;-) http://edgesoft.ca/blog/read/2 - No-Cookie Session Support plugin -- Long ----- Original Message ----- From: <rein.henrichs-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> To: "Ruby on Rails: Talk" <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> Sent: Saturday, September 01, 2007 1:22 PM Subject: [Rails] Re: Lost session with file upload - resolved> > If the user agent disables cookies, there''s not much point to trying > to use session, is there? > > Rein > > On Sep 1, 2:17 pm, "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> wrote: > > Hi, > > > > Sorry I should have written ''Generated View'' instead since it was copied from my Browser usingview> > source. > > > > I agree with your point, for browsers with default settings (cookies enabled). However, I don''t > > think we can (should) trust browsers to pass cookies in all cases. That was my reason forincluding> > the session id in a hidden field. It works fine for regular forms on browsers with and without > > cookies support, and not just with Rails. > > > > I believe this is a Rails bug (at least in 1.1.6) and hope someone from Rails Core can use whatI''ve> > document here to investigate further. > > > > Regards, > > > > -- Long > > > > > > > > ----- Original Message ----- > > From: "raghukumar" <raghukumar.r...-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> > > To: "Ruby on Rails: Talk" <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> > > Sent: Saturday, September 01, 2007 9:30 AM > > Subject: [Rails] Re: Lost session with file upload - resolved > > > > > Hi Long, > > > this is my personal experience, even if you don''t put _session_id in > > > any of your form, still the _session_id will be sent as part of each > > > request > > > which is stored in the browser side cookies, and these values are of > > > 32-character length, and randomly generated by rails for each success- > > > full > > > authorization and they will be used for serialization of "session" > > > attribute of action_controller under the directory "tmp/sessions/". > > > This folder contains "ruby-session-#{_session_id}" files which will be > > > red at each request and de-serialized to populate session hash. > > > So, since you hard-coded the value of _session_id in your form it > > > always goto that file which contains this value as part of file name, > > > which obviously > > > takes you to a different session than what you usually expect. > > > > > On Sep 1, 4:36 am, "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> wrote: > > > > Well, I tried a few more things and found the culprit: > > > > > > <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> > > > > > > I removed the above line and the file upload work as expected (well almost). It seems thereis> > > > something quirky with enctype= and _session_id processing. > > > > > > Bug: params[:photo][:original_filename] should be params[:photo].original_filename > > > > > > Hope this will be useful to some for reference. > > > > > > Cheers, > > > > > > -- Long > > > > > > ----- Original Message ----- > > > > From: "Long" <long...-bJEeYj9oJeDQT0dZR+AlfA@public.gmane.org> > > > > To: <rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org> > > > > Sent: Friday, August 31, 2007 12:04 AM > > > > Subject: [Rails] Lost session with file upload > > > > > > > I''ve search this group for reports of this problem but didn''t find anything useful. > > > > > > > I am doing the following with plain vanilla Rails 1.1.6 running WEBrick. > > > > > > > View: > > > > > <form action="/home/post_photo" method="POST" enctype="multipart/form-data"> > > > > > <p>Upload photo<br /> > > > > > <input id="_photo" name="photo" type="file" /><br /> > > > > > <input name="commit" type="submit" value="Upload" /></p> > > > > > <input name="obj_id" type="hidden" value="2" /> > > > > > <input name="_session_id" type="hidden" value="f1d1e1d3d6378fdaf05e9dad87c168cf" /> > > > > > </form> > > > > > > > Controller: > > > > > def post_photo > > > > > session[:photo_original_filename] = params[:photo][:original_filename] > > > > > redirect_to :controller => ''home'', :action => ''index'' > > > > > end > > > > > > > Problem: > > > > > I login with a user account and have access to all member-only pages. > > > > > Then I access the file upload view, select a local file and press the [Upload] button. > > > > > I was supposed to be redirected to /home/index where session[:photo_original_filename] is > > > > displayed. > > > > > However I was redirected to the Login page instead. This was because my authenticate user > > filter > > > > had > > > > > failed when it shouldn''t. > > > > > > > I figure the session may have changed so I recorded the session_id before and after[Upload]> > > > button > > > > > was pressed. They were indeed different. > > > > > > > Next, I remove the enctype="multipart/form-data" part from the form declaration. I performthe> > > > steps > > > > > again and was redirected /home/index, as expected (with my current session remained intact).> > > > > > > So, I don''t know what the problem is and do hope someone could provide some insight. > > > > > > > Much appreciated, > > > > > > > -- Long > > > >--~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org To unsubscribe from this group, send email to rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---