X-Git-Url: http://wagnertech.de/gitweb/gitweb.cgi/mfinanz.git/blobdiff_plain/0a612d2fe7ec14c9ed3f7d0d036e1c63d3027f4f..dfb76ebf04df9aed8ba63d7b51bc558d2928030e:/SL/Auth.pm

diff --git a/SL/Auth.pm b/SL/Auth.pm
index fd3bb0326..7e46c125e 100644
--- a/SL/Auth.pm
+++ b/SL/Auth.pm
@@ -511,11 +511,8 @@ sub restore_session {
 
   my $self = shift;
 
-  my $cgi            =  $main::cgi;
-  $cgi             ||=  CGI->new('');
-
-  $session_id        =  $cgi->cookie($self->get_session_cookie_name());
-  $session_id        =~ s|[^0-9a-f]||g;
+  $session_id        =  $::request->{cgi}->cookie($self->get_session_cookie_name());
+  $session_id        =~ s|[^0-9a-f]||g if $session_id;
 
   $self->{SESSION}   = { };
 
@@ -528,10 +525,24 @@ sub restore_session {
 
   $form   = $main::form;
 
-  $dbh    = $self->dbconnect();
+  # Don't fail if the auth DB doesn't yet.
+  if (!( $dbh = $self->dbconnect(1) )) {
+    $::lxdebug->leave_sub;
+    return SESSION_NONE;
+  }
+
+  # Don't fail if the "auth" schema doesn't exist yet, e.g. if the
+  # admin is creating the session tables at the moment.
   $query  = qq|SELECT *, (mtime < (now() - '$self->{session_timeout}m'::interval)) AS is_expired FROM auth.session WHERE id = ?|;
 
-  $cookie = selectfirst_hashref_query($form, $dbh, $query, $session_id);
+  if (!($sth = $dbh->prepare($query)) || !$sth->execute($session_id)) {
+    $sth->finish if $sth;
+    $::lxdebug->leave_sub;
+    return SESSION_NONE;
+  }
+
+  $cookie = $sth->fetchrow_hashref;
+  $sth->finish;
 
   if (!$cookie || $cookie->{is_expired} || ($cookie->{ip_address} ne $ENV{REMOTE_ADDR})) {
     $self->destroy_session();
@@ -706,7 +717,13 @@ sub save_session {
 
   $dbh->begin_work unless $provided_dbh;
 
-  do_query($::form, $dbh, qq|LOCK auth.session_content|);
+  # If this fails then the "auth" schema might not exist yet, e.g. if
+  # the admin is just trying to create the auth database.
+  if (!$dbh->do(qq|LOCK auth.session_content|)) {
+    $dbh->rollback unless $provided_dbh;
+    $::lxdebug->leave_sub;
+    return;
+  }
 
   my @unfetched_keys = map     { $_->{key}        }
                        grep    { ! $_->{fetched}  }
@@ -815,12 +832,15 @@ sub create_unique_sesion_value {
   my $key                   = "$$-" . ($now[0] * 1000000 + $now[1]) . "-";
   $self->{unique_counter} ||= 0;
 
-  $self->{unique_counter}++ while exists $self->{SESSION}->{$key . ($self->{unique_counter} + 1)};
-  $self->{unique_counter}++;
+  my $hashed_key;
+  do {
+    $self->{unique_counter}++;
+    $hashed_key = md5_hex($key . $self->{unique_counter});
+  } while (exists $self->{SESSION}->{$hashed_key});
 
-  $self->set_session_value($key . $self->{unique_counter} => $value);
+  $self->set_session_value($hashed_key => $value);
 
-  return $key . $self->{unique_counter};
+  return $hashed_key;
 }
 
 sub save_form_in_session {