Roxen.git/ server/ base_server/ roxen.pike

2002-06-13

2002-06-13 11:34:13 by Jonas Wallden <jonasw@roxen.com>

• 000ae23c198a87cb9095e6192222c4485f6824d2 (11 lines) (+10/-1) ^{[ Show | Annotate ]}
  Branch: 5.2

Making image cache results cacheable over https sessions also polluted the
protocol-level cache in a way where images requiring authentication could
be leaked.

Rev: server/base_server/roxen.pike:1.796

6:   // Per Hedbor, Henrik Grubbström, Pontus Hagland, David Hedbor and others.   // ABS and suicide systems contributed freely by Francesco Chemolli    - constant cvs_version="$Id: roxen.pike,v 1.795 2002/05/08 13:08:34 jonasw Exp $"; + constant cvs_version="$Id: roxen.pike,v 1.796 2002/06/13 11:34:13 jonasw Exp $";      // The argument cache. Used by the image cache.   ArgCache argcache;
2967:    error("Draw callback did not generate any data\n");    }    res->stat = ({ 0, 0, 0, 900000000, 0, 0, 0, 0, 0 }); +  +  // Setting the cacheable flag is done in order to get headers sent which +  // cause the image to be cached in the client even when using https +  // sessions. However, this flag also controls whether the file should +  // be placed in the protocol-level cache, so we'll counter by destroying +  // the cache key if the request is authorized so this is avoided.    id->misc->cacheable = INITIAL_CACHEABLE; -  +  if (id->rawauth) +  id->misc->cachekey = 0;    return res;    }