From ceaa1dd337f649d583802e8a7618ff7d0cfd28e7 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Tue, 18 Feb 2020 16:04:34 +0100 Subject: [PATCH] file-store: don't response with cookies on file-store download. --- rhodecode/apps/file_store/views.py | 3 +++ rhodecode/lib/rc_beaker.py | 8 ++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/rhodecode/apps/file_store/views.py b/rhodecode/apps/file_store/views.py index 2781a173..0812dd7a 100644 --- a/rhodecode/apps/file_store/views.py +++ b/rhodecode/apps/file_store/views.py @@ -93,6 +93,9 @@ class FileStoreView(BaseAppView): file_path = self.storage.store_path(file_uid) return FileResponse(file_path) + # For file store we don't submit any session data, this logic tells the + # Session lib to skip it + setattr(self.request, '_file_response', True) @LoginRequired() @NotAnonymous() diff --git a/rhodecode/lib/rc_beaker.py b/rhodecode/lib/rc_beaker.py index 404c53cb..95c6a3ae 100644 --- a/rhodecode/lib/rc_beaker.py +++ b/rhodecode/lib/rc_beaker.py @@ -32,10 +32,14 @@ def BeakerSessionFactoryConfig(**options): def session_callback(request, response): exception = getattr(request, 'exception', None) - if (exception is None or self._cookie_on_exception) and self.accessed(): + file_response = getattr(request, '_file_response', None) + + if file_response is None \ + and (exception is None or self._cookie_on_exception) \ + and self.accessed(): self.persist() headers = self.__dict__['_headers'] - if headers['set_cookie'] and headers['cookie_out']: + if headers.get('set_cookie') and headers.get('cookie_out'): response.headerlist.append(('Set-Cookie', headers['cookie_out'])) request.add_response_callback(session_callback)