Skip to content

Conversation

@flovilmart
Copy link
Contributor

No description provided.

@flovilmart flovilmart changed the title Adds tests Fixes issue #4150: Session management Sep 12, 2017
@codecov
Copy link

codecov bot commented Sep 12, 2017

Codecov Report

Merging #4152 into master will increase coverage by 0.04%.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #4152      +/-   ##
==========================================
+ Coverage   92.13%   92.17%   +0.04%     
==========================================
  Files         116      116              
  Lines        8044     8051       +7     
==========================================
+ Hits         7411     7421      +10     
+ Misses        633      630       -3
Impacted Files Coverage Δ
src/RestWrite.js 93.16% <100%> (+0.46%) ⬆️
src/Push/PushWorker.js 95.08% <0%> (+1.63%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ba0a51d...5cc266b. Read the comment docs.

@miguel-s
Copy link
Contributor

Hi @flovilmart

We have been testing this fix on our own server and have found two things:

  1. it successfully blocks updating of sessions (with PUT)
  2. it does not prevent creating new sessions with a different user object (with POST). As far as we can see the user pointer saved in sessionData gets accidentally overwritten with the user pointer in the request data in the for-loop on line 673. To fix this issue we have added the user key to the if condition on line 674 like this if (key === 'objectId' || key === 'user').

With your fix and this change we are unable to reproduce issue #4150.

@flovilmart
Copy link
Contributor Author

@miguel-s thanks for debunking it, do you wanna make a PR on my PR with the additional tests so we can merge it?

* add tests

* provide fix

* remove console.log
@flovilmart flovilmart requested a review from acinader September 16, 2017 00:33
@flovilmart
Copy link
Contributor Author

Thanks @miguel-s , I'll let @acinader give the final review OK :)

@flovilmart flovilmart requested a review from a team September 16, 2017 14:08
@flovilmart
Copy link
Contributor Author

flovilmart commented Sep 17, 2017

@natanrolnik , can you have a look?

user: Parse._encode(user)
}
})
}).then(done).catch(done.fail);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you don't need the catch after the done since you catch up a level....

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

right it was just to be safe, I can remove.

@flovilmart flovilmart merged commit a39d045 into master Sep 18, 2017
@flovilmart flovilmart deleted the fix/4150-sessions branch September 18, 2017 18:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants