Bug #17736 for CGI-Application-FastCGI: Issue of persistent object of CGI::App

Sat Feb 18 22:23:53 2006 Guest - Ticket created

Subject:

Issue of persistent object of CGI::App

CGI::App は、作られたオブジェクトが永続的に使われることを必ずしも前提にしてないので、$self->param(foo=>'bar') や $self->{foo} = 'bar' と実行した場合、CA::FastCGI では、それらが永続的に残ってしまいますよね。これですと、はじめて CGI::App で FastCGI をやる人が混乱すると思うので、リクエスト毎に CGI::App オブジェクトを生成するように変更してはどうでしょうか？ The CGI::App does not specify that its object exists persistently. So if new pair is assigned into $self->param() ( for instance $self->param(foo=>'bar') ), it will also exist persistently. And it may cause some problem. Therefore I think the module should be changed to create a object of CGI::App for every single request. Cheers, Yuji Maeda

Mon Oct 09 11:06:44 2006 sven-bitcard [...] sven.de - Correspondence added

From:

sven-bitcard [...] sven.de

I agree. As a workaround, applications can do the following in cgiapp_prerun: $self->{__PARAMS} = {}; $self->header_type('header'); $self->header_props( {} ); Other missing initialisations are: * run_modes() * start_mode() * tmpl_path() * error_mode() * mode_param() These are typically set only once in setup() so they shouldn't be a problem.

Mon Oct 09 11:06:46 2006 The RT System itself - Status changed from 'new' to 'open'

Mon Oct 09 11:08:47 2006 sven-bitcard [...] sven.de - Correspondence added

From:

sven-bitcard [...] sven.de

On Mo. 09. Okt. 2006, 11:06:44, neuhaus wrote: Show quoted text

> As a workaround, applications can do the following in cgiapp_prerun: > > $self->{__PARAMS} = {}; > $self->header_type('header'); > $self->header_props( {} );

The fix for CGI::Application::FastCGI would be to include at least these 3 lines in the sub reset_query().

Sun Jun 17 04:43:09 2012 FANY [...] cpan.org - Correspondence added

On Mon Oct 9th 2006, 11:08:47, neuhaus wrote: Show quoted text

> The fix for CGI::Application::FastCGI would be to include at least > these 3 lines in the sub reset_query().

Unfortunately this would not solve the problem in conjunction with CGI::Application plugins which rely on getting a new CGI::Application instance upon each request. E. g., you run into severe security issues when using CGI::Application::Plugin::Authentication, where you would have to do something like … delete @{ $self->authen }{qw/initialized is_new_login store/}; … between requests in order to avoid that person B gets the authentication cookie from person A who has just logged in, among similar phenomena. But that is still only an example for _one_ plugin. In the meantime, there was a discussion on the CGI::Application mailing list about this topic (http://www.mail-archive.com/cgiapp@lists.erlbaum.net/msg08997.html ff.), and as far as I understand, it boils down to that you simply should not use the same CGI::Application object for more than one request. Remedy: See http://www.cgi-app.org/index.cgi?FastCGI fany