3131#include < TWebApplication>
3232#include < QStringEncoder>
3333
34- const QString FLASH_VARS_SESSION_KEY (" _flashVariants" );
34+ const QString QUEUED_FLASH_SESSION_KEY (" _flashVariants" );
35+ const QString FLASH_VARS_SESSION_KEY (" _activeFlash" );
3536const QString LOGIN_USER_NAME_KEY (" _loginUserName" );
3637const QByteArray DEFAULT_CONTENT_TYPE (" text/html" );
3738
@@ -207,7 +208,11 @@ void TActionController::setCsrfProtectionInto(TSession &session)
207208{
208209 if (TSessionManager::instance ().storeType () == QLatin1String (" cookie" )) {
209210 QString key = TSessionManager::instance ().csrfProtectionKey ();
210- session.insert (key, TSessionManager::instance ().generateId ()); // it's just a random value
211+ QByteArray val = session.value (key).toByteArray ();
212+
213+ if (val.isEmpty ()) {
214+ session.insert (key, TSessionManager::instance ().generateId ()); // it's just a random value
215+ }
211216 }
212217}
213218
@@ -248,6 +253,7 @@ QString TActionController::loginUserNameKey()
248253bool TActionController::verifyRequest (const THttpRequest &request) const
249254{
250255 if (!csrfProtectionEnabled ()) {
256+ tSystemWarn (" Skipped verifying authenticity token : {}" , request.header ().path ().data ());
251257 return true ;
252258 }
253259
@@ -263,7 +269,11 @@ bool TActionController::verifyRequest(const THttpRequest &request) const
263269 }
264270
265271 tSystemDebug (" postAuthToken: {}" , (const char *)postAuthToken.data ());
266- return Tf::strcmp (postAuthToken, authenticityToken ());
272+ bool res = Tf::strcmp (postAuthToken, authenticityToken ());
273+ if (res) {
274+ tSystemDebug (" Verified authenticity token : {}" , request.header ().path ().data ());
275+ }
276+ return res;
267277}
268278
269279/* !
@@ -595,7 +605,7 @@ void TActionController::redirect(const QUrl &url, int statusCode)
595605 // Enable flash-variants
596606 QVariant var;
597607 var.setValue (_flashVars);
598- _sessionStore.insert (FLASH_VARS_SESSION_KEY , var);
608+ _sessionStore.insert (QUEUED_FLASH_SESSION_KEY , var);
599609}
600610
601611/* !
@@ -655,12 +665,39 @@ bool TActionController::sendData(const QByteArray &data, const QByteArray &conte
655665*/
656666void TActionController::exportAllFlashVariants ()
657667{
658- QVariant var = _sessionStore.take (FLASH_VARS_SESSION_KEY);
668+ _sessionStore.remove (FLASH_VARS_SESSION_KEY);
669+
670+ QVariant var = _sessionStore.take (QUEUED_FLASH_SESSION_KEY);
659671 if (!var.isNull ()) {
660672 exportVariants (var.toMap ());
673+ _sessionStore.insert (FLASH_VARS_SESSION_KEY, var);
661674 }
662675}
663676
677+
678+ QVariantMap TActionController::flashVariants () const
679+ {
680+ return _sessionStore.value (FLASH_VARS_SESSION_KEY).toMap ();
681+ }
682+
683+
684+ QVariant TActionController::flashVariant (const QString &key) const
685+ {
686+ return _sessionStore.value (FLASH_VARS_SESSION_KEY).toMap ().value (key);
687+ }
688+
689+
690+ QJsonObject TActionController::flashVariantsJson () const
691+ {
692+ return QJsonObject::fromVariantMap (flashVariants ());
693+ }
694+
695+
696+ QJsonObject TActionController::flashVariantJson (const QString &key) const
697+ {
698+ return QJsonObject::fromVariantMap (flashVariant (key).toMap ());
699+ }
700+
664701/* !
665702 Validates the access of the user \a user. Returns true if the user
666703 access is allowed by rule; otherwise returns false.
0 commit comments