@@ -4,7 +4,8 @@ class ApplicationController < ActionController::Base
44 helper :all
55 protect_from_forgery
66
7- before_filter :initialize_session , :set_session_timestamp , :record_action , :view_filter , :set_pairwise_credentials , :set_locale , :set_p3p_header
7+ before_filter :initialize_session , :get_survey_session , :record_action , :view_filter , :set_pairwise_credentials , :set_locale , :set_p3p_header
8+ after_filter :write_survey_session_cookie
89
910 # preprocess photocracy_view_path on boot because
1011 # doing pathset generation during a request is very costly.
@@ -30,13 +31,6 @@ def set_pairwise_credentials
3031
3132 def initialize_session
3233 session [ :session_id ] # this forces load of the session in Rails 2.3.x
33- if signed_in?
34- logger . info "current user is #{ current_user . inspect }
35- end
36-
37- if white_label_request?
38- logger . info "white_label request - no header and footer displayed"
39- end
4034 end
4135
4236 helper_method :white_label_request?
@@ -60,19 +54,85 @@ def show_aoi_nav?
6054 # called when the request is not verified via the authenticity_token
6155 def handle_unverified_request
6256 super
63- raise ( ActionController ::InvalidAuthenticityToken )
57+ # Appearance_lookup can act like an authenticity token because
58+ # get_survey_session will raise an error if no cookie found with proper appearance_lookup
59+ raise ( ActionController ::InvalidAuthenticityToken ) unless params [ :appearance_lookup ]
6460 end
6561
66- def set_session_timestamp
67- # ActiveResource::HttpMock only matches static strings for query parameters
68- # when in test set this to a static value, so we can match the resulting API queries for mocking
69- request . session_options [ :id ] = "test123" if Rails . env == "test"
70- expiration_time = session [ :expiration_time ]
71- if expiration_time && expiration_time < Time . now || session [ :session_id ] . nil?
72- session [ :session_id ] = ActiveSupport ::SecureRandom . hex ( 16 )
73- request . session_options [ :id ] = session [ :session_id ]
62+ # This method sets question_id based on the URL and parameters of the request
63+ # We want to know the question_id early in the request process because we
64+ # use it to determine the proper session for this request.
65+ #
66+ # The different controller / actions have differing ways of determining the
67+ # question_id. Some are only passed the Earl.name, while others get the
68+ # question_id directly as a parameter.
69+ #
70+ # Some requests like the homepage will have @question_id = nil. This is
71+ # okay as they don't pass any session information to pairwise. A separate
72+ # session is kept for requests that have no question_id.
73+ def set_question_id_earl
74+ @question_id = nil
75+ if [ controller_name , action_name ] == [ 'earls' , 'show' ]
76+ @earl = Earl . find_by_name ( params [ :id ] )
77+ @question_id = @earl . try ( :question_id )
78+ elsif controller_name == 'prompts'
79+ @question_id = params [ :question_id ]
80+ elsif controller_name == 'questions'
81+ if [ 'add_idea' , 'visitor_voting_history' ] . include? ( action_name )
82+ @question_id = params [ :id ]
83+ elsif [ 'results' , 'about' , 'admin' , 'update_name' ] . include? ( action_name )
84+ @earl = Earl . find_by_name ( params [ :id ] )
85+ @question_id = @earl . try ( :question_id )
86+ end
87+ elsif controller_name == 'choices'
88+ if action_name == 'toggle'
89+ @earl = Earl . find ( params [ :earl_id ] )
90+ else
91+ @earl = Earl . find_by_name ( params [ :question_id ] )
92+ end
93+ @question_id = @earl . try ( :question_id )
7494 end
75- session [ :expiration_time ] = 10 . minutes . from_now
95+ end
96+
97+ # Called as a before_filter.
98+ def get_survey_session
99+ # First order of business is to set the question_id.
100+ set_question_id_earl
101+
102+ begin
103+ # Based on the cookies, question_id, and appearance_lookup, find the
104+ # proper session for this request.
105+ session_data = SurveySession . find ( cookies , @question_id , params [ :appearance_lookup ] )
106+ rescue CantFindSessionFromCookies => e
107+ # if no appearance_lookup, then we can safely create a new sesssion
108+ # otherwise this request ought to fail as they are attempting some action
109+ # without the proper session being found
110+ if params [ :appearance_lookup ] . nil?
111+ session_data = [ { :question_id => @question_id } ]
112+ else
113+ raise e
114+ end
115+ end
116+ # Create new SurveySession object for this request.
117+ @survey_session = SurveySession . send ( :new , *session_data )
118+ if @survey_session . expired?
119+ # This will regenerate the session_id, saving the old one.
120+ # We can send along both the new and old session_id to pairwise
121+ # for requests that have sessions that have expired.
122+ @survey_session . regenerate
123+ end
124+
125+ # We want the session to expire after X minutes of inactivity, so update
126+ # the expiry with every request.
127+ @survey_session . update_expiry
128+ end
129+
130+ # Called as a after_filter to ensure we pass along the updated survey session
131+ # cookie in the response to this request.
132+ def write_survey_session_cookie
133+ cookies [ @survey_session . cookie_name ] = {
134+ :value => @survey_session . cookie_value
135+ }
76136 end
77137
78138 def record_action
@@ -88,7 +148,7 @@ def record_action
88148 end
89149
90150 visitor = Visitor . find_or_create_by_remember_token ( :remember_token => visitor_remember_token )
91- user_session = SessionInfo . find_or_create_by_session_id ( :session_id => request . session_options [ :id ] ,
151+ user_session = SessionInfo . find_or_create_by_session_id ( :session_id => @survey_session . session_id ,
92152 :ip_addr => request . remote_ip ,
93153 :user_agent => request . env [ "HTTP_USER_AGENT" ] ,
94154 :white_label_request => white_label_request? ,
@@ -103,13 +163,6 @@ def record_action
103163 user_session . save!
104164 end
105165
106- if current_user
107- logger . info "CLICKSTREAM: #{ controller_name } #{ action_name } #{ request . session_options [ :id ] } #{ current_user . email }
108- else
109- logger . info "CLICKSTREAM: #{ controller_name } #{ action_name } #{ request . session_options [ :id ] }
110- end
111- # Click.create( :sid => request.session_options[:id], :ip_addr => request.remote_ip, :url => request.url,
112- # :controller => controller_name, :action => action_name, :user => nil, :referrer => request.referrer)
113166 if ( session [ :abingo_identity ] )
114167 Abingo . identity = session [ :abingo_identity ]
115168 else
0 commit comments