From 11f5a159a7f2a274ab0d091641da4b4afe15ef2b Mon Sep 17 00:00:00 2001 From: Toshi MARUYAMA Date: Thu, 1 May 2014 01:55:03 +0000 Subject: [PATCH] Merged r13110 and r13112 from trunk to 2.4-stable (#16685) introduce request_store to ensure that the current user doesn't leak across request boundaries. Contributed by Holger Just. git-svn-id: http://svn.redmine.org/redmine/branches/2.4-stable@13114 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- Gemfile | 1 + app/models/user.rb | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/Gemfile b/Gemfile index c17842235..37f0b668a 100644 --- a/Gemfile +++ b/Gemfile @@ -6,6 +6,7 @@ gem "jquery-rails", "~> 2.0.2" gem "coderay", "~> 1.1.0" gem "fastercsv", "~> 1.5.0", :platforms => [:mri_18, :mingw_18, :jruby] gem "builder", "3.0.0" +gem "request_store" # Optional gem for LDAP authentication group :ldap do diff --git a/app/models/user.rb b/app/models/user.rb index 9a20c4c67..827553fc7 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -607,11 +607,11 @@ class User < Principal end def self.current=(user) - Thread.current[:current_user] = user + RequestStore.store[:current_user] = user end def self.current - Thread.current[:current_user] ||= User.anonymous + RequestStore.store[:current_user] ||= User.anonymous end # Returns the anonymous user. If the anonymous user does not exist, it is created. There can be only