plone.session-2.1 patch - secure

diff --exclude='*.pyc' --exclude='*.svn' -rupN plone.session-2.1/plone/session/interfaces.py plone.session/plone/session/interfaces.py--- plone.session-2.1/plone/session/interfaces.py	2009-02-04 23:22:36.000000000 +0000+++ plone.session/plone/session/interfaces.py	2009-10-20 15:31:16.000000000 +0100@@ -5,7 +5,7 @@ class ISessionPlugin(Interface):     Session handling PAS plugin.     """ -    def setupSession(userid, response):+    def setupSession(userid, response, request):         """         Start a new session for a userid. The session will last until         PAS indicates that the user has logged out.diff --exclude='*.pyc' --exclude='*.svn' -rupN plone.session-2.1/plone/session/plugins/session.py plone.session/plone/session/plugins/session.py--- plone.session-2.1/plone/session/plugins/session.py	2009-02-04 23:22:36.000000000 +0000+++ plone.session/plone/session/plugins/session.py	2009-10-22 15:00:25.000000000 +0100@@ -1,4 +1,5 @@-from DateTime import DateTime+# Add option to set secure bit for all session cookies sent over https+ from Products.PageTemplates.PageTemplateFile import PageTemplateFile from Products.PluggableAuthService.plugins.BasePlugin import BasePlugin from Products.PluggableAuthService.utils import classImplements@@ -23,9 +24,9 @@ from Products.PluggableAuthService.permi manage_addSessionPluginForm = PageTemplateFile('session', globals())      -def manage_addSessionPlugin(dispatcher, id, title=None, path='/', REQUEST=None):+def manage_addSessionPlugin(dispatcher, id, title=None, path='/', REQUEST=None, secure=True):     """Add a session plugin."""-    sp=SessionPlugin(id, title=title, path=path)+    sp=SessionPlugin(id, title=title, path=path, secure=secure)     dispatcher._setObject(id, sp)      if REQUEST is not None:@@ -42,7 +43,6 @@ class SessionPlugin(BasePlugin):     meta_type = "Plone Session Plugin"     security = ClassSecurityInfo()     cookie_name = "__ac"-    cookie_lifetime = 0      _properties = (             {@@ -57,18 +57,13 @@ class SessionPlugin(BasePlugin):                 "type"  : "string",                 "mode"  : "w",             },-            {-                "id"    : "cookie_lifetime",-                "label" : "Cookie lifetime (in days)",-                "type"  : "int",-                "mode"  : "w",-            },             ) -    def __init__(self, id, title=None, path="/"):+    def __init__(self, id, title=None, path="/", secure=True):         self._setId(id)         self.title=title         self.path=path+        self.secure=secure      @property     def source(self):@@ -89,16 +84,29 @@ class SessionPlugin(BasePlugin):       # ISessionPlugin implementation-    security.declareProtected(ManageUsers, 'setupSession')-    def setupSession(self, userid, response):+    def setupSession(self, userid, response, request):+        #self.plone_log('setupSession: START')+                 cookie=self.source.createIdentifier(userid)         cookie=binascii.b2a_base64(cookie).rstrip()--        if isinstance(self.cookie_lifetime, int) and self.cookie_lifetime:-            expires = (DateTime() + self.cookie_lifetime).toZone('GMT').rfc822()-            response.setCookie(self.cookie_name, cookie, path=self.path, expires=expires)+        secure = False+         +        if self.secure:++            s_url = request.get('SERVER_URL', None)+            +            #self.plone_log("setupSession: SERVER_URL: %s" % s_url)+            +            #Only set secure bit of cookie if currently over https+            if s_url is not None and s_url.startswith('https'):+                secure = True+        +        if secure:+            response.setCookie(self.cookie_name, cookie, path=self.path, secure=True)         else:             response.setCookie(self.cookie_name, cookie, path=self.path)+            +        #self.plone_log('setupSession: END')       # IExtractionPlugin implementation@@ -139,11 +147,16 @@ class SessionPlugin(BasePlugin):      # ICredentialsUpdatePlugin implementation     def updateCredentials(self, request, response, login, new_password):+        #self.plone_log('updateCredentials: START')+                 pas=self._getPAS()         info=pas._verifyUser(pas.plugins, login=login)         if info is not None:             # Only setup a session for users in our own user folder.-            self.setupSession(info["id"], response)+            self.setupSession(info["id"], response, request)+            +        #self.plone_log('updateCredentials: END')+           # ICredentialsResetPlugin implementationdiff --exclude='*.pyc' --exclude='*.svn' -rupN plone.session-2.1/plone/session/plugins/session.zpt plone.session/plone/session/plugins/session.zpt--- plone.session-2.1/plone/session/plugins/session.zpt	2009-02-04 23:22:36.000000000 +0000+++ plone.session/plone/session/plugins/session.zpt	2009-10-20 16:10:48.000000000 +0100@@ -42,6 +42,16 @@     </tr>     <tr>       <td align="left" valign="top">+        <div class="form-optional">+          Cookie Secure+        </div>+      </td>+      <td align="left" valign="top">+        <input type="checkbox" name="secure:boolean" checked="1" />+      </td>+    </tr>        +    <tr>+      <td align="left" valign="top">       </td>       <td align="left" valign="top">         <div class="form-element">