From 9c7a3604527ea467266ae1fbd427ea2c6f83af3d Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Thu, 09 Feb 2012 19:56:58 -0500
Subject: [PATCH] Documented overriding default log4j configuration (issue 53)
---
src/com/gitblit/wicket/pages/BasePage.java | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/src/com/gitblit/wicket/pages/BasePage.java b/src/com/gitblit/wicket/pages/BasePage.java
index 80bff16..ca94007 100644
--- a/src/com/gitblit/wicket/pages/BasePage.java
+++ b/src/com/gitblit/wicket/pages/BasePage.java
@@ -80,7 +80,10 @@
// Login the user
if (user != null) {
// Set the user into the session
- GitBlitWebSession.get().setUser(user);
+ GitBlitWebSession session = GitBlitWebSession.get();
+ // issue 62: fix session fixation vulnerability
+ session.replaceSession();
+ session.setUser(user);
// Set Cookie
WebResponse response = (WebResponse) getRequestCycle().getResponse();
--
Gitblit v1.9.1