Ticket #2750: fixes to HTTP caching behavior across login/logout boundaries

* now ignoring if-modified-since if we failed an etag if-none-match comparison, per spec
* now including a hash of user id/nickname in most etags, so we'll update the view properly after login/logout

For API methods, checking the API-auth'ed user. (Many change results to include things like 'you're subscribed to this user' or 'this is one of your favorites', so user info is again needed)

There'll still be some last-modified stamps that aren't including user info properly, probably.

diff --git a/actions/apidirectmessage.php b/actions/apidirectmessage.php
index 7a0f46274cbde24478e222da8bdcbbce2bd50f1a..e7ea38dfa1caad26cd40ed9337044d5243c9589f 100644 (file)
--- a/actions/apidirectmessage.php
+++ b/actions/apidirectmessage.php
@@ -357,6 +357,7 @@ class ApiDirectMessageAction extends ApiAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       strtotime($this->messages[0]->created),
                       strtotime($this->messages[$last]->created)

diff --git a/actions/apigrouplist.php b/actions/apigrouplist.php
index 148c802f43b297ecb952e0ea6b759d466f1e45c4..319a1e424d3c15285df9921ddcdb74a7f1d71fc4 100644 (file)
--- a/actions/apigrouplist.php
+++ b/actions/apigrouplist.php
@@ -213,6 +213,7 @@ class ApiGroupListAction extends ApiBareAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->user->id,
                       strtotime($this->groups[0]->created),

diff --git a/actions/apigrouplistall.php b/actions/apigrouplistall.php
index a8317608d7feed0d8cec4125bbc13f6650f00093..cc7cd901dcfe052c1307e20c061a3a6205758b92 100644 (file)
--- a/actions/apigrouplistall.php
+++ b/actions/apigrouplistall.php
@@ -204,6 +204,7 @@ class ApiGroupListAllAction extends ApiPrivateAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       strtotime($this->groups[0]->created),
                       strtotime($this->groups[$last]->created))

diff --git a/actions/apigroupmembership.php b/actions/apigroupmembership.php
index ffd5c7c7d572ca0226ee9723026362475f839d80..b7f3064b5ad8490fbb3ceaa5e9dd304cef0311ce 100644 (file)
--- a/actions/apigroupmembership.php
+++ b/actions/apigroupmembership.php
@@ -183,6 +183,7 @@ class ApiGroupMembershipAction extends ApiPrivateAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->group->id,
                       strtotime($this->profiles[0]->created),

diff --git a/actions/apigroupshow.php b/actions/apigroupshow.php
index 2998e505e2174325c244e63d730fe02420076bef..9b90e6b3832df6717c2ef7165f778defa9a55f9a 100644 (file)
--- a/actions/apigroupshow.php
+++ b/actions/apigroupshow.php
@@ -149,6 +149,7 @@ class ApiGroupShowAction extends ApiPrivateAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->group->id,
                       strtotime($this->group->modified))

diff --git a/actions/apistatusesshow.php b/actions/apistatusesshow.php
index 476820a43db2216b17421e50c1a21a123c63c538..84f8079db553a906367d6d2e0dff542cf9e16315 100644 (file)
--- a/actions/apistatusesshow.php
+++ b/actions/apistatusesshow.php
@@ -194,6 +194,7 @@ class ApiStatusesShowAction extends ApiPrivateAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->notice->id,
                       strtotime($this->notice->created))

diff --git a/actions/apisubscriptions.php b/actions/apisubscriptions.php
index 63d65f2893ca51e37002153b9defd2eac4008d53..749d16f0678c7fa246322193d1dc70fbc7d3a7d5 100644 (file)
--- a/actions/apisubscriptions.php
+++ b/actions/apisubscriptions.php
@@ -181,6 +181,7 @@ class ApiSubscriptionsAction extends ApiBareAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->user->id,
                       isset($this->ids_only) ? 'IDs' : 'Profiles',

diff --git a/actions/apitimelinefavorites.php b/actions/apitimelinefavorites.php
index 7228960c0b48bfef8262366987ad7a3954a75407..f5ce5d2fd4d84e8f8111f407cdcfbcfe18d99f4c 100644 (file)
--- a/actions/apitimelinefavorites.php
+++ b/actions/apitimelinefavorites.php
@@ -259,6 +259,7 @@ class ApiTimelineFavoritesAction extends ApiBareAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->user->id,
                       strtotime($this->notices[0]->created),

diff --git a/actions/apitimelinefriends.php b/actions/apitimelinefriends.php
index 40ce35979b9005c63f1f1157ff30724cc62f88da..c96391c129e39d23794699a83e30159160db3a3e 100644 (file)
--- a/actions/apitimelinefriends.php
+++ b/actions/apitimelinefriends.php
@@ -346,6 +346,7 @@ class ApiTimelineFriendsAction extends ApiBareAuthAction
             return '"' . implode(
                                  ':',
                                  array($this->arg('action'),
+                                       common_user_cache_hash($this->auth_user),
                                        common_language(),
                                        $this->user->id,
                                        strtotime($this->notices[0]->created),

diff --git a/actions/apitimelinegroup.php b/actions/apitimelinegroup.php
index 7a40fd808430b456aaaf5e1f68e586963228a694..5138a4b5e1986210a795907d66364130403d95c3 100644 (file)
--- a/actions/apitimelinegroup.php
+++ b/actions/apitimelinegroup.php
@@ -229,6 +229,7 @@ class ApiTimelineGroupAction extends ApiPrivateAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->group->id,
                       strtotime($this->notices[0]->created),

diff --git a/actions/apitimelinehome.php b/actions/apitimelinehome.php
index 27eb7416915908535e136ef2c6d45b5922c2de47..1ceb3d902b2f8c4bc09b9273fa9b898f264e8b0b 100644 (file)
--- a/actions/apitimelinehome.php
+++ b/actions/apitimelinehome.php
@@ -254,6 +254,7 @@ class ApiTimelineHomeAction extends ApiBareAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->user->id,
                       strtotime($this->notices[0]->created),

diff --git a/actions/apitimelinementions.php b/actions/apitimelinementions.php
index ed1ad20e3247a3c8198ff9959d6f5ce4654fcedd..354dc58b6869f1fec229796b3133c1d67d17e4e2 100644 (file)
--- a/actions/apitimelinementions.php
+++ b/actions/apitimelinementions.php
@@ -244,6 +244,7 @@ class ApiTimelineMentionsAction extends ApiBareAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->user->id,
                       strtotime($this->notices[0]->created),

diff --git a/actions/apitimelinepublic.php b/actions/apitimelinepublic.php
index f901642882ee6a1fd7c4933b2e47cb81dfe4ee19..0119b504a7bb34899f9783455107e955e6df974e 100644 (file)
--- a/actions/apitimelinepublic.php
+++ b/actions/apitimelinepublic.php
@@ -311,6 +311,7 @@ class ApiTimelinePublicAction extends ApiPrivateAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       strtotime($this->notices[0]->created),
                       strtotime($this->notices[$last]->created))

diff --git a/actions/apitimelinetag.php b/actions/apitimelinetag.php
index c7ec172aeb1ded71f53e5c86a9237dd8d6b092a8..712703694fbf48652fdfec2592957b2652a5f829 100644 (file)
--- a/actions/apitimelinetag.php
+++ b/actions/apitimelinetag.php
@@ -232,6 +232,7 @@ class ApiTimelineTagAction extends ApiPrivateAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->tag,
                       strtotime($this->notices[0]->created),

diff --git a/actions/apitimelineuser.php b/actions/apitimelineuser.php
index 17a2836639650434feb7c20f50e9decfe8c3d4b1..0c97aad21c107ff318137441b8bea475d7e232a9 100644 (file)
--- a/actions/apitimelineuser.php
+++ b/actions/apitimelineuser.php
@@ -234,6 +234,7 @@ class ApiTimelineUserAction extends ApiBareAuthAction
             return '"' . implode(
                 ':',
                 array($this->arg('action'),
+                      common_user_cache_hash($this->auth_user),
                       common_language(),
                       $this->user->id,
                       strtotime($this->notices[0]->created),

diff --git a/actions/shownotice.php b/actions/shownotice.php
index 9c5d83441b8688e6ed08b52cf22c9dfdf71f6ba5..86df5f9f30658bdf560ee5be73104e7882639b42 100644 (file)
--- a/actions/shownotice.php
+++ b/actions/shownotice.php
@@ -151,6 +151,7 @@ class ShownoticeAction extends OwnerDesignAction
           strtotime($this->avatar->modified) : 0;
 
         return 'W/"' . implode(':', array($this->arg('action'),
+                                          common_user_cache_hash(),
                                           common_language(),
                                           $this->notice->id,
                                           strtotime($this->notice->created),

diff --git a/lib/action.php b/lib/action.php
index 5c4b4a7b7dcd9b3499c09d9820697f4b4e2d240a..5dcf78dcc964e9aa14ed4585cd2d2df44cf5a0eb 100644 (file)
--- a/lib/action.php
+++ b/lib/action.php
@@ -1018,17 +1018,22 @@ class Action extends HTMLOutputter // lawsuit
             }
         }
 
+        $checked = false;
         if ($etag) {
             $if_none_match = (array_key_exists('HTTP_IF_NONE_MATCH', $_SERVER)) ?
               $_SERVER['HTTP_IF_NONE_MATCH'] : null;
-            if ($if_none_match && $this->_hasEtag($etag, $if_none_match)) {
-                header('HTTP/1.1 304 Not Modified');
-                // Better way to do this?
-                exit(0);
+            if ($if_none_match) {
+                // If this check fails, ignore the if-modified-since below.
+                $checked = true;
+                if ($this->_hasEtag($etag, $if_none_match)) {
+                    header('HTTP/1.1 304 Not Modified');
+                    // Better way to do this?
+                    exit(0);
+                }
             }
         }
 
-        if ($lm && array_key_exists('HTTP_IF_MODIFIED_SINCE', $_SERVER)) {
+        if (!$checked && $lm && array_key_exists('HTTP_IF_MODIFIED_SINCE', $_SERVER)) {
             $if_modified_since = $_SERVER['HTTP_IF_MODIFIED_SINCE'];
             $ims = strtotime($if_modified_since);
             if ($lm <= $ims) {

diff --git a/lib/util.php b/lib/util.php
index 6d2e99b2ae72a83ebc0151f588730c80559ced34..e0457140e253955c93ff9bac74ec5c09fb39c4b7 100644 (file)
--- a/lib/util.php
+++ b/lib/util.php
@@ -494,6 +494,29 @@ function common_is_real_login()
     return common_logged_in() && $_SESSION['real_login'];
 }
 
+/**
+ * Get a hash portion for HTTP caching Etags and such including
+ * info on the current user's session. If login/logout state changes,
+ * or we've changed accounts, or we've renamed the current user,
+ * we'll get a new hash value.
+ *
+ * This should not be considered secure information.
+ *
+ * @param User $user (optional; uses common_current_user() if left out)
+ * @return string
+ */
+function common_user_cache_hash($user=false)
+{
+    if ($user === false) {
+        $user = common_current_user();
+    }
+    if ($user) {
+        return crc32($user->id . ':' . $user->nickname);
+    } else {
+        return '0';
+    }
+}
+
 // get canonical version of nickname for comparison
 function common_canonical_nickname($nickname)
 {

diff --git a/plugins/Autocomplete/autocomplete.php b/plugins/Autocomplete/autocomplete.php
index 5a010572f6bcec8de0f04815f965e5d7f0a2a533..a4e2d9baa4a3c16bfb03034e80e8891a07bcc576 100644 (file)
--- a/plugins/Autocomplete/autocomplete.php
+++ b/plugins/Autocomplete/autocomplete.php
@@ -79,6 +79,7 @@ class AutocompleteAction extends Action
     function etag()
     {
         return '"' . implode(':', array($this->arg('action'),
+            common_user_cache_hash(),
             crc32($this->arg('q')), //the actual string can have funny characters in we don't want showing up in the etag
             $this->arg('limit'),
             $this->lastModified())) . '"';