diff options
author | Christopher Speller <crspeller@gmail.com> | 2015-10-05 10:20:14 -0400 |
---|---|---|
committer | Christopher Speller <crspeller@gmail.com> | 2015-10-05 10:20:14 -0400 |
commit | f4afabd67999baabd06038cb6f3d664f2ebf77ba (patch) | |
tree | f839f71e9c072569fa119dd5a133daa955012f1b /api/user.go | |
parent | 8595fd85c7b64e0e7f928abd398f1e0f5d62eea8 (diff) | |
parent | 3b34e7313251c5c9b7dde8c5916f83ab9e9f2a31 (diff) | |
download | chat-f4afabd67999baabd06038cb6f3d664f2ebf77ba.tar.gz chat-f4afabd67999baabd06038cb6f3d664f2ebf77ba.tar.bz2 chat-f4afabd67999baabd06038cb6f3d664f2ebf77ba.zip |
Merge pull request #903 from mattermost/PLT-44
PLT-44 allow team switching without the need to login
Diffstat (limited to 'api/user.go')
-rw-r--r-- | api/user.go | 39 |
1 files changed, 37 insertions, 2 deletions
diff --git a/api/user.go b/api/user.go index ed3576a30..2d7dd9ab1 100644 --- a/api/user.go +++ b/api/user.go @@ -394,6 +394,41 @@ func Login(c *Context, w http.ResponseWriter, r *http.Request, user *model.User, http.SetCookie(w, sessionCookie) + multiToken := "" + if originalMultiSessionCookie, err := r.Cookie(model.MULTI_SESSION_TOKEN); err == nil { + multiToken = originalMultiSessionCookie.Value + } + + // Attempt to clean all the old tokens or duplicate tokens + if len(multiToken) > 0 { + tokens := strings.Split(multiToken, " ") + + multiToken = "" + seen := make(map[string]string) + seen[session.TeamId] = session.TeamId + for _, token := range tokens { + if sr := <-Srv.Store.Session().Get(token); sr.Err == nil { + s := sr.Data.(*model.Session) + if !s.IsExpired() && seen[s.TeamId] == "" { + multiToken += " " + token + seen[s.TeamId] = s.TeamId + } + } + } + } + + multiToken = strings.TrimSpace(session.Token + " " + multiToken) + + multiSessionCookie := &http.Cookie{ + Name: model.MULTI_SESSION_TOKEN, + Value: multiToken, + Path: "/", + MaxAge: maxAge, + HttpOnly: true, + } + + http.SetCookie(w, multiSessionCookie) + c.Session = *session c.LogAuditWithUserId(user.Id, "success") } @@ -514,7 +549,7 @@ func logout(c *Context, w http.ResponseWriter, r *http.Request) { func Logout(c *Context, w http.ResponseWriter, r *http.Request) { c.LogAudit("") - c.RemoveSessionCookie(w) + c.RemoveSessionCookie(w, r) if result := <-Srv.Store.Session().Remove(c.Session.Id); result.Err != nil { c.Err = result.Err return @@ -529,7 +564,7 @@ func getMe(c *Context, w http.ResponseWriter, r *http.Request) { if result := <-Srv.Store.User().Get(c.Session.UserId); result.Err != nil { c.Err = result.Err - c.RemoveSessionCookie(w) + c.RemoveSessionCookie(w, r) l4g.Error("Error in getting users profile for id=%v forcing logout", c.Session.UserId) return } else if HandleEtag(result.Data.(*model.User).Etag(), w, r) { |