rails/rails — pull request #5676 by aliix (2012-03-30 23:05:13+00:00)
Title: Use request.GET and request.POST instead of request.params in abstract_store

This addresses the primary problem in issue #5670 by using request.GET and request.POST instead of request.params.

ActionDispatch::Http::Parameters#parameters (same as request.params) depends on ActionDispatch::ParamsParser middleware to properly assign env["action_dispatch.request.request_parameters"], but will assign that itself in a more naive way if it has not been set yet by ParamsParser. It uses this value (env["action_dispatch.request.request_parameters"]) to permanently (||=) set the consolidated parameters in env["action_dispatch.request.parameters"].

If request.params is called BEFORE ParamsParser (e.g. in session middleware), then env["action_dispatch.request.parameters"] will be assigned permanently based on a more naive env["action_dispatch.request.request_parameters"] from ActionDispatch::Http::Parameters#parameters. ParamsParser will still reassign env["action_dispatch.request.request_parameters"] when it runs, but env["action_dispatch.request.parameters"] will have already been assigned and will not be recalculated.

If request.params is called AFTER ParamsParser (i.e. it is NOT called by session middleware), then env["action_dispatch.request.parameters"] will be assigned based on ParamsParser env["action_dispatch.request.request_parameters"].

Thus, depending on whether session middleware calls ActionDispatch::Session::AbstractStore#extract_session_id with no cookie set AND cookies_only set to false, the params could be set incorrectly. This bug seems unusual, since not that many people use the cookies_only feature and the feature is only effective if no cookie is already set.