avoinministerio/avoinministerio — pull request #200 by jyrkive (2012-07-27 08:21:21+00:00)
Title: Security fixes for signing

Yay! Pull request #200! :D

This commit fixes some security issues which, among other things, caused tests to fail.

+ fixed: it was possible to sign a proposal multiple times*
+ changed session_store to active_record_store, which stores sessions in a database instead of in cookies. It makes [session poisoning](http://en.wikipedia.org/wiki/Session_poisoning) attacks much harder. (Obviously, server-side bugs may still allow session poisoning.)
+ fixed some bugs in tests

I also applied automatic reformatting to SignaturesController.

*I'm not sure if I actually fixed it fully. One test about it still fails. When I debugged the test, signing failed in the controller as expected, but the page that eventually got generated looked like signing had succeeded.