diff -Nru django-session-security-2.4.0+dfsg/CHANGELOG django-session-security-2.6.5+dfsg/CHANGELOG --- django-session-security-2.4.0+dfsg/CHANGELOG 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/CHANGELOG 2019-01-04 16:10:20.000000000 +0000 @@ -1,3 +1,28 @@ +2.6.1 #113: Check if session expired on activity by @rbntimes + +2.6.0 Release + +2.6.0-rc1 + + #103: Django 2.0 urlresolvers import fix by @Ruffle0 + #98: Call is_authenticated property instead of function for Django 2.0 by @tpeaton + #105: Ensure setTimeout() millisecond parameter doesn't exceed max value by @abottc + Polish translation update by @mpasternak + +2.5.1 + + - #90: add SESSION_SECURITY_PASSIVE_URL_NAMES setting + +2.5.0 + + - #79 remove compiled binary from source to comply with Debian source code + repository policy by @nirgal + - #81 support django 1.10 by @eriktelepovsky + - #84 a11y support to modal dialog by @lynnco + - #85 support for mobile device activity by @kalekseev + - #88 dutch translation update by @rdekker1 + - #91 test django 1.11 and 2.0 instead of 1.7 by @jpic + 2.4.0 - #75 Fix vulnerability when SESSION_EXPIRE_AT_BROWSER_CLOSE is off diff -Nru django-session-security-2.4.0+dfsg/debian/changelog django-session-security-2.6.5+dfsg/debian/changelog --- django-session-security-2.4.0+dfsg/debian/changelog 2016-09-13 17:02:35.000000000 +0000 +++ django-session-security-2.6.5+dfsg/debian/changelog 2019-01-04 17:20:17.000000000 +0000 @@ -1,3 +1,17 @@ +django-session-security (2.6.5+dfsg-1) unstable; urgency=medium + + [ Jean-Michel Vourgère ] + * New upstream version. + * Bumped policy to 4.3.0: No change required. + + [ Ondřej Nový ] + * d/control: Set Vcs-* to salsa.debian.org + * d/copyright: Use https protocol in Format field + * d/control: Remove ancient X-Python-Version field + * d/control: Remove ancient X-Python3-Version field + + -- Jean-Michel Vourgère Fri, 04 Jan 2019 18:20:17 +0100 + django-session-security (2.4.0+dfsg-1) unstable; urgency=medium * New upstream version. diff -Nru django-session-security-2.4.0+dfsg/debian/control django-session-security-2.6.5+dfsg/debian/control --- django-session-security-2.4.0+dfsg/debian/control 2016-09-13 16:18:12.000000000 +0000 +++ django-session-security-2.6.5+dfsg/debian/control 2019-01-04 17:12:45.000000000 +0000 @@ -11,11 +11,9 @@ python3-sphinx Maintainer: Debian Python Modules Team Uploaders: Jean-Michel Vourgère -Vcs-Browser: https://anonscm.debian.org/cgit/python-modules/packages/django-session-security.git -Vcs-Git: https://anonscm.debian.org/git/python-modules/packages/django-session-security.git -Standards-Version: 3.9.8 -X-Python-Version: >= 2.7 -X-Python3-Version: >= 3.2 +Vcs-Browser: https://salsa.debian.org/python-team/modules/django-session-security +Vcs-Git: https://salsa.debian.org/python-team/modules/django-session-security.git +Standards-Version: 4.3.0 Homepage: http://django-session-security.rtfd.org/ Package: python-django-session-security diff -Nru django-session-security-2.4.0+dfsg/debian/copyright django-session-security-2.6.5+dfsg/debian/copyright --- django-session-security-2.4.0+dfsg/debian/copyright 2016-09-13 16:24:20.000000000 +0000 +++ django-session-security-2.6.5+dfsg/debian/copyright 2019-01-04 17:04:09.000000000 +0000 @@ -1,14 +1,13 @@ -Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: django-session-security Upstream-Contact: James Pic Source: https://github.com/yourlabs/django-session-security/ Files-Excluded: test_project/db.sqlite - session_security/locale/cs/LC_MESSAGES/django.mo Comment: test_project/db.sqlite is unused, even in tests, and contains binary data such as opened session. Files: * -Copyright: 2012-2016 James Pic +Copyright: 2012-2019 James Pic 2013 Richard "autodidacticon" Moorhead 2013 Yat "yscumc" So 2013 Fábio C. Barrioneuvo da Luz @@ -36,8 +35,8 @@ this list is incomplete. Files: debian/* -Copyright: 2014-2016 Jean-Michel Vourgère - 2016 Ondřej Nový +Copyright: 2014-2019 Jean-Michel Vourgère + 2016-2018 Ondřej Nový License: MIT Files: session_security/tests/project/static/jquery.js diff -Nru django-session-security-2.4.0+dfsg/debian/patches/disable_pycco django-session-security-2.6.5+dfsg/debian/patches/disable_pycco --- django-session-security-2.4.0+dfsg/debian/patches/disable_pycco 2016-09-13 16:18:12.000000000 +0000 +++ django-session-security-2.6.5+dfsg/debian/patches/disable_pycco 2019-01-04 16:22:19.000000000 +0000 @@ -4,34 +4,46 @@ Forwarded: no Last-Update: 2014-07-19 -Index: django-session-security-2.2.0/docs/source/conf.py +Index: django-session-security/docs/source/conf.py =================================================================== ---- django-session-security-2.2.0.orig/docs/source/conf.py -+++ django-session-security-2.2.0/docs/source/conf.py -@@ -27,16 +27,16 @@ autoclass_content = "both" +--- django-session-security.orig/docs/source/conf.py ++++ django-session-security/docs/source/conf.py +@@ -29,22 +29,22 @@ autoclass_content = "both" - project_root = os.path.abspath('../../') - static_root = os.path.abspath('_static') + project_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../')) + static_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '_static')) -import pycco -for script in ('script',): - html = pycco.generate_documentation( - os.path.join(project_root, 'session_security/static/session_security/%s.js' % script), - static_root - ) -- html = html.replace('../../../docs/source/_static/pycco.css', 'pycco.css') -- f = open(os.path.join(static_root, '%s.html' % script), 'w+') -- f.write(html) -- f.close() +- html = re.sub( +- r'"[^"]*pycco.css', +- '"pycco.css', +- html +- ) +- out = os.path.join(static_root, '%s.html' % script) +- if os.path.exists(out): +- os.unlink(out) +- with open(out, 'wb+') as f: +- f.write(six.u(html)) +#import pycco +#for script in ('script',): +# html = pycco.generate_documentation( +# os.path.join(project_root, 'session_security/static/session_security/%s.js' % script), +# static_root +# ) -+# html = html.replace('../../../docs/source/_static/pycco.css', 'pycco.css') -+# f = open(os.path.join(static_root, '%s.html' % script), 'w+') -+# f.write(html) -+# f.close() ++# html = re.sub( ++# r'"[^"]*pycco.css', ++# '"pycco.css', ++# html ++# ) ++# out = os.path.join(static_root, '%s.html' % script) ++# if os.path.exists(out): ++# os.unlink(out) ++# with open(out, 'wb+') as f: ++# f.write(six.u(html)) # -- General configuration ----------------------------------------------------- diff -Nru django-session-security-2.4.0+dfsg/debian/patches/no-external-images django-session-security-2.6.5+dfsg/debian/patches/no-external-images --- django-session-security-2.4.0+dfsg/debian/patches/no-external-images 2016-09-13 16:18:12.000000000 +0000 +++ django-session-security-2.6.5+dfsg/debian/patches/no-external-images 2019-01-04 16:22:19.000000000 +0000 @@ -1,16 +1,23 @@ Description: Remove external image from documentation This package creates a potential privacy breach by fetching data from an - external website at runtime. These ressources must be removed. + external website at runtime. These resources must be removed. . See http://lintian.debian.org/tags/privacy-breach-generic.html Author: Jean-Michel Nirgal Vourgère Forwarded: no -Last-Update: 2014-07-19 +Last-Update: 2019-01-04 ---- django-session-security-2.2.0.orig/README.rst -+++ django-session-security-2.2.0/README.rst -@@ -1,5 +1,3 @@ --.. image:: https://secure.travis-ci.org/yourlabs/django-session-security.png?branch=master +Index: django-session-security/README.rst +=================================================================== +--- django-session-security.orig/README.rst ++++ django-session-security/README.rst +@@ -1,10 +1,3 @@ +-.. image:: https://img.shields.io/pypi/v/django-session-security.svg +- :target: https://pypi.python.org/pypi/django-session-security +- +-.. image:: https://img.shields.io/travis/yourlabs/django-session-security.svg +- :target: https://travis-ci.org/yourlabs/django-session-security +- - This app provides a mechanism to logout inactive authenticated users. An inactive browser should be logged out automatically if the user left his diff -Nru django-session-security-2.4.0+dfsg/docs/source/conf.py django-session-security-2.6.5+dfsg/docs/source/conf.py --- django-session-security-2.4.0+dfsg/docs/source/conf.py 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/docs/source/conf.py 2019-01-04 16:10:20.000000000 +0000 @@ -11,6 +11,8 @@ # All configuration values have a default; values that are commented out # serve to show the default. +import re +import six import sys, os, os.path # If extensions (or modules to document with autodoc) are in another directory, @@ -21,22 +23,28 @@ from django.conf import settings settings.configure() settings.ROOT_URLCONF='session_security.urls' -settings.SESSION_EXPIRE_AT_BROWSER_CLOSE +settings.SESSION_EXPIRE_AT_BROWSER_CLOSE=True autoclass_content = "both" -project_root = os.path.abspath('../../') -static_root = os.path.abspath('_static') +project_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../')) +static_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '_static')) import pycco for script in ('script',): html = pycco.generate_documentation( os.path.join(project_root, 'session_security/static/session_security/%s.js' % script), static_root ) - html = html.replace('../../../docs/source/_static/pycco.css', 'pycco.css') - f = open(os.path.join(static_root, '%s.html' % script), 'w+') - f.write(html) - f.close() + html = re.sub( + r'"[^"]*pycco.css', + '"pycco.css', + html + ) + out = os.path.join(static_root, '%s.html' % script) + if os.path.exists(out): + os.unlink(out) + with open(out, 'wb+') as f: + f.write(six.u(html)) # -- General configuration ----------------------------------------------------- @@ -68,9 +76,9 @@ # built documents. # # The short X.Y version. -version = '2.4' +version = '2.6' # The full version, including alpha/beta/rc tags. -release = '2.4.0' +release = '2.6.1' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. diff -Nru django-session-security-2.4.0+dfsg/docs/source/faq.rst django-session-security-2.6.5+dfsg/docs/source/faq.rst --- django-session-security-2.4.0+dfsg/docs/source/faq.rst 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/docs/source/faq.rst 2019-01-04 16:10:20.000000000 +0000 @@ -2,7 +2,7 @@ ---------------------------------------------- Call `sessionSecurity.activity() -` +` every time you want to programaticaly trigger an activity. diff -Nru django-session-security-2.4.0+dfsg/LICENSE django-session-security-2.6.5+dfsg/LICENSE --- django-session-security-2.4.0+dfsg/LICENSE 1970-01-01 00:00:00.000000000 +0000 +++ django-session-security-2.6.5+dfsg/LICENSE 2019-01-04 16:10:20.000000000 +0000 @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2018 YourLabs + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff -Nru django-session-security-2.4.0+dfsg/README.rst django-session-security-2.6.5+dfsg/README.rst --- django-session-security-2.4.0+dfsg/README.rst 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/README.rst 2019-01-04 16:10:20.000000000 +0000 @@ -1,4 +1,9 @@ -.. image:: https://secure.travis-ci.org/yourlabs/django-session-security.png?branch=master +.. image:: https://img.shields.io/pypi/v/django-session-security.svg + :target: https://pypi.python.org/pypi/django-session-security + +.. image:: https://img.shields.io/travis/yourlabs/django-session-security.svg + :target: https://travis-ci.org/yourlabs/django-session-security + This app provides a mechanism to logout inactive authenticated users. An inactive browser should be logged out automatically if the user left his @@ -56,11 +61,10 @@ Requirements ------------ -- Python 2.7 or 3 +- Python 2.7 or 3.5+ - jQuery 1.7+ -- Django 1.7+ -- django.contrib.staticfiles or django-staticfiles (included in Pinax) or - you're on your own +- Django 1.8 to 2.0 +- django.contrib.staticfiles or #YoYo Resources --------- @@ -84,6 +88,3 @@ - `Continuous integration graciously hosted `_ by `Travis-ci `_ - -.. Continuous integration graciously hosted by Travis: -.. http://travis-ci.org/yourlabs/django-session-security diff -Nru django-session-security-2.4.0+dfsg/session_security/locale/fr/LC_MESSAGES/django.po django-session-security-2.6.5+dfsg/session_security/locale/fr/LC_MESSAGES/django.po --- django-session-security-2.4.0+dfsg/session_security/locale/fr/LC_MESSAGES/django.po 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/session_security/locale/fr/LC_MESSAGES/django.po 2019-01-04 16:10:20.000000000 +0000 @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: 2.0.3\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2013-02-19 16:28+0100\n" +"POT-Creation-Date: 2018-10-23 11:41-0400\n" "PO-Revision-Date: 2013-02-19 16:26+0100\n" "Last-Translator: James Pic \n" "Language: French\n" @@ -17,12 +17,13 @@ #: templates/session_security/all.html:32 msgid "You have unsaved changes in a form of this page." -msgstr "Vous avez des changements non sauvegardés dans un formulaire de cette page." +msgstr "" +"Vous avez des changements non sauvegardés dans un formulaire de cette page." #: templates/session_security/dialog.html:6 msgid "Your session is about to expire" msgstr "Votre session est sur le point d'expirer" #: templates/session_security/dialog.html:7 -msgid "Click to extend your session." -msgstr "Touchez la souris pour étendre la durée de votre session." +msgid "Click or type to extend your session." +msgstr "Touchez la souris ou tapez votre clavier pour étendre la durée de votre session." diff -Nru django-session-security-2.4.0+dfsg/session_security/locale/nl/LC_MESSAGES/django.po django-session-security-2.6.5+dfsg/session_security/locale/nl/LC_MESSAGES/django.po --- django-session-security-2.4.0+dfsg/session_security/locale/nl/LC_MESSAGES/django.po 1970-01-01 00:00:00.000000000 +0000 +++ django-session-security-2.6.5+dfsg/session_security/locale/nl/LC_MESSAGES/django.po 2019-01-04 16:10:20.000000000 +0000 @@ -0,0 +1,31 @@ +# Dutch translation for the django-session-security app. +# Copyright (C) 2014 +# This file is distributed under the same license as the django-session-security package. +# Rik Dekker , 2016. +# +msgid "" +msgstr "" +"Project-Id-Version: \n" +"Report-Msgid-Bugs-To: \n" +"POT-Creation-Date: 2014-03-13 12:36+0100\n" +"PO-Revision-Date: 2016-12-29 11:27+0100\n" +"Language: nl\n" +"MIME-Version: 1.0\n" +"Content-Type: text/plain; charset=UTF-8\n" +"Content-Transfer-Encoding: 8bit\n" +"Plural-Forms: nplurals=2; plural=(n != 1);\n" +"Last-Translator: \n" +"Language-Team: \n" +"X-Generator: Poedit 1.8.8\n" + +#: templates/session_security/all.html:33 +msgid "You have unsaved changes in a form of this page." +msgstr "Je hebt niet-opgeslagen wijzigingen op deze pagina." + +#: templates/session_security/dialog.html:6 +msgid "Your session is about to expire" +msgstr "Jouw sessie verloopt bijna" + +#: templates/session_security/dialog.html:7 +msgid "Click to extend your session." +msgstr "Klik om je sessie te verlengen." diff -Nru django-session-security-2.4.0+dfsg/session_security/locale/pl/LC_MESSAGES/django.po django-session-security-2.6.5+dfsg/session_security/locale/pl/LC_MESSAGES/django.po --- django-session-security-2.4.0+dfsg/session_security/locale/pl/LC_MESSAGES/django.po 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/session_security/locale/pl/LC_MESSAGES/django.po 2019-01-04 16:10:20.000000000 +0000 @@ -7,26 +7,29 @@ msgstr "" "Project-Id-Version: django-session-security\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2014-06-29 12:56+0200\n" -"PO-Revision-Date: 2014-06-29 12:57+0100\n" +"POT-Creation-Date: 2017-06-26 12:42+0200\n" +"PO-Revision-Date: 2017-06-26 12:44+0200\n" "Last-Translator: Michał Pasternak \n" -"Language-Team: LANGUAGE \n" +"Language: pl\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" "Plural-Forms: nplurals=3; plural=(n==1 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 " "|| n%100>=20) ? 1 : 2);\n" -"Language: pl\n" -"X-Generator: Poedit 1.6.2\n" +"X-Generator: Poedit 2.0.2\n" +"Language-Team: \n" -#: .\templates\session_security\all.html:33 +#: session_security/templates/session_security/all.html:32 msgid "You have unsaved changes in a form of this page." -msgstr "W formularzu na tej stronie znajdują się niezapisane informacje." +msgstr "" +"Na tej stronie znajduje się formularz, w którym zmiany mogły jeszcze nie " +"zostać zapisane." -#: .\templates\session_security\dialog.html:6 +#: session_security/templates/session_security/dialog.html:6 msgid "Your session is about to expire" -msgstr "Twoja sesja za chwilę wygaśnie." +msgstr "Twoja sesja za chwilę wygaśnie" -#: .\templates\session_security\dialog.html:7 -msgid "Click to extend your session." -msgstr "Kliknij, aby wydłużyć czas trwania Twojej sesji." +#: session_security/templates/session_security/dialog.html:7 +msgid "Click or type to extend your session." +msgstr "" +"Kliknij lub wciśnij dowolny klawisz, aby wydłużyć czas trwania Twojej sesji." diff -Nru django-session-security-2.4.0+dfsg/session_security/middleware.py django-session-security-2.6.5+dfsg/session_security/middleware.py --- django-session-security-2.4.0+dfsg/session_security/middleware.py 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/session_security/middleware.py 2019-01-04 16:10:20.000000000 +0000 @@ -11,21 +11,43 @@ from datetime import datetime, timedelta +import django from django.contrib.auth import logout -from django.core.urlresolvers import reverse +try: # Django 2.0 + from django.urls import reverse, resolve, Resolver404 +except: # Django < 2.0 + from django.core.urlresolvers import reverse, resolve, Resolver404 + +try: + from django.utils.deprecation import MiddlewareMixin +except ImportError: # Django < 1.10 + # Works perfectly for everyone using MIDDLEWARE_CLASSES + MiddlewareMixin = object from .utils import get_last_activity, set_last_activity -from .settings import EXPIRE_AFTER, PASSIVE_URLS +from .settings import EXPIRE_AFTER, PASSIVE_URLS, PASSIVE_URL_NAMES -class SessionSecurityMiddleware(object): +class SessionSecurityMiddleware(MiddlewareMixin): """ In charge of maintaining the real 'last activity' time, and log out the user if appropriate. """ def is_passive_request(self, request): - return request.path in PASSIVE_URLS + """ Should we skip activity update on this URL/View. """ + if request.path in PASSIVE_URLS: + return True + + try: + match = resolve(request.path) + # TODO: check namespaces too + if match.url_name in PASSIVE_URL_NAMES: + return True + except Resolver404: + pass + + return False def get_expire_seconds(self, request): """Return time (in seconds) before the user should be logged out.""" @@ -33,7 +55,13 @@ def process_request(self, request): """ Update last activity time or logout. """ - if not request.user.is_authenticated(): + + if django.VERSION < (1, 10): + is_authenticated = request.user.is_authenticated() + else: + is_authenticated = request.user.is_authenticated + + if not is_authenticated: return now = datetime.now() diff -Nru django-session-security-2.4.0+dfsg/session_security/settings.py django-session-security-2.6.5+dfsg/session_security/settings.py --- django-session-security-2.4.0+dfsg/session_security/settings.py 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/session_security/settings.py 2019-01-04 16:10:20.000000000 +0000 @@ -16,6 +16,12 @@ it should not be used to update the user's last activity datetime. Overridable in ``settings.SESSION_SECURITY_PASSIVE_URLS``. +PASSIVE_URL_NAMES + Same as PASSIVE_URLS, but takes Django URL names instead of a path. This + is useful in case path names change, or contain parameterized values, and + thus cannot be described statically. NOTE: currently namespaces are not + handled. Overridable in ``settings.SESSION_SECURITY_PASSIVE_URL_NAMES``. + SESSION_SECURITY_INSECURE Set this to True in your settings if you want the project to run without having to set SESSION_EXPIRE_AT_BROWSER_CLOSE=True, which you should @@ -32,6 +38,8 @@ PASSIVE_URLS = getattr(settings, 'SESSION_SECURITY_PASSIVE_URLS', []) +PASSIVE_URL_NAMES = getattr(settings, 'SESSION_SECURITY_PASSIVE_URL_NAMES', []) + expire_at_browser_close = getattr( settings, 'SESSION_EXPIRE_AT_BROWSER_CLOSE', diff -Nru django-session-security-2.4.0+dfsg/session_security/static/session_security/script.js django-session-security-2.6.5+dfsg/session_security/static/session_security/script.js --- django-session-security-2.4.0+dfsg/session_security/static/session_security/script.js 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/session_security/static/session_security/script.js 2019-01-04 16:10:20.000000000 +0000 @@ -24,24 +24,27 @@ this.lastActivity = new Date(); // Events that would trigger an activity - this.events = ['mousemove', 'scroll', 'keyup', 'click']; - + this.events = ['mousemove', 'scroll', 'keyup', 'click', 'touchstart', 'touchend', 'touchmove']; + // Merge the options dict here. $.extend(this, options); // Bind activity events to update this.lastActivity. + var $document = $(document); for(var i=0; i= this.expireAfter) { + // Enforces checking whether a user's session is expired. This + // ensures a user being redirected instead of waiting until nextPing. + this.expire(); + } + if (this.$warning.is(':visible')) { // Inform the server that the user came back manually, this should // block other browser tabs from expiring. this.ping(); + // The hideWarning should only be called when the warning is visible + this.hideWarning(); } - - this.hideWarning(); }, // Hit the PingView with the number of seconds since last activity. @@ -130,7 +143,10 @@ nextPing = this.warnAfter - idleFor; } - this.timeout = setTimeout($.proxy(this.ping, this), nextPing * 1000); + // setTimeout expects the timeout value not to exceed + // a 32-bit unsigned int, so cap the value + var milliseconds = Math.min(nextPing * 1000, 2147483647) + this.timeout = setTimeout($.proxy(this.ping, this), milliseconds); }, // onbeforeunload handler. diff -Nru django-session-security-2.4.0+dfsg/session_security/templates/session_security/dialog.html django-session-security-2.6.5+dfsg/session_security/templates/session_security/dialog.html --- django-session-security-2.4.0+dfsg/session_security/templates/session_security/dialog.html 2016-08-17 13:37:57.000000000 +0000 +++ django-session-security-2.6.5+dfsg/session_security/templates/session_security/dialog.html 2019-01-04 16:10:20.000000000 +0000 @@ -1,10 +1,10 @@ {% load i18n %} -