From 5d611202038e69e29bcba8759917189fbab0862a Mon Sep 17 00:00:00 2001
From: Thomas NOEL <tnoel@entrouvert.com>
Date: Wed, 15 Mar 2017 01:38:17 +0100
Subject: [PATCH] clear all session_var if new ones in query string (#15436)

---
 tests/test_form_pages.py | 13 +++++++++++++
 wcs/qommon/publisher.py  |  2 +-
 wcs/qommon/sessions.py   |  5 ++---
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/tests/test_form_pages.py b/tests/test_form_pages.py
index 4fd6febc..d1ef7435 100644
--- a/tests/test_form_pages.py
+++ b/tests/test_form_pages.py
@@ -1608,6 +1608,19 @@ query_string_allowed_vars = foo,bar
     resp = resp.click('test')
     assert resp.forms[0]['f0'].value == 'hello2'
 
+    # check new session_var_ erase all previous ones
+    app = get_app(pub)
+    resp = app.get('/?session_var_foo=hello')
+    assert resp.location == 'http://example.net/'
+    resp = resp.follow()
+    resp = resp.click('test')
+    assert resp.forms[0]['f0'].value == 'hello'
+    resp = app.get('/?session_var_bar=hello')
+    assert resp.location == 'http://example.net/'
+    resp = resp.follow()
+    resp = resp.click('test')
+    assert resp.forms[0]['f0'].value == ''
+
     # check repeated options are ignored
     resp = get_app(pub).get('/?session_var_foo=hello&session_var_foo=hello2')
     assert resp.location == 'http://example.net/'
diff --git a/wcs/qommon/publisher.py b/wcs/qommon/publisher.py
index c62995d7..2ebaf4e9 100644
--- a/wcs/qommon/publisher.py
+++ b/wcs/qommon/publisher.py
@@ -607,7 +607,7 @@ class QommonPublisher(Publisher, object):
                     del request.form[k]
             if had_session_variables:
                 self.start_request() # creates session
-                request.session.add_extra_variables(**session_variables)
+                request.session.set_extra_variables(**session_variables)
                 self.finish_successful_request() # commits session
                 new_query_string = ''
                 if request.form:
diff --git a/wcs/qommon/sessions.py b/wcs/qommon/sessions.py
index a3c730c7..48dc2b7b 100644
--- a/wcs/qommon/sessions.py
+++ b/wcs/qommon/sessions.py
@@ -236,9 +236,8 @@ class Session(QommonSession, CaptchaSession, StorableObject):
         value.fp = open(filename)
         return value
 
-    def add_extra_variables(self, **kwargs):
-        if not self.extra_variables:
-            self.extra_variables = {}
+    def set_extra_variables(self, **kwargs):
+        self.extra_variables = {}
         self.extra_variables.update(kwargs)
 
     def get_substitution_variables(self, prefix='session_var_'):
-- 
2.11.0