[FIX] website: `geoip` not defined in session for invalid session

The method that set `geoip` in the session, `_geoip_resolve`,
is called just before `self._authenticate`, which logout the user
when the session is invalid, and therefore reset the session.

Therefore, `geoip` could not be in the session in that place.
This isn't that bad, as, at the next request, the `geoip` will be
correctly set in the session.

During the analysis of this issue, we observed that the reset
of the session is actually not saved, because the save
of this session is done in `Root.get_response`, through the call
`self.session_store.save(httprequest.session)`,
but `Root.get_response` is not called in `Root.dispatch` in case
of HTTPException (500 internal server error in this case).

This might need to be changed, to do the session save with a finally
in this `Root.dispatch` method, so the above bug could have been
resolved with a simple refresh (which would have re-defined the
`geoip` in the session).

opw-650416

0 files changed, 0 insertions, 0 deletions