/ 
Solstice-1440
/ Solstice::Resource
Security Advisories (1)
CVE-2026-5085 (2026-04-13)

Solstice::Session versions through 1440 for Perl generates session ids insecurely. The _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id. The same method is used in the _generateID method in Solstice::Subsession, which is part of the same distribution. The epoch time may be guessed, if it is not leaked in the HTTP Date header. Stringified hash refences will contain predictable content. The built-in rand() function is seeded by 16-bits and is unsuitable for security purposes. The process id comes from a small set of numbers. Predictable session ids could allow an attacker to gain access to systems.

NAME

Solstice::Resource - A superclass for all Solstice::Resource objects.

SYNOPSIS

package Solstice::Resource;

DESCRIPTION

Superclass

Solstice::Tree, Solstice::Model.

Export

No symbols exported.

Methods

new()

Constructor; should only be called by a subclass. Returns a Solstice::Resource object.

setName($name)

Sets the name of a resource, if it hasn't already been set.

isContainer()

Return TRUE if the resource is a container, FALSE otherwise.

isValidPath($path)

Return TRUE if the passed $path is valid, FALSE otherwise.

getPath()

Finds the path of the resource, recursing up the tree to generate it.

getOwner()

Optimized for loading owner object only when called on.

getCreationDate()

Returns a Solstice::DateTime that represents the date the Resource was first stored.

getModificationDate()

Returns a Solstice::DateTime that represents the date the Resource was last stored, with changes.

move($path)

Move the resource to parent $path.

delete()

Delete the resource.

clone()

Returns a clone of the resource, with the name stripped and a source path added.

store([$params])

Stores the resource. Brokers work off to various methods for moving, copying deleting, storing content, and so on.

equals($resource)

Returns TRUE if the passed $resource represents the same resource as $self, FALSE otherwise.

isValidName($name)

Returns TRUE if passed $name is valid for the resource, FALSE otherwise. The default implementation is very strict, and should probably be overridden in a subclass.

Private Methods

_initFromID()
_initFromHash(\%params)
_initEmpty()
_store()

Internal store, implemented by a subclass.

_copy()

The actual copy, called by store.

_move()

The actual move, called by store.

_delete()

The actual delete, called by store.

_getAccessorDefinition()

Modules Used

Solstice::Model.

Carp.

AUTHOR

Catalyst Group, <catalyst@u.washington.edu>

VERSION

$Revision: 851 $

COPYRIGHT

Copyright 1998-2007 Office of Learning Technologies, University of Washington

Licensed under the Educational Community License, Version 1.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at: http://www.opensource.org/licenses/ecl1.php

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.