Security Advisories (1)
CVE-2026-5083 (2026-04-08)

Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that Ado is no longer maintained, and has been removed from the CPAN index. It is still available on BackPAN.

NAME

A class for TABLE users in schema main

SYNOPSIS

#In a controller use the helper.
#Find a user by login_name and change the current user
my $user       = Ado::Model::Users->by_login_name($login_name);
$c->user($user);

#in a template
<h1>Hello, <%=user->name%>!</h1>

#Add a new user.
my $user = Ado::Model::Users->add(login_name=>'petko'...);
#Add the user to a group
$user->add_to_group('cool');

DESCRIPTION

This class maps to rows in table users.

ATTRIBUTES

Ado::Model::Users inherits all attributes from Ado::Model and provides the following.

name

Readonly. Returns concatenated "first_name" and "last_name" of the user or the username (in case the first two are not available).

# Hello, Guest
<h1>Hello, <%=user->name%>!</h1>

COLUMNS

Each column from table users has an accessor method in this class.

id

group_id

login_name

login_password

first_name

last_name

email

description

created_by

changed_by

tstamp

reg_date

disabled

start_date

stop_date

ALIASES

none

METHODS

Ado::Model::Users inherits all methods from Ado::Model and provides the following additional methods:

add

Given enough parameters creates a new user object and inserts it into the table users. Creates a primary group for the user with the same group name. Throws an exception if any of the above fails. Returns (the eventually newly created) user object.

my $user = Ado::Model::Users->add(
    login_name     => $login_name,
    login_password => Mojo::Util::sha1_hex($login_name.$login_password)
);

add_to_group

Adds a user with login_name to a group. Creates the group if it does not already exists. Returns the group.

$ingroup = Ado::Model::Users->add_to_group(login_name=>'petko',ingroup=>'admin');

by_login_name

Selects a user by login_name column.

my $user = Ado::Model::Users->by_login_name('guest');
say $user->login_name if $user->id;

ingroup

Given a group name returns true if a user is member of the group. Returns false otherwise. Returns a list of all group names a user belongs to if no group name passed.

say $user->name . ' is admin!' if $user->ingroup('admin');
say $user->name .' is member of the following groups:' 
. join(', ', $user->ingroup);

GENERATOR

DBIx::Simple::Class::Schema

This class contains also custom code.

SEE ALSO

Ado::Command::adduser, Email::Address, Ado::Model, DBIx::Simple::Class, DBIx::Simple::Class::Schema