init

at-admin/vendor/github.com/astaxie/beego/session/README.md

@@ -0,0 +1,114 @@
+session
+==============
+
+session is a Go session manager. It can use many session providers. Just like the `database/sql` and `database/sql/driver`.
+
+## How to install?
+
+	go get github.com/astaxie/beego/session
+
+
+## What providers are supported?
+
+As of now this session manager support memory, file, Redis and MySQL.
+
+
+## How to use it?
+
+First you must import it
+
+	import (
+		"github.com/astaxie/beego/session"
+	)
+
+Then in you web app init the global session manager
+	
+	var globalSessions *session.Manager
+
+* Use **memory** as provider:
+
+		func init() {
+			globalSessions, _ = session.NewManager("memory", `{"cookieName":"gosessionid","gclifetime":3600}`)
+			go globalSessions.GC()
+		}
+
+* Use **file** as provider, the last param is the path where you want file to be stored:
+
+		func init() {
+			globalSessions, _ = session.NewManager("file",`{"cookieName":"gosessionid","gclifetime":3600,"ProviderConfig":"./tmp"}`)
+			go globalSessions.GC()
+		}
+
+* Use **Redis** as provider, the last param is the Redis conn address,poolsize,password:
+
+		func init() {
+			globalSessions, _ = session.NewManager("redis", `{"cookieName":"gosessionid","gclifetime":3600,"ProviderConfig":"127.0.0.1:6379,100,astaxie"}`)
+			go globalSessions.GC()
+		}
+		
+* Use **MySQL** as provider, the last param is the DSN, learn more from [mysql](https://github.com/go-sql-driver/mysql#dsn-data-source-name):
+
+		func init() {
+			globalSessions, _ = session.NewManager(
+				"mysql", `{"cookieName":"gosessionid","gclifetime":3600,"ProviderConfig":"username:password@protocol(address)/dbname?param=value"}`)
+			go globalSessions.GC()
+		}
+
+* Use **Cookie** as provider:
+
+		func init() {
+			globalSessions, _ = session.NewManager(
+				"cookie", `{"cookieName":"gosessionid","enableSetCookie":false,"gclifetime":3600,"ProviderConfig":"{\"cookieName\":\"gosessionid\",\"securityKey\":\"beegocookiehashkey\"}"}`)
+			go globalSessions.GC()
+		}
+
+
+Finally in the handlerfunc you can use it like this
+
+	func login(w http.ResponseWriter, r *http.Request) {
+		sess := globalSessions.SessionStart(w, r)
+		defer sess.SessionRelease(w)
+		username := sess.Get("username")
+		fmt.Println(username)
+		if r.Method == "GET" {
+			t, _ := template.ParseFiles("login.gtpl")
+			t.Execute(w, nil)
+		} else {
+			fmt.Println("username:", r.Form["username"])
+			sess.Set("username", r.Form["username"])
+			fmt.Println("password:", r.Form["password"])
+		}
+	}
+
+
+## How to write own provider?
+
+When you develop a web app, maybe you want to write own provider because you must meet the requirements.
+
+Writing a provider is easy. You only need to define two struct types 
+(Session and Provider), which satisfy the interface definition. 
+Maybe you will find the **memory** provider is a good example.
+
+	type SessionStore interface {
+		Set(key, value interface{}) error     //set session value
+		Get(key interface{}) interface{}      //get session value
+		Delete(key interface{}) error         //delete session value
+		SessionID() string                    //back current sessionID
+		SessionRelease(w http.ResponseWriter) // release the resource & save data to provider & return the data
+		Flush() error                         //delete all data
+	}
+	
+	type Provider interface {
+		SessionInit(gclifetime int64, config string) error
+		SessionRead(sid string) (SessionStore, error)
+		SessionExist(sid string) bool
+		SessionRegenerate(oldsid, sid string) (SessionStore, error)
+		SessionDestroy(sid string) error
+		SessionAll() int //get all active session
+		SessionGC()
+	}
+
+
+## LICENSE
+
+BSD License http://creativecommons.org/licenses/BSD/

at-admin/vendor/github.com/astaxie/beego/session/sess_cookie.go

@@ -0,0 +1,178 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"sync"
+)
+
+var cookiepder = &CookieProvider{}
+
+// CookieSessionStore Cookie SessionStore
+type CookieSessionStore struct {
+	sid    string
+	values map[interface{}]interface{} // session data
+	lock   sync.RWMutex
+}
+
+// Set value to cookie session.
+// the value are encoded as gob with hash block string.
+func (st *CookieSessionStore) Set(key, value interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.values[key] = value
+	return nil
+}
+
+// Get value from cookie session
+func (st *CookieSessionStore) Get(key interface{}) interface{} {
+	st.lock.RLock()
+	defer st.lock.RUnlock()
+	if v, ok := st.values[key]; ok {
+		return v
+	}
+	return nil
+}
+
+// Delete value in cookie session
+func (st *CookieSessionStore) Delete(key interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	delete(st.values, key)
+	return nil
+}
+
+// Flush Clean all values in cookie session
+func (st *CookieSessionStore) Flush() error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.values = make(map[interface{}]interface{})
+	return nil
+}
+
+// SessionID Return id of this cookie session
+func (st *CookieSessionStore) SessionID() string {
+	return st.sid
+}
+
+// SessionRelease Write cookie session to http response cookie
+func (st *CookieSessionStore) SessionRelease(w http.ResponseWriter) {
+	encodedCookie, err := encodeCookie(cookiepder.block, cookiepder.config.SecurityKey, cookiepder.config.SecurityName, st.values)
+	if err == nil {
+		cookie := &http.Cookie{Name: cookiepder.config.CookieName,
+			Value:    url.QueryEscape(encodedCookie),
+			Path:     "/",
+			HttpOnly: true,
+			Secure:   cookiepder.config.Secure,
+			MaxAge:   cookiepder.config.Maxage}
+		http.SetCookie(w, cookie)
+	}
+}
+
+type cookieConfig struct {
+	SecurityKey  string `json:"securityKey"`
+	BlockKey     string `json:"blockKey"`
+	SecurityName string `json:"securityName"`
+	CookieName   string `json:"cookieName"`
+	Secure       bool   `json:"secure"`
+	Maxage       int    `json:"maxage"`
+}
+
+// CookieProvider Cookie session provider
+type CookieProvider struct {
+	maxlifetime int64
+	config      *cookieConfig
+	block       cipher.Block
+}
+
+// SessionInit Init cookie session provider with max lifetime and config json.
+// maxlifetime is ignored.
+// json config:
+// 	securityKey - hash string
+// 	blockKey - gob encode hash string. it's saved as aes crypto.
+// 	securityName - recognized name in encoded cookie string
+// 	cookieName - cookie name
+// 	maxage - cookie max life time.
+func (pder *CookieProvider) SessionInit(maxlifetime int64, config string) error {
+	pder.config = &cookieConfig{}
+	err := json.Unmarshal([]byte(config), pder.config)
+	if err != nil {
+		return err
+	}
+	if pder.config.BlockKey == "" {
+		pder.config.BlockKey = string(generateRandomKey(16))
+	}
+	if pder.config.SecurityName == "" {
+		pder.config.SecurityName = string(generateRandomKey(20))
+	}
+	pder.block, err = aes.NewCipher([]byte(pder.config.BlockKey))
+	if err != nil {
+		return err
+	}
+	pder.maxlifetime = maxlifetime
+	return nil
+}
+
+// SessionRead Get SessionStore in cooke.
+// decode cooke string to map and put into SessionStore with sid.
+func (pder *CookieProvider) SessionRead(sid string) (Store, error) {
+	maps, _ := decodeCookie(pder.block,
+		pder.config.SecurityKey,
+		pder.config.SecurityName,
+		sid, pder.maxlifetime)
+	if maps == nil {
+		maps = make(map[interface{}]interface{})
+	}
+	rs := &CookieSessionStore{sid: sid, values: maps}
+	return rs, nil
+}
+
+// SessionExist Cookie session is always existed
+func (pder *CookieProvider) SessionExist(sid string) bool {
+	return true
+}
+
+// SessionRegenerate Implement method, no used.
+func (pder *CookieProvider) SessionRegenerate(oldsid, sid string) (Store, error) {
+	return nil, nil
+}
+
+// SessionDestroy Implement method, no used.
+func (pder *CookieProvider) SessionDestroy(sid string) error {
+	return nil
+}
+
+// SessionGC Implement method, no used.
+func (pder *CookieProvider) SessionGC() {
+}
+
+// SessionAll Implement method, return 0.
+func (pder *CookieProvider) SessionAll() int {
+	return 0
+}
+
+// SessionUpdate Implement method, no used.
+func (pder *CookieProvider) SessionUpdate(sid string) error {
+	return nil
+}
+
+func init() {
+	Register("cookie", cookiepder)
+}

at-admin/vendor/github.com/astaxie/beego/session/sess_file.go

@@ -0,0 +1,309 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"errors"
+	"path"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+var (
+	filepder      = &FileProvider{}
+	gcmaxlifetime int64
+)
+
+// FileSessionStore File session store
+type FileSessionStore struct {
+	sid    string
+	lock   sync.RWMutex
+	values map[interface{}]interface{}
+}
+
+// Set value to file session
+func (fs *FileSessionStore) Set(key, value interface{}) error {
+	fs.lock.Lock()
+	defer fs.lock.Unlock()
+	fs.values[key] = value
+	return nil
+}
+
+// Get value from file session
+func (fs *FileSessionStore) Get(key interface{}) interface{} {
+	fs.lock.RLock()
+	defer fs.lock.RUnlock()
+	if v, ok := fs.values[key]; ok {
+		return v
+	}
+	return nil
+}
+
+// Delete value in file session by given key
+func (fs *FileSessionStore) Delete(key interface{}) error {
+	fs.lock.Lock()
+	defer fs.lock.Unlock()
+	delete(fs.values, key)
+	return nil
+}
+
+// Flush Clean all values in file session
+func (fs *FileSessionStore) Flush() error {
+	fs.lock.Lock()
+	defer fs.lock.Unlock()
+	fs.values = make(map[interface{}]interface{})
+	return nil
+}
+
+// SessionID Get file session store id
+func (fs *FileSessionStore) SessionID() string {
+	return fs.sid
+}
+
+// SessionRelease Write file session to local file with Gob string
+func (fs *FileSessionStore) SessionRelease(w http.ResponseWriter) {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+	b, err := EncodeGob(fs.values)
+	if err != nil {
+		SLogger.Println(err)
+		return
+	}
+	_, err = os.Stat(path.Join(filepder.savePath, string(fs.sid[0]), string(fs.sid[1]), fs.sid))
+	var f *os.File
+	if err == nil {
+		f, err = os.OpenFile(path.Join(filepder.savePath, string(fs.sid[0]), string(fs.sid[1]), fs.sid), os.O_RDWR, 0777)
+		if err != nil {
+			SLogger.Println(err)
+			return
+		}
+	} else if os.IsNotExist(err) {
+		f, err = os.Create(path.Join(filepder.savePath, string(fs.sid[0]), string(fs.sid[1]), fs.sid))
+		if err != nil {
+			SLogger.Println(err)
+			return
+		}
+	} else {
+		return
+	}
+	f.Truncate(0)
+	f.Seek(0, 0)
+	f.Write(b)
+	f.Close()
+}
+
+// FileProvider File session provider
+type FileProvider struct {
+	lock        sync.RWMutex
+	maxlifetime int64
+	savePath    string
+}
+
+// SessionInit Init file session provider.
+// savePath sets the session files path.
+func (fp *FileProvider) SessionInit(maxlifetime int64, savePath string) error {
+	fp.maxlifetime = maxlifetime
+	fp.savePath = savePath
+	return nil
+}
+
+// SessionRead Read file session by sid.
+// if file is not exist, create it.
+// the file path is generated from sid string.
+func (fp *FileProvider) SessionRead(sid string) (Store, error) {
+	if strings.ContainsAny(sid, "./") {
+		return nil, nil
+	}
+	if len(sid) < 2 {
+		return nil, errors.New("length of the sid is less than 2")
+	}
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	err := os.MkdirAll(path.Join(fp.savePath, string(sid[0]), string(sid[1])), 0777)
+	if err != nil {
+		SLogger.Println(err.Error())
+	}
+	_, err = os.Stat(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	var f *os.File
+	if err == nil {
+		f, err = os.OpenFile(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid), os.O_RDWR, 0777)
+	} else if os.IsNotExist(err) {
+		f, err = os.Create(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	} else {
+		return nil, err
+	}
+
+	defer f.Close()
+
+	os.Chtimes(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid), time.Now(), time.Now())
+	var kv map[interface{}]interface{}
+	b, err := ioutil.ReadAll(f)
+	if err != nil {
+		return nil, err
+	}
+	if len(b) == 0 {
+		kv = make(map[interface{}]interface{})
+	} else {
+		kv, err = DecodeGob(b)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	ss := &FileSessionStore{sid: sid, values: kv}
+	return ss, nil
+}
+
+// SessionExist Check file session exist.
+// it checks the file named from sid exist or not.
+func (fp *FileProvider) SessionExist(sid string) bool {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	_, err := os.Stat(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	return err == nil
+}
+
+// SessionDestroy Remove all files in this save path
+func (fp *FileProvider) SessionDestroy(sid string) error {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+	os.Remove(path.Join(fp.savePath, string(sid[0]), string(sid[1]), sid))
+	return nil
+}
+
+// SessionGC Recycle files in save path
+func (fp *FileProvider) SessionGC() {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	gcmaxlifetime = fp.maxlifetime
+	filepath.Walk(fp.savePath, gcpath)
+}
+
+// SessionAll Get active file session number.
+// it walks save path to count files.
+func (fp *FileProvider) SessionAll() int {
+	a := &activeSession{}
+	err := filepath.Walk(fp.savePath, func(path string, f os.FileInfo, err error) error {
+		return a.visit(path, f, err)
+	})
+	if err != nil {
+		SLogger.Printf("filepath.Walk() returned %v\n", err)
+		return 0
+	}
+	return a.total
+}
+
+// SessionRegenerate Generate new sid for file session.
+// it delete old file and create new file named from new sid.
+func (fp *FileProvider) SessionRegenerate(oldsid, sid string) (Store, error) {
+	filepder.lock.Lock()
+	defer filepder.lock.Unlock()
+
+	oldPath := path.Join(fp.savePath, string(oldsid[0]), string(oldsid[1]))
+	oldSidFile := path.Join(oldPath, oldsid)
+	newPath := path.Join(fp.savePath, string(sid[0]), string(sid[1]))
+	newSidFile := path.Join(newPath, sid)
+
+	// new sid file is exist
+	_, err := os.Stat(newSidFile)
+	if err == nil {
+		return nil, fmt.Errorf("newsid %s exist", newSidFile)
+	}
+
+	err = os.MkdirAll(newPath, 0777)
+	if err != nil {
+		SLogger.Println(err.Error())
+	}
+
+	// if old sid file exist
+	// 1.read and parse file content
+	// 2.write content to new sid file
+	// 3.remove old sid file, change new sid file atime and ctime
+	// 4.return FileSessionStore
+	_, err = os.Stat(oldSidFile)
+	if err == nil {
+		b, err := ioutil.ReadFile(oldSidFile)
+		if err != nil {
+			return nil, err
+		}
+
+		var kv map[interface{}]interface{}
+		if len(b) == 0 {
+			kv = make(map[interface{}]interface{})
+		} else {
+			kv, err = DecodeGob(b)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		ioutil.WriteFile(newSidFile, b, 0777)
+		os.Remove(oldSidFile)
+		os.Chtimes(newSidFile, time.Now(), time.Now())
+		ss := &FileSessionStore{sid: sid, values: kv}
+		return ss, nil
+	}
+
+	// if old sid file not exist, just create new sid file and return
+	newf, err := os.Create(newSidFile)
+	if err != nil {
+		return nil, err
+	}
+	newf.Close()
+	ss := &FileSessionStore{sid: sid, values: make(map[interface{}]interface{})}
+	return ss, nil
+}
+
+// remove file in save path if expired
+func gcpath(path string, info os.FileInfo, err error) error {
+	if err != nil {
+		return err
+	}
+	if info.IsDir() {
+		return nil
+	}
+	if (info.ModTime().Unix() + gcmaxlifetime) < time.Now().Unix() {
+		os.Remove(path)
+	}
+	return nil
+}
+
+type activeSession struct {
+	total int
+}
+
+func (as *activeSession) visit(paths string, f os.FileInfo, err error) error {
+	if err != nil {
+		return err
+	}
+	if f.IsDir() {
+		return nil
+	}
+	as.total = as.total + 1
+	return nil
+}
+
+func init() {
+	Register("file", filepder)
+}

at-admin/vendor/github.com/astaxie/beego/session/sess_mem.go

@@ -0,0 +1,196 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"container/list"
+	"net/http"
+	"sync"
+	"time"
+)
+
+var mempder = &MemProvider{list: list.New(), sessions: make(map[string]*list.Element)}
+
+// MemSessionStore memory session store.
+// it saved sessions in a map in memory.
+type MemSessionStore struct {
+	sid          string                      //session id
+	timeAccessed time.Time                   //last access time
+	value        map[interface{}]interface{} //session store
+	lock         sync.RWMutex
+}
+
+// Set value to memory session
+func (st *MemSessionStore) Set(key, value interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.value[key] = value
+	return nil
+}
+
+// Get value from memory session by key
+func (st *MemSessionStore) Get(key interface{}) interface{} {
+	st.lock.RLock()
+	defer st.lock.RUnlock()
+	if v, ok := st.value[key]; ok {
+		return v
+	}
+	return nil
+}
+
+// Delete in memory session by key
+func (st *MemSessionStore) Delete(key interface{}) error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	delete(st.value, key)
+	return nil
+}
+
+// Flush clear all values in memory session
+func (st *MemSessionStore) Flush() error {
+	st.lock.Lock()
+	defer st.lock.Unlock()
+	st.value = make(map[interface{}]interface{})
+	return nil
+}
+
+// SessionID get this id of memory session store
+func (st *MemSessionStore) SessionID() string {
+	return st.sid
+}
+
+// SessionRelease Implement method, no used.
+func (st *MemSessionStore) SessionRelease(w http.ResponseWriter) {
+}
+
+// MemProvider Implement the provider interface
+type MemProvider struct {
+	lock        sync.RWMutex             // locker
+	sessions    map[string]*list.Element // map in memory
+	list        *list.List               // for gc
+	maxlifetime int64
+	savePath    string
+}
+
+// SessionInit init memory session
+func (pder *MemProvider) SessionInit(maxlifetime int64, savePath string) error {
+	pder.maxlifetime = maxlifetime
+	pder.savePath = savePath
+	return nil
+}
+
+// SessionRead get memory session store by sid
+func (pder *MemProvider) SessionRead(sid string) (Store, error) {
+	pder.lock.RLock()
+	if element, ok := pder.sessions[sid]; ok {
+		go pder.SessionUpdate(sid)
+		pder.lock.RUnlock()
+		return element.Value.(*MemSessionStore), nil
+	}
+	pder.lock.RUnlock()
+	pder.lock.Lock()
+	newsess := &MemSessionStore{sid: sid, timeAccessed: time.Now(), value: make(map[interface{}]interface{})}
+	element := pder.list.PushFront(newsess)
+	pder.sessions[sid] = element
+	pder.lock.Unlock()
+	return newsess, nil
+}
+
+// SessionExist check session store exist in memory session by sid
+func (pder *MemProvider) SessionExist(sid string) bool {
+	pder.lock.RLock()
+	defer pder.lock.RUnlock()
+	if _, ok := pder.sessions[sid]; ok {
+		return true
+	}
+	return false
+}
+
+// SessionRegenerate generate new sid for session store in memory session
+func (pder *MemProvider) SessionRegenerate(oldsid, sid string) (Store, error) {
+	pder.lock.RLock()
+	if element, ok := pder.sessions[oldsid]; ok {
+		go pder.SessionUpdate(oldsid)
+		pder.lock.RUnlock()
+		pder.lock.Lock()
+		element.Value.(*MemSessionStore).sid = sid
+		pder.sessions[sid] = element
+		delete(pder.sessions, oldsid)
+		pder.lock.Unlock()
+		return element.Value.(*MemSessionStore), nil
+	}
+	pder.lock.RUnlock()
+	pder.lock.Lock()
+	newsess := &MemSessionStore{sid: sid, timeAccessed: time.Now(), value: make(map[interface{}]interface{})}
+	element := pder.list.PushFront(newsess)
+	pder.sessions[sid] = element
+	pder.lock.Unlock()
+	return newsess, nil
+}
+
+// SessionDestroy delete session store in memory session by id
+func (pder *MemProvider) SessionDestroy(sid string) error {
+	pder.lock.Lock()
+	defer pder.lock.Unlock()
+	if element, ok := pder.sessions[sid]; ok {
+		delete(pder.sessions, sid)
+		pder.list.Remove(element)
+		return nil
+	}
+	return nil
+}
+
+// SessionGC clean expired session stores in memory session
+func (pder *MemProvider) SessionGC() {
+	pder.lock.RLock()
+	for {
+		element := pder.list.Back()
+		if element == nil {
+			break
+		}
+		if (element.Value.(*MemSessionStore).timeAccessed.Unix() + pder.maxlifetime) < time.Now().Unix() {
+			pder.lock.RUnlock()
+			pder.lock.Lock()
+			pder.list.Remove(element)
+			delete(pder.sessions, element.Value.(*MemSessionStore).sid)
+			pder.lock.Unlock()
+			pder.lock.RLock()
+		} else {
+			break
+		}
+	}
+	pder.lock.RUnlock()
+}
+
+// SessionAll get count number of memory session
+func (pder *MemProvider) SessionAll() int {
+	return pder.list.Len()
+}
+
+// SessionUpdate expand time of session store by id in memory session
+func (pder *MemProvider) SessionUpdate(sid string) error {
+	pder.lock.Lock()
+	defer pder.lock.Unlock()
+	if element, ok := pder.sessions[sid]; ok {
+		element.Value.(*MemSessionStore).timeAccessed = time.Now()
+		pder.list.MoveToFront(element)
+		return nil
+	}
+	return nil
+}
+
+func init() {
+	Register("memory", mempder)
+}

at-admin/vendor/github.com/astaxie/beego/session/sess_utils.go

@@ -0,0 +1,207 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package session
+
+import (
+	"bytes"
+	"crypto/cipher"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha1"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/gob"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"time"
+
+	"github.com/astaxie/beego/utils"
+)
+
+func init() {
+	gob.Register([]interface{}{})
+	gob.Register(map[int]interface{}{})
+	gob.Register(map[string]interface{}{})
+	gob.Register(map[interface{}]interface{}{})
+	gob.Register(map[string]string{})
+	gob.Register(map[int]string{})
+	gob.Register(map[int]int{})
+	gob.Register(map[int]int64{})
+}
+
+// EncodeGob encode the obj to gob
+func EncodeGob(obj map[interface{}]interface{}) ([]byte, error) {
+	for _, v := range obj {
+		gob.Register(v)
+	}
+	buf := bytes.NewBuffer(nil)
+	enc := gob.NewEncoder(buf)
+	err := enc.Encode(obj)
+	if err != nil {
+		return []byte(""), err
+	}
+	return buf.Bytes(), nil
+}
+
+// DecodeGob decode data to map
+func DecodeGob(encoded []byte) (map[interface{}]interface{}, error) {
+	buf := bytes.NewBuffer(encoded)
+	dec := gob.NewDecoder(buf)
+	var out map[interface{}]interface{}
+	err := dec.Decode(&out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// generateRandomKey creates a random key with the given strength.
+func generateRandomKey(strength int) []byte {
+	k := make([]byte, strength)
+	if n, err := io.ReadFull(rand.Reader, k); n != strength || err != nil {
+		return utils.RandomCreateBytes(strength)
+	}
+	return k
+}
+
+// Encryption -----------------------------------------------------------------
+
+// encrypt encrypts a value using the given block in counter mode.
+//
+// A random initialization vector (http://goo.gl/zF67k) with the length of the
+// block size is prepended to the resulting ciphertext.
+func encrypt(block cipher.Block, value []byte) ([]byte, error) {
+	iv := generateRandomKey(block.BlockSize())
+	if iv == nil {
+		return nil, errors.New("encrypt: failed to generate random iv")
+	}
+	// Encrypt it.
+	stream := cipher.NewCTR(block, iv)
+	stream.XORKeyStream(value, value)
+	// Return iv + ciphertext.
+	return append(iv, value...), nil
+}
+
+// decrypt decrypts a value using the given block in counter mode.
+//
+// The value to be decrypted must be prepended by a initialization vector
+// (http://goo.gl/zF67k) with the length of the block size.
+func decrypt(block cipher.Block, value []byte) ([]byte, error) {
+	size := block.BlockSize()
+	if len(value) > size {
+		// Extract iv.
+		iv := value[:size]
+		// Extract ciphertext.
+		value = value[size:]
+		// Decrypt it.
+		stream := cipher.NewCTR(block, iv)
+		stream.XORKeyStream(value, value)
+		return value, nil
+	}
+	return nil, errors.New("decrypt: the value could not be decrypted")
+}
+
+func encodeCookie(block cipher.Block, hashKey, name string, value map[interface{}]interface{}) (string, error) {
+	var err error
+	var b []byte
+	// 1. EncodeGob.
+	if b, err = EncodeGob(value); err != nil {
+		return "", err
+	}
+	// 2. Encrypt (optional).
+	if b, err = encrypt(block, b); err != nil {
+		return "", err
+	}
+	b = encode(b)
+	// 3. Create MAC for "name|date|value". Extra pipe to be used later.
+	b = []byte(fmt.Sprintf("%s|%d|%s|", name, time.Now().UTC().Unix(), b))
+	h := hmac.New(sha1.New, []byte(hashKey))
+	h.Write(b)
+	sig := h.Sum(nil)
+	// Append mac, remove name.
+	b = append(b, sig...)[len(name)+1:]
+	// 4. Encode to base64.
+	b = encode(b)
+	// Done.
+	return string(b), nil
+}
+
+func decodeCookie(block cipher.Block, hashKey, name, value string, gcmaxlifetime int64) (map[interface{}]interface{}, error) {
+	// 1. Decode from base64.
+	b, err := decode([]byte(value))
+	if err != nil {
+		return nil, err
+	}
+	// 2. Verify MAC. Value is "date|value|mac".
+	parts := bytes.SplitN(b, []byte("|"), 3)
+	if len(parts) != 3 {
+		return nil, errors.New("Decode: invalid value format")
+	}
+
+	b = append([]byte(name+"|"), b[:len(b)-len(parts[2])]...)
+	h := hmac.New(sha1.New, []byte(hashKey))
+	h.Write(b)
+	sig := h.Sum(nil)
+	if len(sig) != len(parts[2]) || subtle.ConstantTimeCompare(sig, parts[2]) != 1 {
+		return nil, errors.New("Decode: the value is not valid")
+	}
+	// 3. Verify date ranges.
+	var t1 int64
+	if t1, err = strconv.ParseInt(string(parts[0]), 10, 64); err != nil {
+		return nil, errors.New("Decode: invalid timestamp")
+	}
+	t2 := time.Now().UTC().Unix()
+	if t1 > t2 {
+		return nil, errors.New("Decode: timestamp is too new")
+	}
+	if t1 < t2-gcmaxlifetime {
+		return nil, errors.New("Decode: expired timestamp")
+	}
+	// 4. Decrypt (optional).
+	b, err = decode(parts[1])
+	if err != nil {
+		return nil, err
+	}
+	if b, err = decrypt(block, b); err != nil {
+		return nil, err
+	}
+	// 5. DecodeGob.
+	dst, err := DecodeGob(b)
+	if err != nil {
+		return nil, err
+	}
+	return dst, nil
+}
+
+// Encoding -------------------------------------------------------------------
+
+// encode encodes a value using base64.
+func encode(value []byte) []byte {
+	encoded := make([]byte, base64.URLEncoding.EncodedLen(len(value)))
+	base64.URLEncoding.Encode(encoded, value)
+	return encoded
+}
+
+// decode decodes a cookie using base64.
+func decode(value []byte) ([]byte, error) {
+	decoded := make([]byte, base64.URLEncoding.DecodedLen(len(value)))
+	b, err := base64.URLEncoding.Decode(decoded, value)
+	if err != nil {
+		return nil, err
+	}
+	return decoded[:b], nil
+}

at-admin/vendor/github.com/astaxie/beego/session/session.go

@@ -0,0 +1,376 @@
+// Copyright 2014 beego Author. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package session provider
+//
+// Usage:
+// import(
+//   "github.com/astaxie/beego/session"
+// )
+//
+//	func init() {
+//      globalSessions, _ = session.NewManager("memory", `{"cookieName":"gosessionid", "enableSetCookie,omitempty": true, "gclifetime":3600, "maxLifetime": 3600, "secure": false, "cookieLifeTime": 3600, "providerConfig": ""}`)
+//		go globalSessions.GC()
+//	}
+//
+// more docs: http://beego.me/docs/module/session.md
+package session
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"os"
+	"time"
+)
+
+// Store contains all data for one session process with specific id.
+type Store interface {
+	Set(key, value interface{}) error     //set session value
+	Get(key interface{}) interface{}      //get session value
+	Delete(key interface{}) error         //delete session value
+	SessionID() string                    //back current sessionID
+	SessionRelease(w http.ResponseWriter) // release the resource & save data to provider & return the data
+	Flush() error                         //delete all data
+}
+
+// Provider contains global session methods and saved SessionStores.
+// it can operate a SessionStore by its id.
+type Provider interface {
+	SessionInit(gclifetime int64, config string) error
+	SessionRead(sid string) (Store, error)
+	SessionExist(sid string) bool
+	SessionRegenerate(oldsid, sid string) (Store, error)
+	SessionDestroy(sid string) error
+	SessionAll() int //get all active session
+	SessionGC()
+}
+
+var provides = make(map[string]Provider)
+
+// SLogger a helpful variable to log information about session
+var SLogger = NewSessionLog(os.Stderr)
+
+// Register makes a session provide available by the provided name.
+// If Register is called twice with the same name or if driver is nil,
+// it panics.
+func Register(name string, provide Provider) {
+	if provide == nil {
+		panic("session: Register provide is nil")
+	}
+	if _, dup := provides[name]; dup {
+		panic("session: Register called twice for provider " + name)
+	}
+	provides[name] = provide
+}
+
+//GetProvider
+func GetProvider(name string) (Provider, error) {
+	provider, ok := provides[name]
+	if !ok {
+		return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", name)
+	}
+	return provider, nil
+}
+
+// ManagerConfig define the session config
+type ManagerConfig struct {
+	CookieName              string `json:"cookieName"`
+	EnableSetCookie         bool   `json:"enableSetCookie,omitempty"`
+	Gclifetime              int64  `json:"gclifetime"`
+	Maxlifetime             int64  `json:"maxLifetime"`
+	DisableHTTPOnly         bool   `json:"disableHTTPOnly"`
+	Secure                  bool   `json:"secure"`
+	CookieLifeTime          int    `json:"cookieLifeTime"`
+	ProviderConfig          string `json:"providerConfig"`
+	Domain                  string `json:"domain"`
+	SessionIDLength         int64  `json:"sessionIDLength"`
+	EnableSidInHTTPHeader   bool   `json:"EnableSidInHTTPHeader"`
+	SessionNameInHTTPHeader string `json:"SessionNameInHTTPHeader"`
+	EnableSidInURLQuery     bool   `json:"EnableSidInURLQuery"`
+	SessionIDPrefix         string `json:"sessionIDPrefix"`
+}
+
+// Manager contains Provider and its configuration.
+type Manager struct {
+	provider Provider
+	config   *ManagerConfig
+}
+
+// NewManager Create new Manager with provider name and json config string.
+// provider name:
+// 1. cookie
+// 2. file
+// 3. memory
+// 4. redis
+// 5. mysql
+// json config:
+// 1. is https  default false
+// 2. hashfunc  default sha1
+// 3. hashkey default beegosessionkey
+// 4. maxage default is none
+func NewManager(provideName string, cf *ManagerConfig) (*Manager, error) {
+	provider, ok := provides[provideName]
+	if !ok {
+		return nil, fmt.Errorf("session: unknown provide %q (forgotten import?)", provideName)
+	}
+
+	if cf.Maxlifetime == 0 {
+		cf.Maxlifetime = cf.Gclifetime
+	}
+
+	if cf.EnableSidInHTTPHeader {
+		if cf.SessionNameInHTTPHeader == "" {
+			panic(errors.New("SessionNameInHTTPHeader is empty"))
+		}
+
+		strMimeHeader := textproto.CanonicalMIMEHeaderKey(cf.SessionNameInHTTPHeader)
+		if cf.SessionNameInHTTPHeader != strMimeHeader {
+			strErrMsg := "SessionNameInHTTPHeader (" + cf.SessionNameInHTTPHeader + ") has the wrong format, it should be like this : " + strMimeHeader
+			panic(errors.New(strErrMsg))
+		}
+	}
+
+	err := provider.SessionInit(cf.Maxlifetime, cf.ProviderConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	if cf.SessionIDLength == 0 {
+		cf.SessionIDLength = 16
+	}
+
+	return &Manager{
+		provider,
+		cf,
+	}, nil
+}
+
+// GetProvider return current manager's provider
+func (manager *Manager) GetProvider() Provider {
+	return manager.provider
+}
+
+// getSid retrieves session identifier from HTTP Request.
+// First try to retrieve id by reading from cookie, session cookie name is configurable,
+// if not exist, then retrieve id from querying parameters.
+//
+// error is not nil when there is anything wrong.
+// sid is empty when need to generate a new session id
+// otherwise return an valid session id.
+func (manager *Manager) getSid(r *http.Request) (string, error) {
+	cookie, errs := r.Cookie(manager.config.CookieName)
+	if errs != nil || cookie.Value == "" {
+		var sid string
+		if manager.config.EnableSidInURLQuery {
+			errs := r.ParseForm()
+			if errs != nil {
+				return "", errs
+			}
+
+			sid = r.FormValue(manager.config.CookieName)
+		}
+
+		// if not found in Cookie / param, then read it from request headers
+		if manager.config.EnableSidInHTTPHeader && sid == "" {
+			sids, isFound := r.Header[manager.config.SessionNameInHTTPHeader]
+			if isFound && len(sids) != 0 {
+				return sids[0], nil
+			}
+		}
+
+		return sid, nil
+	}
+
+	// HTTP Request contains cookie for sessionid info.
+	return url.QueryUnescape(cookie.Value)
+}
+
+// SessionStart generate or read the session id from http request.
+// if session id exists, return SessionStore with this id.
+func (manager *Manager) SessionStart(w http.ResponseWriter, r *http.Request) (session Store, err error) {
+	sid, errs := manager.getSid(r)
+	if errs != nil {
+		return nil, errs
+	}
+
+	if sid != "" && manager.provider.SessionExist(sid) {
+		return manager.provider.SessionRead(sid)
+	}
+
+	// Generate a new session
+	sid, errs = manager.sessionID()
+	if errs != nil {
+		return nil, errs
+	}
+
+	session, err = manager.provider.SessionRead(sid)
+	if err != nil {
+		return nil, err
+	}
+	cookie := &http.Cookie{
+		Name:     manager.config.CookieName,
+		Value:    url.QueryEscape(sid),
+		Path:     "/",
+		HttpOnly: !manager.config.DisableHTTPOnly,
+		Secure:   manager.isSecure(r),
+		Domain:   manager.config.Domain,
+	}
+	if manager.config.CookieLifeTime > 0 {
+		cookie.MaxAge = manager.config.CookieLifeTime
+		cookie.Expires = time.Now().Add(time.Duration(manager.config.CookieLifeTime) * time.Second)
+	}
+	if manager.config.EnableSetCookie {
+		http.SetCookie(w, cookie)
+	}
+	r.AddCookie(cookie)
+
+	if manager.config.EnableSidInHTTPHeader {
+		r.Header.Set(manager.config.SessionNameInHTTPHeader, sid)
+		w.Header().Set(manager.config.SessionNameInHTTPHeader, sid)
+	}
+
+	return
+}
+
+// SessionDestroy Destroy session by its id in http request cookie.
+func (manager *Manager) SessionDestroy(w http.ResponseWriter, r *http.Request) {
+	if manager.config.EnableSidInHTTPHeader {
+		r.Header.Del(manager.config.SessionNameInHTTPHeader)
+		w.Header().Del(manager.config.SessionNameInHTTPHeader)
+	}
+
+	cookie, err := r.Cookie(manager.config.CookieName)
+	if err != nil || cookie.Value == "" {
+		return
+	}
+
+	sid, _ := url.QueryUnescape(cookie.Value)
+	manager.provider.SessionDestroy(sid)
+	if manager.config.EnableSetCookie {
+		expiration := time.Now()
+		cookie = &http.Cookie{Name: manager.config.CookieName,
+			Path:     "/",
+			HttpOnly: !manager.config.DisableHTTPOnly,
+			Expires:  expiration,
+			MaxAge:   -1}
+
+		http.SetCookie(w, cookie)
+	}
+}
+
+// GetSessionStore Get SessionStore by its id.
+func (manager *Manager) GetSessionStore(sid string) (sessions Store, err error) {
+	sessions, err = manager.provider.SessionRead(sid)
+	return
+}
+
+// GC Start session gc process.
+// it can do gc in times after gc lifetime.
+func (manager *Manager) GC() {
+	manager.provider.SessionGC()
+	time.AfterFunc(time.Duration(manager.config.Gclifetime)*time.Second, func() { manager.GC() })
+}
+
+// SessionRegenerateID Regenerate a session id for this SessionStore who's id is saving in http request.
+func (manager *Manager) SessionRegenerateID(w http.ResponseWriter, r *http.Request) (session Store) {
+	sid, err := manager.sessionID()
+	if err != nil {
+		return
+	}
+	cookie, err := r.Cookie(manager.config.CookieName)
+	if err != nil || cookie.Value == "" {
+		//delete old cookie
+		session, _ = manager.provider.SessionRead(sid)
+		cookie = &http.Cookie{Name: manager.config.CookieName,
+			Value:    url.QueryEscape(sid),
+			Path:     "/",
+			HttpOnly: !manager.config.DisableHTTPOnly,
+			Secure:   manager.isSecure(r),
+			Domain:   manager.config.Domain,
+		}
+	} else {
+		oldsid, _ := url.QueryUnescape(cookie.Value)
+		session, _ = manager.provider.SessionRegenerate(oldsid, sid)
+		cookie.Value = url.QueryEscape(sid)
+		cookie.HttpOnly = true
+		cookie.Path = "/"
+	}
+	if manager.config.CookieLifeTime > 0 {
+		cookie.MaxAge = manager.config.CookieLifeTime
+		cookie.Expires = time.Now().Add(time.Duration(manager.config.CookieLifeTime) * time.Second)
+	}
+	if manager.config.EnableSetCookie {
+		http.SetCookie(w, cookie)
+	}
+	r.AddCookie(cookie)
+
+	if manager.config.EnableSidInHTTPHeader {
+		r.Header.Set(manager.config.SessionNameInHTTPHeader, sid)
+		w.Header().Set(manager.config.SessionNameInHTTPHeader, sid)
+	}
+
+	return
+}
+
+// GetActiveSession Get all active sessions count number.
+func (manager *Manager) GetActiveSession() int {
+	return manager.provider.SessionAll()
+}
+
+// SetSecure Set cookie with https.
+func (manager *Manager) SetSecure(secure bool) {
+	manager.config.Secure = secure
+}
+
+func (manager *Manager) sessionID() (string, error) {
+	b := make([]byte, manager.config.SessionIDLength)
+	n, err := rand.Read(b)
+	if n != len(b) || err != nil {
+		return "", fmt.Errorf("Could not successfully read from the system CSPRNG")
+	}
+	return manager.config.SessionIDPrefix + hex.EncodeToString(b), nil
+}
+
+// Set cookie with https.
+func (manager *Manager) isSecure(req *http.Request) bool {
+	if !manager.config.Secure {
+		return false
+	}
+	if req.URL.Scheme != "" {
+		return req.URL.Scheme == "https"
+	}
+	if req.TLS == nil {
+		return false
+	}
+	return true
+}
+
+// Log implement the log.Logger
+type Log struct {
+	*log.Logger
+}
+
+// NewSessionLog set io.Writer to create a Logger for session.
+func NewSessionLog(out io.Writer) *Log {
+	sl := new(Log)
+	sl.Logger = log.New(out, "[SESSION]", 1e9)
+	return sl
+}