Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=49598

When updating the session cookie header, actually update it rather than adding a new header without a name.

git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@964614 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/connector/Response.java b/java/org/apache/catalina/connector/Response.java
index f414cd6..2064ea5 100644 (file)
--- a/java/org/apache/catalina/connector/Response.java
+++ b/java/org/apache/catalina/connector/Response.java
@@ -974,7 +974,7 @@ public class Response
         for (int i = 0; i < n; i++) {
             if (headers.getName(i).toString().equals(headername)) {
                 if (headers.getValue(i).toString().startsWith(startsWith)) {
-                    headers.setValue(sb.toString());
+                    headers.getValue(i).setString(sb.toString());
                     set = true;
                 }
             }

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 85f2109..f83c31d 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -162,6 +162,11 @@
         Avoid NullPointerException, when copyXML=true and META-INF/context.xml 
         does not exist. (kfujino)
       </fix>
+      <fix>
+        <bug>49598</bug>: When session is changed and the session cookie is
+        replaced, ensure that the new Set-Cookie header overwrites the old
+        Set-Cookie header. (markt) 
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">