def resource_form(params, request, session)
  if not allowed_for_local_cluster(session, Permissions::READ)
    return 403, 'Permission denied'
  end

  cib_dom = get_cib_dom(session)
  @cur_resource = get_resource_by_id(params[:resource], cib_dom)
  @groups = get_resource_groups(cib_dom)
  @version = params[:version]

  if @cur_resource.instance_of?(ClusterEntity::Primitive) and !@cur_resource.stonith
    @cur_resource_group = @cur_resource.get_group
    @cur_resource_clone = @cur_resource.get_clone
    @cur_resource_ms = @cur_resource.get_master
    @resource = ResourceAgent.new(@cur_resource.agentname)
    if @cur_resource.provider == 'heartbeat'
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, HEARTBEAT_AGENTS_DIR + @cur_resource.type)
    elsif @cur_resource.provider == 'pacemaker'
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, PACEMAKER_AGENTS_DIR + @cur_resource.type)
    elsif @cur_resource._class == 'nagios'
      @resource.required_options, @resource.optional_options, @resource.info = getResourceMetadata(session, NAGIOS_METADATA_DIR + @cur_resource.type + '.xml')
    end
    @existing_resource = true
    if @resource
      erb :resourceagentform
    else
      "Can't find resource"
    end
  else
    "Resource #{params[:resource]} doesn't exist"
  end
end
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.