Manager.php

Go to the documentation of this file.

<?php
/*
 You may not change or alter any portion of this comment or credits
 of supporting developers from this source code or any supporting source code
 which is considered copyrighted (c) material of the original comment or credit authors.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/

namespace Xoops\Core\Session;

use Xoops\Core\AttributeInterface;
use Xoops\Core\HttpRequest;

class Manager implements AttributeInterface
{
    protected $xoops = null;

    protected $httpRequest = null;

    protected $fingerprint = null;

    protected $sessionUser = null;

    public function __construct()
    {
        $this->xoops = \Xoops::getInstance();
        $this->httpRequest = HttpRequest::getInstance();
        $this->sessionUser = new SessionUser($this);
        $this->fingerprint = new Fingerprint;
    }

    public function sessionStart()
    {
        $name = $this->xoops->getConfig('session_name');
        $name = (empty($name)) ? 'xoops_session' : $name;
        $expire = intval($this->xoops->getConfig('session_expire'));
        $expire = ($expire>0) ? $expire : 300;

        $path = \XoopsBaseConfig::get('cookie-path');
        $domain = \XoopsBaseConfig::get('cookie-domain');
        $secure = $this->httpRequest->is('ssl');
        session_name($name);
        session_cache_expire($expire);

        session_set_cookie_params(0, $path, $domain, $secure, true);

        $sessionHandler = new Handler;
        session_set_save_handler($sessionHandler);

        session_register_shutdown();

        session_start();

        // if session is empty, make sure it isn't using a passed in id
        if (empty($_SESSION)) {
            $this->regenerateSession();
        }

        // Make sure the session hasn't expired, and destroy it if it has
        if (!$this->validateSession()) {
            $this->clearSession();
            return;
        }

        // Check to see if the session shows sign of hijacking attempt
        if (!$this->fingerprint->checkSessionPrint($this)) {
            $this->regenerateSession(); // session data already cleared, just needs new id
            return;
        }

        // establish valid user data in session, possibly clearing or adding from
        // RememberMe mechanism as needed
        $this->sessionUser->establish();

        // Give a 5% chance of the session id changing on any authenticated request
        //if ($this->has('xoopsUserId') && (rand(1, 100) <= 5)) {
        if ((rand(1, 100) <= 5)) {
            $this->expireSession();
        }
    }

    public function clearSession()
    {
        $this->clear();
        $this->fingerprint->checkSessionPrint($this);
        $this->regenerateSession();
    }

    public function expireSession()
    {
        // If this session is obsolete it means there already is a new id
        if ($this->has('SESSION_MANAGER_OBSOLETE')) {
            return;
        }

        // Set current session to expire in 10 seconds
        $this->set('SESSION_MANAGER_OBSOLETE', true);
        $this->set('SESSION_MANAGER_EXPIRES', time() + 10);

        // Grab current session ID and close it
        $sessionId = session_id();
        session_write_close();

        // reopen the old session
        session_id($sessionId);
        session_start();

        // Create new session without destroying the old one
        session_regenerate_id(false);

        // Now we unset the obsolete and expiration values since we ant to keep this one
        $this->remove('SESSION_MANAGER_OBSOLETE');
        $this->remove('SESSION_MANAGER_EXPIRES');
    }

    public function regenerateSession()
    {
        session_regenerate_id(true);
    }

    protected function validateSession()
    {
        // invalid to have obsolete and not expires
        if ($this->has('SESSION_MANAGER_OBSOLETE') && !$this->has('SESSION_MANAGER_EXPIRES')) {
            return false;
        }

        // if we don't have the expires key, use a future value for test
        if ($this->get('SESSION_MANAGER_EXPIRES', time()+10) < time()) {
            return false;
        }

        return true;
    }

    public function user()
    {
        return $this->sessionUser;
    }

    // access session variables as attribute object

    public function get($name, $default = null)
    {
        return (isset($_SESSION[$name])) ? $_SESSION[$name] : $default;
    }

    public function set($name, $value)
    {
        $_SESSION[$name] = $value;
    }

    public function has($name)
    {
        return isset($_SESSION[$name]);
    }

    public function remove($name)
    {
        $value = (isset($_SESSION[$name])) ? $_SESSION[$name] : null;
        unset($_SESSION[$name]);

        return $value;
    }

    public function clear()
    {
        $oldValues = $_SESSION;
        $_SESSION = array();
        return $oldValues;
    }
}