Skip to content

Commit c650dd8

Browse files
author
David Monllao
committed
Merge branch 'MDL-61351_34' of git://github.com/markn86/moodle into MOODLE_34_STABLE
2 parents b55fa75 + af4c2fb commit c650dd8

File tree

4 files changed

+156
-82
lines changed

4 files changed

+156
-82
lines changed

‎auth/shibboleth/classes/helper.php‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
<?php
2+
// This file is part of Moodle - http://moodle.org/
3+
//
4+
// Moodle is free software: you can redistribute it and/or modify
5+
// it under the terms of the GNU General Public License as published by
6+
// the Free Software Foundation, either version 3 of the License, or
7+
// (at your option) any later version.
8+
//
9+
// Moodle is distributed in the hope that it will be useful,
10+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
// GNU General Public License for more details.
13+
//
14+
// You should have received a copy of the GNU General Public License
15+
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
16+
17+
/**
18+
* Contains a helper class for the Shibboleth authentication plugin.
19+
*
20+
* @package auth_shibboleth
21+
* @copyright 2018 Mark Nelson <markn@moodle.com>
22+
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
23+
*/
24+
25+
namespace auth_shibboleth;
26+
27+
defined('MOODLE_INTERNAL') || die();
28+
29+
/**
30+
* The helper class for the Shibboleth authentication plugin.
31+
*
32+
* @package auth_shibboleth
33+
* @copyright 2018 Mark Nelson <markn@moodle.com>
34+
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
35+
*/
36+
class helper {
37+
38+
/**
39+
* Delete session of user using file sessions.
40+
*
41+
* @param string $spsessionid SP-provided Shibboleth Session ID
42+
* @return \SoapFault or void if everything was fine
43+
*/
44+
public static function logout_file_session($spsessionid) {
45+
global $CFG;
46+
47+
if (!empty($CFG->session_file_save_path)) {
48+
$dir = $CFG->session_file_save_path;
49+
} else {
50+
$dir = $CFG->dataroot . '/sessions';
51+
}
52+
53+
if (is_dir($dir)) {
54+
if ($dh = opendir($dir)) {
55+
// Read all session files.
56+
while (($file = readdir($dh)) !== false) {
57+
// Check if it is a file.
58+
if (is_file($dir.'/'.$file)) {
59+
// Read session file data.
60+
$data = file($dir.'/'.$file);
61+
if (isset($data[0])) {
62+
$usersession = self::unserializesession($data[0]);
63+
// Check if we have found session that shall be deleted.
64+
if (isset($usersession['SESSION']) && isset($usersession['SESSION']->shibboleth_session_id)) {
65+
// If there is a match, delete file.
66+
if ($usersession['SESSION']->shibboleth_session_id == $spsessionid) {
67+
// Delete session file.
68+
if (!unlink($dir.'/'.$file)) {
69+
return new SoapFault('LogoutError', 'Could not delete Moodle session file.');
70+
}
71+
}
72+
}
73+
}
74+
}
75+
}
76+
closedir($dh);
77+
}
78+
}
79+
}
80+
81+
/**
82+
* Delete session of user using DB sessions.
83+
*
84+
* @param string $spsessionid SP-provided Shibboleth Session ID
85+
*/
86+
public static function logout_db_session($spsessionid) {
87+
global $CFG, $DB;
88+
89+
$sessions = $DB->get_records_sql(
90+
'SELECT userid, sessdata FROM {sessions} WHERE timemodified > ?',
91+
array(time() - $CFG->sessiontimeout)
92+
);
93+
94+
foreach ($sessions as $session) {
95+
// Get user session from DB.
96+
if (session_decode(base64_decode($session->sessdata))) {
97+
if (isset($_SESSION['SESSION']) && isset($_SESSION['SESSION']->shibboleth_session_id)) {
98+
// If there is a match, kill the session.
99+
if ($_SESSION['SESSION']->shibboleth_session_id == trim($spsessionid)) {
100+
// Delete this user's sessions.
101+
\core\session\manager::kill_user_sessions($session->userid);
102+
}
103+
}
104+
}
105+
}
106+
}
107+
108+
/**
109+
* Unserialize a session string.
110+
*
111+
* @param string $serializedstring
112+
* @return array
113+
*/
114+
private static function unserializesession($serializedstring) {
115+
$variables = array();
116+
$a = preg_split("/(\w+)\|/", $serializedstring, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE);
117+
$counta = count($a);
118+
for ($i = 0; $i < $counta; $i = $i + 2) {
119+
$variables[$a[$i]] = unserialize($a[$i + 1]);
120+
}
121+
return $variables;
122+
}
123+
}

‎auth/shibboleth/logout.php‎

Lines changed: 8 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -127,75 +127,15 @@
127127
* @return SoapFault or void if everything was fine
128128
*/
129129
function LogoutNotification($spsessionid) {
130-
131-
global $CFG, $SESSION, $DB;
132-
133130
// Delete session of user using $spsessionid.
134-
if(empty($CFG->dbsessions)) {
135-
136-
// File session
137-
$dir = $CFG->dataroot .'/sessions';
138-
if (is_dir($dir)) {
139-
if ($dh = opendir($dir)) {
140-
// Read all session files
141-
while (($file = readdir($dh)) !== false) {
142-
// Check if it is a file
143-
if (is_file($dir.'/'.$file)){
144-
$session_key = preg_replace('/sess_/', '', $file);
145-
146-
// Read session file data
147-
$data = file($dir.'/'.$file);
148-
if (isset($data[0])){
149-
$usersession = unserializesession($data[0]);
150-
151-
// Check if we have found session that shall be deleted
152-
if (isset($usersession['SESSION']) && isset($usersession['SESSION']->shibboleth_session_id)) {
153-
154-
// If there is a match, delete file
155-
if ($usersession['SESSION']->shibboleth_session_id == $spsessionid) {
156-
// Delete session file
157-
if (!unlink($dir.'/'.$file)){
158-
return new SoapFault('LogoutError', 'Could not delete Moodle session file.');
159-
}
160-
}
161-
}
162-
}
163-
}
164-
}
165-
closedir($dh);
166-
}
167-
}
168-
} else {
169-
// DB Sessions.
170-
$sessions = $DB->get_records_sql(
171-
'SELECT userid, sessdata FROM {sessions} WHERE timemodified > ?',
172-
array(time() - $CFG->sessiontimeout)
173-
);
174-
foreach ($sessions as $session) {
175-
// Get user session from DB.
176-
if (session_decode(base64_decode($session->sessdata))) {
177-
if (isset($_SESSION['SESSION']) && isset($_SESSION['SESSION']->shibboleth_session_id)) {
178-
// If there is a match, kill the session.
179-
if ($_SESSION['SESSION']->shibboleth_session_id == trim($spsessionid)) {
180-
// Delete this user's sessions.
181-
\core\session\manager::kill_user_sessions($session->userid);
182-
}
183-
}
184-
}
185-
}
131+
$sessionclass = \core\session\manager::get_handler_class();
132+
switch ($sessionclass) {
133+
case '\core\session\file':
134+
return \auth_shibboleth\helper::logout_file_session($spsessionid);
135+
case '\core\session\database':
136+
return \auth_shibboleth\helper::logout_db_session($spsessionid);
137+
default:
138+
throw new moodle_exception("Shibboleth logout not implemented for '$sessionclass'");
186139
}
187140
// If no SoapFault was thrown, the function will return OK as the SP assumes.
188141
}
189-
190-
/*****************************************************************************/
191-
192-
// Same function as in adodb, but cannot be used for file session for some reason...
193-
function unserializesession($serialized_string) {
194-
$variables = array();
195-
$a = preg_split("/(\w+)\|/", $serialized_string, -1, PREG_SPLIT_NO_EMPTY | PREG_SPLIT_DELIM_CAPTURE);
196-
$counta = count($a);
197-
for ($i = 0; $i < $counta; $i = $i+2) {
198-
$variables[$a[$i]] = unserialize($a[$i+1]);
199-
}
200-
return $variables;
201-
}

‎auth/shibboleth/upgrade.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
This files describes API changes in /auth/shibboleth/*,
22
information provided here is intended especially for developers.
33

4+
=== 3.4.5 ===
5+
6+
* Moved the public function unserializesession in auth/shibboleth/logout.php to auth/shibboleth/classes/helper.php and
7+
made it private. This function should not have been used outside of this file.
8+
49
=== 3.3 ===
510

611
* The config.html file was migrated to use the admin settings API.

‎lib/classes/session/manager.php‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -123,28 +123,34 @@ public static function get_performance_info() {
123123
}
124124

125125
/**
126-
* Create handler instance.
126+
* Get fully qualified name of session handler class.
127+
*
128+
* @return string The name of the handler class
127129
*/
128-
protected static function load_handler() {
130+
public static function get_handler_class() {
129131
global $CFG, $DB;
130132

131-
if (self::$handler) {
132-
return;
133-
}
134-
135-
// Find out which handler to use.
136133
if (PHPUNIT_TEST) {
137-
$class = '\core\session\file';
138-
134+
return '\core\session\file';
139135
} else if (!empty($CFG->session_handler_class)) {
140-
$class = $CFG->session_handler_class;
141-
136+
return $CFG->session_handler_class;
142137
} else if (!empty($CFG->dbsessions) and $DB->session_lock_supported()) {
143-
$class = '\core\session\database';
138+
return '\core\session\database';
139+
}
144140

145-
} else {
146-
$class = '\core\session\file';
141+
return '\core\session\file';
142+
}
143+
144+
/**
145+
* Create handler instance.
146+
*/
147+
protected static function load_handler() {
148+
if (self::$handler) {
149+
return;
147150
}
151+
152+
// Find out which handler to use.
153+
$class = self::get_handler_class();
148154
self::$handler = new $class();
149155
}
150156

0 commit comments

Comments
 (0)