-
Notifications
You must be signed in to change notification settings - Fork 821
/
Session.php
619 lines (545 loc) · 17.1 KB
/
Session.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
<?php
/**
* Handles all manipulation of the session.
*
* The static methods are used to manipulate the currently active controller's session.
* The instance methods are used to manipulate a particular session. There can be more than one of these created.
*
* In order to support things like testing, the session is associated with a particular Controller. In normal usage,
* this is loaded from and saved to the regular PHP session, but for things like static-page-generation and
* unit-testing, you can create multiple Controllers, each with their own session.
*
* The instance object is basically just a way of manipulating a set of nested maps, and isn't specific to session
* data.
*
* <b>Saving Data</b>
*
* You can write a value to a users session from your PHP code using the static function {@link Session::set()}. You
* can add this line in any function or file you wish to save the value.
*
* <code>
* Session::set('MyValue', 6);
* </code>
*
* Saves the value of "6" to the MyValue session data. You can also save arrays or serialized objects in session (but
* note there may be size restrictions as to how much you can save)
*
* <code>
* // save a variable
* $var = 1;
* Session::set('MyVar', $var);
*
* // saves an array
* Session::set('MyArrayOfValues', array('1','2','3'));
*
* // saves an object (you'll have to unserialize it back)
* $object = new Object();
*
* Session::set('MyObject', serialize($object));
* </code>
*
* <b>Accessing Data</b>
*
* Once you have saved a value to the Session you can access it by using the {@link Session::get()} function.
* Like the {@link Session::set()} function you can use this anywhere in your PHP files.
*
* The values in the comments are the values stored from the previous example.
*
* <code>
* public function bar() {
* $value = Session::get('MyValue'); // $value = 6
* $var = Session::get('MyVar'); // $var = 1
* $array = Session::get('MyArrayOfValues'); // $array = array(1,2,3)
* $object = Session::get('MyObject', unserialize($object)); // $object = Object()
* }
* </code>
*
* You can also get all the values in the session at once. This is useful for debugging.
*
* <code>
* Session::get_all(); // returns an array of all the session values.
* </code>
*
* <b>Clearing Data</b>
*
* Once you have accessed a value from the Session it doesn't automatically wipe the value from the Session, you have
* to specifically remove it. To clear a value you can either delete 1 session value by the name that you saved it
*
* <code>
* Session::clear('MyValue'); // myvalue is no longer 6.
* </code>
*
* Or you can clear every single value in the session at once. Note SilverStripe stores some of its own session data
* including form and page comment information. None of this is vital but clear_all will clear everything.
*
* <code>
* Session::clear_all();
* </code>
*
* @see Cookie
* @todo This class is currently really basic and could do with a more well-thought-out implementation.
*
* @package framework
* @subpackage control
*/
class Session {
/**
* @var $timeout Set session timeout in seconds.
* @config
*/
private static $timeout = 0;
/**
* @config
* @var array
*/
private static $session_ips = array();
/**
* @config
* @var string
*/
private static $cookie_domain;
/**
* @config
* @var string
*/
private static $cookie_path;
/**
* @config
* @var string
*/
private static $session_store_path;
/**
* @config
* @var boolean
*/
private static $cookie_secure = false;
/**
* Session data
*/
protected $data = array();
protected $changedData = array();
protected function userAgent() {
if (isset($_SERVER['HTTP_USER_AGENT'])) {
return $_SERVER['HTTP_USER_AGENT'];
} else {
return '';
}
}
/**
* Start PHP session, then create a new Session object with the given start data.
*
* @param $data Can be an array of data (such as $_SESSION) or another Session object to clone.
*/
public function __construct($data) {
if($data instanceof Session) $data = $data->inst_getAll();
$this->data = $data;
if (isset($this->data['HTTP_USER_AGENT'])) {
if ($this->data['HTTP_USER_AGENT'] != $this->userAgent()) {
// Funny business detected!
$this->inst_clearAll();
Session::destroy();
Session::start();
}
}
}
/**
* Cookie domain, for example 'www.php.net'.
*
* To make cookies visible on all subdomains then the domain
* must be prefixed with a dot like '.php.net'.
*
* @deprecated 3.2 Use the "Session.cookie_domain" config setting instead
*
* @param string $domain The domain to set
*/
public static function set_cookie_domain($domain) {
Deprecation::notice('3.2', 'Use the "Session.cookie_domain" config setting instead');
Config::inst()->update('Session', 'cookie_domain', $age);
}
/**
* Get the cookie domain.
*
* @deprecated 3.2 Use the "Session.cookie_domain" config setting instead
*
* @return string
*/
public static function get_cookie_domain() {
Deprecation::notice('3.2', 'Use the "Session.cookie_domain" config setting instead');
return Config::inst()->get('Session', 'cookie_domain');
}
/**
* Path to set on the domain where the session cookie will work.
* Use a single slash ('/') for all paths on the domain.
*
* @deprecated 3.2 Use the "Session.cookie_path" config setting instead
*
* @param string $path The path to set
*/
public static function set_cookie_path($path) {
Deprecation::notice('3.2', 'Use the "Session.cookie_path" config setting instead');
Config::inst()->update('Session', 'cookie_path', $path);
}
/**
* Get the path on the domain where the session cookie will work.
*
* @deprecated 3.2 Use the "Session.cookie_path" config setting instead
*
* @return string
*/
public static function get_cookie_path() {
Deprecation::notice('3.2', 'Use the "Session.cookie_path" config setting instead');
if(Config::inst()->get('Session', 'cookie_path')) {
return Config::inst()->get('Session', 'cookie_path');
} else {
return Director::baseURL();
}
}
/**
* Secure cookie, tells the browser to only send it over SSL.
*
* @deprecated 3.2 Use the "Session.cookie_secure" config setting instead
*
* @param boolean $secure
*/
public static function set_cookie_secure($secure) {
Deprecation::notice('3.2', 'Use the "Session.cookie_secure" config setting instead');
Config::inst()->update('Session', 'cookie_secure', (bool)$secure);
}
/**
* Get if the cookie is secure
*
* @deprecated 3.2 Use the "Session.cookie_secure" config setting instead
*
* @return boolean
*/
public static function get_cookie_secure() {
Deprecation::notice('3.2', 'Use the "Session.cookie_secure" config setting instead');
return Config::inst()->get('Session', 'cookie_secure');
}
/**
* Set the session store path
*
* @deprecated 3.2 Use the "Session.session_store_path" config setting instead
*
* @param string $path Filesystem path to the session store
*/
public static function set_session_store_path($path) {
Deprecation::notice('3.2', 'Use the "Session.session_store_path" config setting instead');
Config::inst()->update('Session', 'session_store_path', $path);
}
/**
* Get the session store path
* @return string
*/
public static function get_session_store_path() {
Deprecation::notice('3.2', 'Use the "Session.session_store_path" config setting instead');
return Config::inst()->get('Session', 'session_store_path');
}
/**
* Provide an <code>array</code> of rules specifing timeouts for IPv4 address ranges or
* individual IPv4 addresses. The key is an IP address or range and the value is the time
* until the session expires in seconds. For example:
*
* Session::set_timeout_ips(array(
* '127.0.0.1' => 36000
* ));
*
* Any user connecting from 127.0.0.1 (localhost) will have their session expired after 10 hours.
*
* Session::set_timeout is used to set the timeout value for any users whose address is not in the given IP range.
*
* @deprecated 3.2 Use the "Session.timeout_ips" config setting instead
*
* @param array $session_ips Array of IPv4 rules.
*/
public static function set_timeout_ips($ips) {
Deprecation::notice('3.2', 'Use the "Session.timeout_ips" config setting instead');
Config::inst()->update('Session', 'timeout_ips', $ips);
}
/**
* Add a value to a specific key in the session array
*/
public static function add_to_array($name, $val) {
return self::current_session()->inst_addToArray($name, $val);
}
/**
* Set a key/value pair in the session
*
* @param string $name Key
* @param string $val Value
*/
public static function set($name, $val) {
return self::current_session()->inst_set($name, $val);
}
/**
* Return a specific value by session key
*
* @param string $name Key to lookup
*/
public static function get($name) {
return self::current_session()->inst_get($name);
}
/**
* Return all the values in session
*
* @return Array
*/
public static function get_all() {
return self::current_session()->inst_getAll();
}
/**
* Clear a given session key, value pair.
*
* @param string $name Key to lookup
*/
public static function clear($name) {
return self::current_session()->inst_clear($name);
}
/**
* Clear all the values
*
* @return void
*/
public static function clear_all() {
self::current_session()->inst_clearAll();
self::$default_session = null;
}
/**
* Save all the values in our session to $_SESSION
*/
public static function save() {
return self::current_session()->inst_save();
}
protected static $default_session = null;
protected static function current_session() {
if(Controller::has_curr()) {
return Controller::curr()->getSession();
} else {
if(!self::$default_session) self::$default_session = new Session(isset($_SESSION) ? $_SESSION : array());
return self::$default_session;
}
}
public function inst_set($name, $val) {
// Quicker execution path for "."-free names
if(strpos($name,'.') === false) {
$this->data[$name] = $val;
$this->changedData[$name] = $val;
} else {
$names = explode('.', $name);
// We still want to do this even if we have strict path checking for legacy code
$var = &$this->data;
$diffVar = &$this->changedData;
// Iterate twice over the names - once to see if the value needs to be changed,
// and secondly to get the changed data value. This is done to solve a problem
// where iterating over the diff var would create empty arrays, and the value
// would then not be set, inadvertently clearing session values.
foreach($names as $n) {
$var = &$var[$n];
}
if($var !== $val) {
foreach($names as $n) {
$diffVar = &$diffVar[$n];
}
$var = $val;
$diffVar = $val;
}
}
}
public function inst_addToArray($name, $val) {
$names = explode('.', $name);
// We still want to do this even if we have strict path checking for legacy code
$var = &$this->data;
$diffVar = &$this->changedData;
foreach($names as $n) {
$var = &$var[$n];
$diffVar = &$diffVar[$n];
}
$var[] = $val;
$diffVar[sizeof($var)-1] = $val;
}
public function inst_get($name) {
// Quicker execution path for "."-free names
if(strpos($name,'.') === false) {
if(isset($this->data[$name])) return $this->data[$name];
} else {
$names = explode('.', $name);
if(!isset($this->data)) {
return null;
}
$var = $this->data;
foreach($names as $n) {
if(!isset($var[$n])) {
return null;
}
$var = $var[$n];
}
return $var;
}
}
public function inst_clear($name) {
$names = explode('.', $name);
// We still want to do this even if we have strict path checking for legacy code
$var = &$this->data;
$diffVar = &$this->changedData;
foreach($names as $n) {
// don't clear a record that doesn't exist
if(!isset($var[$n])) return;
$var = &$var[$n];
}
// only loop to find data within diffVar if var is proven to exist in the above loop
foreach($names as $n) {
$diffVar = &$diffVar[$n];
}
if($var !== null) {
$var = null;
$diffVar = null;
}
}
public function inst_clearAll() {
if($this->data && is_array($this->data)) {
foreach(array_keys($this->data) as $key) {
$this->inst_clear($key);
}
}
}
public function inst_getAll() {
return $this->data;
}
public function inst_finalize() {
$this->inst_set('HTTP_USER_AGENT', $this->userAgent());
}
/**
* Save data to session
* Only save the changes, so that anyone manipulating $_SESSION directly doesn't get burned.
*/
public function inst_save() {
if($this->changedData) {
$this->inst_finalize();
if(!isset($_SESSION)) Session::start();
$this->recursivelyApply($this->changedData, $_SESSION);
}
}
/**
* Recursively apply the changes represented in $data to $dest.
* Used to update $_SESSION
*/
protected function recursivelyApply($data, &$dest) {
foreach($data as $k => $v) {
if(is_array($v)) {
if(!isset($dest[$k]) || !is_array($dest[$k])) $dest[$k] = array();
$this->recursivelyApply($v, $dest[$k]);
} else {
$dest[$k] = $v;
}
}
}
/**
* Return the changed data, for debugging purposes.
* @return array
*/
public function inst_changedData() {
return $this->changedData;
}
/**
* Sets the appropriate form message in session, with type. This will be shown once,
* for the form specified.
*
* @param formname the form name you wish to use ( usually $form->FormName() )
* @param messsage the message you wish to add to it
* @param type the type of message
*/
public static function setFormMessage($formname,$message,$type){
Session::set("FormInfo.$formname.formError.message", $message);
Session::set("FormInfo.$formname.formError.type", $type);
}
/**
* Is there a session ID in the request?
* @return bool
*/
public static function request_contains_session_id() {
$secure = Director::is_https() && Config::inst()->get('Session', 'cookie_secure');
$name = $secure ? 'SECSESSID' : session_name();
return isset($_COOKIE[$name]) || isset($_REQUEST[$name]);
}
/**
* Initialize session.
*
* @param string $sid Start the session with a specific ID
*/
public static function start($sid = null) {
$path = Config::inst()->get('Session', 'cookie_path');
if(!$path) $path = Director::baseURL();
$domain = Config::inst()->get('Session', 'cookie_domain');
$secure = Director::is_https() && Config::inst()->get('Session', 'cookie_secure');
$session_path = Config::inst()->get('Session', 'session_store_path');
$timeout = Config::inst()->get('Session', 'timeout');
if(!session_id() && !headers_sent()) {
if($domain) {
session_set_cookie_params($timeout, $path, $domain,
$secure /* secure */, true /* httponly */);
} else {
session_set_cookie_params($timeout, $path, null,
$secure /* secure */, true /* httponly */);
}
// Allow storing the session in a non standard location
if($session_path) session_save_path($session_path);
// If we want a secure cookie for HTTPS, use a seperate session name. This lets us have a
// seperate (less secure) session for non-HTTPS requests
if($secure) session_name('SECSESSID');
// @ is to supress win32 warnings/notices when session wasn't cleaned up properly
// There's nothing we can do about this, because it's an operating system function!
if($sid) session_id($sid);
@session_start();
}
// Modify the timeout behaviour so it's the *inactive* time before the session expires.
// By default it's the total session lifetime
if($timeout && !headers_sent()) {
Cookie::set(session_name(), session_id(), $timeout/86400, $path, $domain ? $domain
: null, $secure, true);
}
}
/**
* Destroy the active session.
*
* @param bool $removeCookie If set to TRUE, removes the user's cookie, FALSE does not remove
*/
public static function destroy($removeCookie = true) {
if(session_id()) {
if($removeCookie) {
$path = Config::inst()->get('Session', 'cookie_path');
if(!$path) $path = Director::baseURL();
$domain = Config::inst()->get('Session', 'cookie_domain');
$secure = Config::inst()->get('Session', 'cookie_secure');
if($domain) {
Cookie::set(session_name(), '', null, $path, $domain, $secure, true);
}
else {
Cookie::set(session_name(), '', null, $path, null, $secure, true);
}
unset($_COOKIE[session_name()]);
}
session_destroy();
// Clean up the superglobal - session_destroy does not do it.
// http://nz1.php.net/manual/en/function.session-destroy.php
unset($_SESSION);
}
}
/**
* Set the timeout of a Session value
*
* @deprecated 3.2 Use the "Session.timeout" config setting instead
*
* @param int $timeout Time until a session expires in seconds. Defaults to expire when browser is closed.
*/
public static function set_timeout($timeout) {
Deprecation::notice('3.2', 'Use the "Session.timeout" config setting instead');
Config::inst()->update('Session', 'timeout', (int)$timeout);
}
/**
* @deprecated 3.2 Use the "Session.timeout" config setting instead
*/
public static function get_timeout() {
Deprecation::notice('3.2', 'Use the "Session.timeout" config setting instead');
return Config::inst()->get('Session', 'timeout');
}
}