harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Important work on the sessionhandler to maintain compatibility with php7 and php5x (x > 4)

Browse Source 
Merge branch 'master' into dev
This commit is contained in:
redmatrix 2016-04-12 19:40:19 -07:00
commit be654f1769
3 changed files with 63 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
Zotlabs/Web/Session.php
View File

@ -14,6 +14,7 @@ namespace Zotlabs\Web;
class Session {
private static $handler = null;
private static $session_started = false;
function init() {
@ -37,20 +38,19 @@ class Session {
// Force cookies to be secure (https only) if this site is SSL enabled.
// Must be done before session_start().
if(intval(\App::$config['system']['ssl_cookie_protection'])) {
$arr = session_get_cookie_params();
session_set_cookie_params(
((isset($arr['lifetime'])) ? $arr['lifetime'] : 0),
((isset($arr['path'])) ? $arr['path'] : '/'),
((isset($arr['domain'])) ? $arr['domain'] : App::get_hostname()),
((isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') ? true : false),
((isset($arr['httponly'])) ? $arr['httponly'] : true)
);
}
$arr = session_get_cookie_params();
session_set_cookie_params(
((isset($arr['lifetime'])) ? $arr['lifetime'] : 0),
((isset($arr['path'])) ? $arr['path'] : '/'),
((isset($arr['domain'])) ? $arr['domain'] : App::get_hostname()),
((isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') ? true : false),
((isset($arr['httponly'])) ? $arr['httponly'] : true)
);
}
function start() {
session_start();
self::$session_started = true;
}
/**
@ -74,10 +74,13 @@ class Session {
$old_sid = session_id();
session_regenerate_id(false);
if(self::$handler && self::$session_started) {
session_regenerate_id(true);
if(self::$handler) {
self::$handler->rename($old_sid,session_id());
// force SessionHandler record creation with the new session_id
// which occurs as a side effect of read()
self::$handler->read(session_id());
}
else
logger('no session handler');
@ -87,14 +90,21 @@ class Session {
}
setcookie(session_name(),session_id(),$newxtime);
$arr = array('expire' => $xtime);
call_hooks('new_cookie', $arr);
}
function extend_cookie() {
// if there's a long-term cookie, extend it
if(intval($_SESSION['remember_me']))
setcookie(session_name(),session_id(),(time() + (60 * 60 * 24 * 365)));
$xtime = (($_SESSION['remember_me']) ? (60 * 60 * 24 * 365) : 0 );
if($xtime)
setcookie(session_name(),session_id(),(time() + $xtime));
$arr = array('expire' => $xtime);
call_hooks('extend_cookie', $arr);
}

76
Zotlabs/Web/SessionHandler.php
View File

@ -5,24 +5,30 @@ namespace Zotlabs\Web;
class SessionHandler implements \SessionHandlerInterface {
private $session_exists;
private $session_expire;
function open ($s, $n) {
$this->session_exists = 0;
$this->session_expire = 180000;
return true;
}
// IMPORTANT: if we read the session and it doesn't exist, create an empty record.
// We rely on this due to differing PHP implementation of session_regenerate_id()
// some which call read explicitly and some that do not. So we call it explicitly
// just after sid regeneration to force a record to exist.
function read ($id) {
if(x($id))
if($id) {
$r = q("SELECT `data` FROM `session` WHERE `sid`= '%s'", dbesc($id));
if($r) {
$this->session_exists = true;
return $r[0]['data'];
if($r) {
return $r[0]['data'];
}
else {
q("INSERT INTO `session` (sid, expire) values ('%s', '%s')",
dbesc($id),
dbesc(time() + 300)
);
}
}
return '';
@ -35,30 +41,30 @@ class SessionHandler implements \SessionHandlerInterface {
return false;
}
// Can't just use $data here because we can't be certain of the serialisation algorithm
// Unless we authenticate somehow, only keep a session for 5 minutes
// The viewer can extend this by performing any web action using the
// original cookie, but this allows us to cleanup the hundreds or
// thousands of empty sessions left around from web crawlers which are
// assigned cookies on each page that they never use.
if($_SESSION && array_key_exists('remember_me',$_SESSION) && intval($_SESSION['remember_me']))
$expire = time() + (60 * 60 * 24 * 365);
else
$expire = time() + $this->session_expire;
$default_expire = time() + 300;
$expire = time() + 300;
if($this->session_exists) {
q("UPDATE `session`
SET `data` = '%s', `expire` = '%s' WHERE `sid` = '%s'",
dbesc($data),
dbesc($expire),
dbesc($id)
);
}
else {
q("INSERT INTO `session` (sid, expire, data) values ('%s', '%s', '%s')",
dbesc($id),
dbesc($default_expire),
dbesc($data)
);
if($_SESSION) {
if(array_key_exists('remember_me',$_SESSION) && intval($_SESSION['remember_me']))
$expire = time() + (60 * 60 * 24 * 365);
elseif(local_channel())
$expire = time() + (60 * 60 * 24 * 3);
elseif(remote_channel())
$expire = time() + (60 * 60 * 24 * 1);
}
q("UPDATE `session`
SET `data` = '%s', `expire` = '%s' WHERE `sid` = '%s'",
dbesc($data),
dbesc($expire),
dbesc($id)
);
return true;
}
@ -79,14 +85,4 @@ class SessionHandler implements \SessionHandlerInterface {
return true;
}
// not part of the official interface, used when regenerating the session id
function rename($old,$new) {
$v = q("UPDATE session SET sid = '%s' WHERE sid = '%s'",
dbesc($new),
dbesc($old)
);
}
}
}

3
version.inc
View File

@ -1,2 +1,3 @@
2016-04-11.1363H
2016-04-12.1364H