1
|
|
|
<?php |
2
|
|
|
/** |
3
|
|
|
* CodeIgniter |
4
|
|
|
* |
5
|
|
|
* An open source application development framework for PHP |
6
|
|
|
* |
7
|
|
|
* This content is released under the MIT License (MIT) |
8
|
|
|
* |
9
|
|
|
* Copyright (c) 2014 - 2015, British Columbia Institute of Technology |
10
|
|
|
* |
11
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy |
12
|
|
|
* of this software and associated documentation files (the "Software"), to deal |
13
|
|
|
* in the Software without restriction, including without limitation the rights |
14
|
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
15
|
|
|
* copies of the Software, and to permit persons to whom the Software is |
16
|
|
|
* furnished to do so, subject to the following conditions: |
17
|
|
|
* |
18
|
|
|
* The above copyright notice and this permission notice shall be included in |
19
|
|
|
* all copies or substantial portions of the Software. |
20
|
|
|
* |
21
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
22
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
23
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
24
|
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
25
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
26
|
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN |
27
|
|
|
* THE SOFTWARE. |
28
|
|
|
* |
29
|
|
|
* @package CodeIgniter |
30
|
|
|
* @author EllisLab Dev Team |
31
|
|
|
* @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/) |
32
|
|
|
* @copyright Copyright (c) 2014 - 2015, British Columbia Institute of Technology (http://bcit.ca/) |
33
|
|
|
* @license http://opensource.org/licenses/MIT MIT License |
34
|
|
|
* @link http://codeigniter.com |
35
|
|
|
* @since Version 3.0.0 |
36
|
|
|
* @filesource |
37
|
|
|
*/ |
38
|
|
|
defined('BASEPATH') OR exit('No direct script access allowed'); |
39
|
|
|
|
40
|
|
|
/** |
41
|
|
|
* CodeIgniter Session Files Driver |
42
|
|
|
* |
43
|
|
|
* @package CodeIgniter |
44
|
|
|
* @subpackage Libraries |
45
|
|
|
* @category Sessions |
46
|
|
|
* @author Andrey Andreev |
47
|
|
|
* @link http://codeigniter.com/user_guide/libraries/sessions.html |
48
|
|
|
*/ |
49
|
|
|
class CI_Session_files_driver extends CI_Session_driver implements SessionHandlerInterface { |
50
|
|
|
|
51
|
|
|
/** |
52
|
|
|
* Save path |
53
|
|
|
* |
54
|
|
|
* @var string |
55
|
|
|
*/ |
56
|
|
|
protected $_save_path; |
57
|
|
|
|
58
|
|
|
/** |
59
|
|
|
* File handle |
60
|
|
|
* |
61
|
|
|
* @var resource |
62
|
|
|
*/ |
63
|
|
|
protected $_file_handle; |
64
|
|
|
|
65
|
|
|
/** |
66
|
|
|
* File name |
67
|
|
|
* |
68
|
|
|
* @var resource |
69
|
|
|
*/ |
70
|
|
|
protected $_file_path; |
71
|
|
|
|
72
|
|
|
/** |
73
|
|
|
* File new flag |
74
|
|
|
* |
75
|
|
|
* @var bool |
76
|
|
|
*/ |
77
|
|
|
protected $_file_new; |
78
|
|
|
|
79
|
|
|
// ------------------------------------------------------------------------ |
80
|
|
|
|
81
|
|
|
/** |
82
|
|
|
* Class constructor |
83
|
|
|
* |
84
|
|
|
* @param array $params Configuration parameters |
85
|
|
|
* @return void |
86
|
|
|
*/ |
87
|
|
|
public function __construct(&$params) |
88
|
|
|
{ |
89
|
|
|
parent::__construct($params); |
90
|
|
|
|
91
|
|
|
if (isset($this->_config['save_path'])) |
92
|
|
|
{ |
93
|
|
|
$this->_config['save_path'] = rtrim($this->_config['save_path'], '/\\'); |
94
|
|
|
ini_set('session.save_path', $this->_config['save_path']); |
95
|
|
|
} |
96
|
|
|
else |
97
|
|
|
{ |
98
|
|
|
$this->_config['save_path'] = rtrim(ini_get('session.save_path'), '/\\'); |
99
|
|
|
} |
100
|
|
|
} |
101
|
|
|
|
102
|
|
|
// ------------------------------------------------------------------------ |
103
|
|
|
|
104
|
|
|
/** |
105
|
|
|
* Open |
106
|
|
|
* |
107
|
|
|
* Sanitizes the save_path directory. |
108
|
|
|
* |
109
|
|
|
* @param string $save_path Path to session files' directory |
110
|
|
|
* @param string $name Session cookie name |
111
|
|
|
* @return bool |
112
|
|
|
*/ |
113
|
|
|
public function open($save_path, $name) |
114
|
|
|
{ |
115
|
|
|
if ( ! is_dir($save_path)) |
116
|
|
|
{ |
117
|
|
|
if ( ! mkdir($save_path, 0700, TRUE)) |
118
|
|
|
{ |
119
|
|
|
throw new Exception("Session: Configured save path '".$this->_config['save_path']."' is not a directory, doesn't exist or cannot be created."); |
120
|
|
|
} |
121
|
|
|
} |
122
|
|
|
elseif ( ! is_writable($save_path)) |
123
|
|
|
{ |
124
|
|
|
throw new Exception("Session: Configured save path '".$this->_config['save_path']."' is not writable by the PHP process."); |
125
|
|
|
} |
126
|
|
|
|
127
|
|
|
$this->_config['save_path'] = $save_path; |
128
|
|
|
$this->_file_path = $this->_config['save_path'].DIRECTORY_SEPARATOR |
129
|
|
|
.$name // we'll use the session cookie name as a prefix to avoid collisions |
130
|
|
|
.($this->_config['match_ip'] ? md5($_SERVER['REMOTE_ADDR']) : ''); |
131
|
|
|
|
132
|
|
|
return $this->_success; |
133
|
|
|
} |
134
|
|
|
|
135
|
|
|
// ------------------------------------------------------------------------ |
136
|
|
|
|
137
|
|
|
/** |
138
|
|
|
* Read |
139
|
|
|
* |
140
|
|
|
* Reads session data and acquires a lock |
141
|
|
|
* |
142
|
|
|
* @param string $session_id Session ID |
143
|
|
|
* @return string Serialized session data |
144
|
|
|
*/ |
145
|
|
|
public function read($session_id) |
146
|
|
|
{ |
147
|
|
|
// This might seem weird, but PHP 5.6 introduces session_reset(), |
148
|
|
|
// which re-reads session data |
149
|
|
|
if ($this->_file_handle === NULL) |
150
|
|
|
{ |
151
|
|
|
// Just using fopen() with 'c+b' mode would be perfect, but it is only |
152
|
|
|
// available since PHP 5.2.6 and we have to set permissions for new files, |
153
|
|
|
// so we'd have to hack around this ... |
154
|
|
|
if (($this->_file_new = ! file_exists($this->_file_path.$session_id)) === TRUE) |
155
|
|
|
{ |
156
|
|
View Code Duplication |
if (($this->_file_handle = fopen($this->_file_path.$session_id, 'w+b')) === FALSE) |
157
|
|
|
{ |
158
|
|
|
log_message('error', "Session: File '".$this->_file_path.$session_id."' doesn't exist and cannot be created."); |
159
|
|
|
return $this->_failure; |
160
|
|
|
} |
161
|
|
|
} |
162
|
|
View Code Duplication |
elseif (($this->_file_handle = fopen($this->_file_path.$session_id, 'r+b')) === FALSE) |
163
|
|
|
{ |
164
|
|
|
log_message('error', "Session: Unable to open file '".$this->_file_path.$session_id."'."); |
165
|
|
|
return $this->_failure; |
166
|
|
|
} |
167
|
|
|
|
168
|
|
|
if (flock($this->_file_handle, LOCK_EX) === FALSE) |
169
|
|
|
{ |
170
|
|
|
log_message('error', "Session: Unable to obtain lock for file '".$this->_file_path.$session_id."'."); |
171
|
|
|
fclose($this->_file_handle); |
172
|
|
|
$this->_file_handle = NULL; |
173
|
|
|
return $this->_failure; |
174
|
|
|
} |
175
|
|
|
|
176
|
|
|
// Needed by write() to detect session_regenerate_id() calls |
177
|
|
|
$this->_session_id = $session_id; |
178
|
|
|
|
179
|
|
|
if ($this->_file_new) |
180
|
|
|
{ |
181
|
|
|
chmod($this->_file_path.$session_id, 0600); |
182
|
|
|
$this->_fingerprint = md5(''); |
183
|
|
|
return ''; |
184
|
|
|
} |
185
|
|
|
} |
186
|
|
|
// We shouldn't need this, but apparently we do ... |
187
|
|
|
// See https://github.com/bcit-ci/CodeIgniter/issues/4039 |
188
|
|
|
elseif ($this->_file_handle === FALSE) |
189
|
|
|
{ |
190
|
|
|
return $this->_failure; |
191
|
|
|
} |
192
|
|
|
else |
193
|
|
|
{ |
194
|
|
|
rewind($this->_file_handle); |
195
|
|
|
} |
196
|
|
|
|
197
|
|
|
$session_data = ''; |
198
|
|
|
for ($read = 0, $length = filesize($this->_file_path.$session_id); $read < $length; $read += strlen($buffer)) |
199
|
|
|
{ |
200
|
|
|
if (($buffer = fread($this->_file_handle, $length - $read)) === FALSE) |
201
|
|
|
{ |
202
|
|
|
break; |
203
|
|
|
} |
204
|
|
|
|
205
|
|
|
$session_data .= $buffer; |
206
|
|
|
} |
207
|
|
|
|
208
|
|
|
$this->_fingerprint = md5($session_data); |
209
|
|
|
return $session_data; |
210
|
|
|
} |
211
|
|
|
|
212
|
|
|
// ------------------------------------------------------------------------ |
213
|
|
|
|
214
|
|
|
/** |
215
|
|
|
* Write |
216
|
|
|
* |
217
|
|
|
* Writes (create / update) session data |
218
|
|
|
* |
219
|
|
|
* @param string $session_id Session ID |
220
|
|
|
* @param string $session_data Serialized session data |
221
|
|
|
* @return bool |
222
|
|
|
*/ |
223
|
|
|
public function write($session_id, $session_data) |
224
|
|
|
{ |
225
|
|
|
// If the two IDs don't match, we have a session_regenerate_id() call |
226
|
|
|
// and we need to close the old handle and open a new one |
227
|
|
|
if ($session_id !== $this->_session_id && ($this->close() === $this->_failure OR $this->read($session_id) === $this->_failure)) |
228
|
|
|
{ |
229
|
|
|
return $this->_failure; |
230
|
|
|
} |
231
|
|
|
|
232
|
|
|
if ( ! is_resource($this->_file_handle)) |
233
|
|
|
{ |
234
|
|
|
return $this->_failure; |
235
|
|
|
} |
236
|
|
|
elseif ($this->_fingerprint === md5($session_data)) |
237
|
|
|
{ |
238
|
|
|
return ( ! $this->_file_new && ! touch($this->_file_path.$session_id)) |
239
|
|
|
? $this->_failure |
240
|
|
|
: $this->_success; |
241
|
|
|
} |
242
|
|
|
|
243
|
|
|
if ( ! $this->_file_new) |
244
|
|
|
{ |
245
|
|
|
ftruncate($this->_file_handle, 0); |
246
|
|
|
rewind($this->_file_handle); |
247
|
|
|
} |
248
|
|
|
|
249
|
|
|
if (($length = strlen($session_data)) > 0) |
250
|
|
|
{ |
251
|
|
|
for ($written = 0; $written < $length; $written += $result) |
252
|
|
|
{ |
253
|
|
|
if (($result = fwrite($this->_file_handle, substr($session_data, $written))) === FALSE) |
254
|
|
|
{ |
255
|
|
|
break; |
256
|
|
|
} |
257
|
|
|
} |
258
|
|
|
|
259
|
|
|
if ( ! is_int($result)) |
260
|
|
|
{ |
261
|
|
|
$this->_fingerprint = md5(substr($session_data, 0, $written)); |
262
|
|
|
log_message('error', 'Session: Unable to write data.'); |
263
|
|
|
return $this->_failure; |
264
|
|
|
} |
265
|
|
|
} |
266
|
|
|
|
267
|
|
|
$this->_fingerprint = md5($session_data); |
268
|
|
|
return $this->_success; |
269
|
|
|
} |
270
|
|
|
|
271
|
|
|
// ------------------------------------------------------------------------ |
272
|
|
|
|
273
|
|
|
/** |
274
|
|
|
* Close |
275
|
|
|
* |
276
|
|
|
* Releases locks and closes file descriptor. |
277
|
|
|
* |
278
|
|
|
* @return bool |
279
|
|
|
*/ |
280
|
|
|
public function close() |
281
|
|
|
{ |
282
|
|
|
if (is_resource($this->_file_handle)) |
283
|
|
|
{ |
284
|
|
|
flock($this->_file_handle, LOCK_UN); |
285
|
|
|
fclose($this->_file_handle); |
286
|
|
|
|
287
|
|
|
$this->_file_handle = $this->_file_new = $this->_session_id = NULL; |
288
|
|
|
} |
289
|
|
|
|
290
|
|
|
return $this->_success; |
291
|
|
|
} |
292
|
|
|
|
293
|
|
|
// ------------------------------------------------------------------------ |
294
|
|
|
|
295
|
|
|
/** |
296
|
|
|
* Destroy |
297
|
|
|
* |
298
|
|
|
* Destroys the current session. |
299
|
|
|
* |
300
|
|
|
* @param string $session_id Session ID |
301
|
|
|
* @return bool |
302
|
|
|
*/ |
303
|
|
|
public function destroy($session_id) |
304
|
|
|
{ |
305
|
|
|
if ($this->close() === $this->_success) |
306
|
|
|
{ |
307
|
|
View Code Duplication |
if (file_exists($this->_file_path.$session_id)) |
|
|
|
|
308
|
|
|
{ |
309
|
|
|
$this->_cookie_destroy(); |
310
|
|
|
return unlink($this->_file_path.$session_id) |
311
|
|
|
? $this->_success |
312
|
|
|
: $this->_failure; |
313
|
|
|
} |
314
|
|
|
|
315
|
|
|
return $this->_success; |
316
|
|
|
} |
317
|
|
|
elseif ($this->_file_path !== NULL) |
318
|
|
|
{ |
319
|
|
|
clearstatcache(); |
320
|
|
View Code Duplication |
if (file_exists($this->_file_path.$session_id)) |
|
|
|
|
321
|
|
|
{ |
322
|
|
|
$this->_cookie_destroy(); |
323
|
|
|
return unlink($this->_file_path.$session_id) |
324
|
|
|
? $this->_success |
325
|
|
|
: $this->_failure; |
326
|
|
|
} |
327
|
|
|
|
328
|
|
|
return $this->_success; |
329
|
|
|
} |
330
|
|
|
|
331
|
|
|
return $this->_failure; |
332
|
|
|
} |
333
|
|
|
|
334
|
|
|
// ------------------------------------------------------------------------ |
335
|
|
|
|
336
|
|
|
/** |
337
|
|
|
* Garbage Collector |
338
|
|
|
* |
339
|
|
|
* Deletes expired sessions |
340
|
|
|
* |
341
|
|
|
* @param int $maxlifetime Maximum lifetime of sessions |
342
|
|
|
* @return bool |
343
|
|
|
*/ |
344
|
|
|
public function gc($maxlifetime) |
345
|
|
|
{ |
346
|
|
|
if ( ! is_dir($this->_config['save_path']) OR ($directory = opendir($this->_config['save_path'])) === FALSE) |
347
|
|
|
{ |
348
|
|
|
log_message('debug', "Session: Garbage collector couldn't list files under directory '".$this->_config['save_path']."'."); |
349
|
|
|
return $this->_failure; |
350
|
|
|
} |
351
|
|
|
|
352
|
|
|
$ts = time() - $maxlifetime; |
353
|
|
|
|
354
|
|
|
$pattern = sprintf( |
355
|
|
|
'/^%s[0-9a-f]{%d}$/', |
356
|
|
|
preg_quote($this->_config['cookie_name'], '/'), |
357
|
|
|
($this->_config['match_ip'] === TRUE ? 72 : 40) |
358
|
|
|
); |
359
|
|
|
|
360
|
|
|
while (($file = readdir($directory)) !== FALSE) |
361
|
|
|
{ |
362
|
|
|
// If the filename doesn't match this pattern, it's either not a session file or is not ours |
363
|
|
|
if ( ! preg_match($pattern, $file) |
364
|
|
|
OR ! is_file($this->_config['save_path'].DIRECTORY_SEPARATOR.$file) |
365
|
|
|
OR ($mtime = filemtime($this->_config['save_path'].DIRECTORY_SEPARATOR.$file)) === FALSE |
366
|
|
|
OR $mtime > $ts) |
367
|
|
|
{ |
368
|
|
|
continue; |
369
|
|
|
} |
370
|
|
|
|
371
|
|
|
unlink($this->_config['save_path'].DIRECTORY_SEPARATOR.$file); |
372
|
|
|
} |
373
|
|
|
|
374
|
|
|
closedir($directory); |
375
|
|
|
|
376
|
|
|
return $this->_success; |
377
|
|
|
} |
378
|
|
|
|
379
|
|
|
} |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.