Session::getCsrfToken() - Code Metrics - Inspection of "Fix: #2901 - add captcha to deter spam messages/re..." - fisharebest/webtrees - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 8246ff...70ca9c )

by Greg

created 2019-12-22 21:20 UTC

Session::getCsrfToken() A

↳ Parent: Session

Complexity

Conditions	2
Paths	2

Size

Total Lines	7
Code Lines	3

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	2
eloc	3
nc	2
nop	0
dl	0
loc	7
rs	10
c	0
b	0
f	0

<?php

/**
 * webtrees: online genealogy
 * Copyright (C) 2019 webtrees development team
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

declare(strict_types=1);

namespace Fisharebest\Webtrees;

use Illuminate\Support\Str;
use Psr\Http\Message\ServerRequestInterface;

use function array_map;
use function explode;
use function implode;
use function parse_url;
use function session_name;
use function session_regenerate_id;
use function session_register_shutdown;
use function session_set_cookie_params;
use function session_set_save_handler;
use function session_start;
use function session_status;
use function session_write_close;

use const PHP_SESSION_ACTIVE;
use const PHP_URL_HOST;
use const PHP_URL_PATH;
use const PHP_URL_SCHEME;

/**
 * Session handling
 */
class Session
{
    private const SESSION_NAME = 'WT2_SESSION';

    /**
     * Start a session
     *
     * @param ServerRequestInterface $request
     *
     * @return void
     */
    public static function start(ServerRequestInterface $request): void
    {
        // Store sessions in the database
        session_set_save_handler(new SessionDatabaseHandler($request));

        $url    = $request->getAttribute('base_url');
        $secure = parse_url($url, PHP_URL_SCHEME) === 'https';
        $domain = parse_url($url, PHP_URL_HOST);
        $path   = parse_url($url, PHP_URL_PATH) ?? '';

        // Paths containing UTF-8 characters need special handling.
        $path = implode('/', array_map('rawurlencode', explode('/', $path)));

        session_name(self::SESSION_NAME);
        session_register_shutdown();
        session_set_cookie_params(0, $path . '/', $domain, $secure, true);
        session_start();

        // A new session? Prevent session fixation attacks by choosing a new session ID.
        if (self::get('initiated') !== true) {
            self::regenerate(true);
            self::put('initiated', true);
        }
    }

    /**
     * Save/close the session.  This releases the session lock.
     * Closing early can help concurrent connections.
     */
    public static function save(): void
    {
        if (session_status() === PHP_SESSION_ACTIVE) {
            session_write_close();
        }
    }

    /**
     * Read a value from the session
     *
     * @param string $name
     * @param mixed  $default
     *
     * @return mixed
     */
    public static function get(string $name, $default = null)
    {
        return $_SESSION[$name] ?? $default;
    }

    /**
     * Read a value from the session and remove it.
     *
     * @param string $name
     * @param mixed  $default
     *
     * @return mixed
     */
    public static function pull(string $name, $default = null)
    {
        $value = self::get($name, $default);
        self::forget($name);

        return $value;
    }

    /**
     * After any change in authentication level, we should use a new session ID.
     *
     * @param bool $destroy
     *
     * @return void
     */
    public static function regenerate(bool $destroy = false): void
    {
        if ($destroy) {
            self::clear();
        }

        if (session_status() === PHP_SESSION_ACTIVE) {
            session_regenerate_id($destroy);
        }
    }

    /**
     * Remove all stored data from the session.
     *
     * @return void
     */
    public static function clear(): void
    {
        $_SESSION = [];
    }

    /**
     * Write a value to the session
     *
     * @param string $name
     * @param mixed  $value
     *
     * @return void
     */
    public static function put(string $name, $value): void
    {
        $_SESSION[$name] = $value;
    }

    /**
     * Remove a value from the session
     *
     * @param string $name
     *
     * @return void
     */
    public static function forget(string $name): void
    {
        unset($_SESSION[$name]);
    }

    /**
     * Cross-Site Request Forgery tokens - ensure that the user is submitting
     * a form that was generated by the current session.
     *
     * @return string
     */
    public static function getCsrfToken(): string
    {
        if (!self::has('CSRF_TOKEN')) {
            self::put('CSRF_TOKEN', Str::random(32));
        }

        return self::get('CSRF_TOKEN');
    }

    /**
     * Does a session variable exist?
     *
     * @param string $name
     *
     * @return bool
     */
    public static function has(string $name): bool
    {
        return isset($_SESSION[$name]);
    }
}


1			<?php
2
3			/**
4			* webtrees: online genealogy
5			* Copyright (C) 2019 webtrees development team
6			* This program is free software: you can redistribute it and/or modify
7			* it under the terms of the GNU General Public License as published by
8			* the Free Software Foundation, either version 3 of the License, or
9			* (at your option) any later version.
10			* This program is distributed in the hope that it will be useful,
11			* but WITHOUT ANY WARRANTY; without even the implied warranty of
12			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13			* GNU General Public License for more details.
14			* You should have received a copy of the GNU General Public License
15			* along with this program. If not, see <http://www.gnu.org/licenses/>.
16			*/
17
18			declare(strict_types=1);
19
20			namespace Fisharebest\Webtrees;
21
22			use Illuminate\Support\Str;
23			use Psr\Http\Message\ServerRequestInterface;
24
25			use function array_map;
26			use function explode;
27			use function implode;
28			use function parse_url;
29			use function session_name;
30			use function session_regenerate_id;
31			use function session_register_shutdown;
32			use function session_set_cookie_params;
33			use function session_set_save_handler;
34			use function session_start;
35			use function session_status;
36			use function session_write_close;
37
38			use const PHP_SESSION_ACTIVE;
39			use const PHP_URL_HOST;
40			use const PHP_URL_PATH;
41			use const PHP_URL_SCHEME;
42
43			/**
44			* Session handling
45			*/
46			class Session
47			{
48			private const SESSION_NAME = 'WT2_SESSION';
49
50			/**
51			* Start a session
52			*
53			* @param ServerRequestInterface $request
54			*
55			* @return void
56			*/
57			public static function start(ServerRequestInterface $request): void
58			{
59			// Store sessions in the database
60			session_set_save_handler(new SessionDatabaseHandler($request));
61
62			$url = $request->getAttribute('base_url');
63			$secure = parse_url($url, PHP_URL_SCHEME) === 'https';
64			$domain = parse_url($url, PHP_URL_HOST);
65			$path = parse_url($url, PHP_URL_PATH) ?? '';
66
67			// Paths containing UTF-8 characters need special handling.
68			$path = implode('/', array_map('rawurlencode', explode('/', $path)));
69
70			session_name(self::SESSION_NAME);
71			session_register_shutdown();
72			session_set_cookie_params(0, $path . '/', $domain, $secure, true);
73			session_start();
74
75			// A new session? Prevent session fixation attacks by choosing a new session ID.
76			if (self::get('initiated') !== true) {
77			self::regenerate(true);
78			self::put('initiated', true);
79			}
80			}
81
82			/**
83			* Save/close the session. This releases the session lock.
84			* Closing early can help concurrent connections.
85			*/
86			public static function save(): void
87			{
88			if (session_status() === PHP_SESSION_ACTIVE) {
89			session_write_close();
90			}
91			}
92
93			/**
94			* Read a value from the session
95			*
96			* @param string $name
97			* @param mixed $default
98			*
99			* @return mixed
100			*/
101			public static function get(string $name, $default = null)
102			{
103			return $_SESSION[$name] ?? $default;
104			}
105
106			/**
107			* Read a value from the session and remove it.
108			*
109			* @param string $name
110			* @param mixed $default
111			*
112			* @return mixed
113			*/
114			public static function pull(string $name, $default = null)
115			{
116			$value = self::get($name, $default);
117			self::forget($name);
118
119			return $value;
120			}
121
122			/**
123			* After any change in authentication level, we should use a new session ID.
124			*
125			* @param bool $destroy
126			*
127			* @return void
128			*/
129			public static function regenerate(bool $destroy = false): void
130			{
131			if ($destroy) {
132			self::clear();
133			}
134
135			if (session_status() === PHP_SESSION_ACTIVE) {
136			session_regenerate_id($destroy);
137			}
138			}
139
140			/**
141			* Remove all stored data from the session.
142			*
143			* @return void
144			*/
145			public static function clear(): void
146			{
147			$_SESSION = [];
148			}
149
150			/**
151			* Write a value to the session
152			*
153			* @param string $name
154			* @param mixed $value
155			*
156			* @return void
157			*/
158			public static function put(string $name, $value): void
159			{
160			$_SESSION[$name] = $value;
161			}
162
163			/**
164			* Remove a value from the session
165			*
166			* @param string $name
167			*
168			* @return void
169			*/
170			public static function forget(string $name): void
171			{
172			unset($_SESSION[$name]);
173			}
174
175			/**
176			* Cross-Site Request Forgery tokens - ensure that the user is submitting
177			* a form that was generated by the current session.
178			*
179			* @return string
180			*/
181			public static function getCsrfToken(): string
182			{
183			if (!self::has('CSRF_TOKEN')) {
184			self::put('CSRF_TOKEN', Str::random(32));
185			}
186
187			return self::get('CSRF_TOKEN');
188			}
189
190			/**
191			* Does a session variable exist?
192			*
193			* @param string $name
194			*
195			* @return bool
196			*/
197			public static function has(string $name): bool
198			{
199			return isset($_SESSION[$name]);
200			}
201			}
202

fisharebest / webtrees

Push — master ( 8246ff...70ca9c )

Session::getCsrfToken() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like