1
|
|
|
<?php |
2
|
|
|
/** |
3
|
|
|
* Copyright (C) 2016 SURFnet. |
4
|
|
|
* |
5
|
|
|
* This program is free software: you can redistribute it and/or modify |
6
|
|
|
* it under the terms of the GNU Affero General Public License as |
7
|
|
|
* published by the Free Software Foundation, either version 3 of the |
8
|
|
|
* License, or (at your option) any later version. |
9
|
|
|
* |
10
|
|
|
* This program is distributed in the hope that it will be useful, |
11
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
12
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
13
|
|
|
* GNU Affero General Public License for more details. |
14
|
|
|
* |
15
|
|
|
* You should have received a copy of the GNU Affero General Public License |
16
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>. |
17
|
|
|
*/ |
18
|
|
|
|
19
|
|
|
namespace fkooman\RemoteStorage\Http; |
20
|
|
|
|
21
|
|
|
use fkooman\RemoteStorage\Http\Exception\HttpException; |
22
|
|
|
|
23
|
|
|
class Session implements SessionInterface |
24
|
|
|
{ |
25
|
|
|
public function __construct($serverName, $requestRoot, $secureOnly) |
|
|
|
|
26
|
|
|
{ |
27
|
|
|
session_set_cookie_params(0, $requestRoot, $serverName, $secureOnly, true); |
28
|
|
|
session_start(); |
29
|
|
|
|
30
|
|
|
// Make sure we have a canary set |
31
|
|
|
if (!isset($_SESSION['canary'])) { |
32
|
|
|
$this->setCanary($serverName, $requestRoot); |
33
|
|
|
} |
34
|
|
|
// Regenerate session ID every five minutes: |
35
|
|
|
if ($_SESSION['canary'] < time() - 300) { |
36
|
|
|
$this->setCanary($serverName, $requestRoot); |
37
|
|
|
} |
38
|
|
|
|
39
|
|
|
if ($serverName !== $_SESSION['serverName']) { |
40
|
|
|
throw new HttpException('session error (serverName)', 400); |
41
|
|
|
} |
42
|
|
|
|
43
|
|
|
if ($requestRoot !== $_SESSION['requestRoot']) { |
44
|
|
|
throw new HttpException('session error (requestRoot)', 400); |
45
|
|
|
} |
46
|
|
|
} |
47
|
|
|
|
48
|
|
|
public function set($key, $value) |
|
|
|
|
49
|
|
|
{ |
50
|
|
|
$_SESSION[$key] = $value; |
51
|
|
|
} |
52
|
|
|
|
53
|
|
|
public function delete($key) |
|
|
|
|
54
|
|
|
{ |
55
|
|
|
if ($this->has($key)) { |
56
|
|
|
unset($_SESSION[$key]); |
57
|
|
|
} |
58
|
|
|
} |
59
|
|
|
|
60
|
|
|
public function has($key) |
|
|
|
|
61
|
|
|
{ |
62
|
|
|
return array_key_exists($key, $_SESSION); |
63
|
|
|
} |
64
|
|
|
|
65
|
|
|
public function get($key) |
|
|
|
|
66
|
|
|
{ |
67
|
|
|
if ($this->has($key)) { |
68
|
|
|
return $_SESSION[$key]; |
69
|
|
|
} |
70
|
|
|
|
71
|
|
|
return; |
72
|
|
|
} |
73
|
|
|
|
74
|
|
|
public function destroy() |
75
|
|
|
{ |
76
|
|
|
session_destroy(); |
77
|
|
|
} |
78
|
|
|
|
79
|
|
|
private function setCanary($serverName, $requestRoot) |
|
|
|
|
80
|
|
|
{ |
81
|
|
|
session_regenerate_id(true); |
82
|
|
|
$_SESSION['canary'] = time(); |
83
|
|
|
$_SESSION['serverName'] = $serverName; |
84
|
|
|
$_SESSION['requestRoot'] = $requestRoot; |
85
|
|
|
} |
86
|
|
|
} |
87
|
|
|
|
Instead of super-globals, we recommend to explicitly inject the dependencies of your class. This makes your code less dependent on global state and it becomes generally more testable: