OC::initSession()

Complexity

Conditions	9
Paths	20

Size

Total Lines	60
Code Lines	25

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	1	Features	0

<?php
	public static function initSession(): void {
		$request = Server::get(IRequest::class);

		// TODO: Temporary disabled again to solve issues with CalDAV/CardDAV clients like DAVx5 that use cookies
		// TODO: See https://github.com/nextcloud/server/issues/37277#issuecomment-1476366147 and the other comments
		// TODO: for further information.
		// $isDavRequest = strpos($request->getRequestUri(), '/remote.php/dav') === 0 || strpos($request->getRequestUri(), '/remote.php/webdav') === 0;
		// if ($request->getHeader('Authorization') !== '' && is_null($request->getCookie('cookie_test')) && $isDavRequest && !isset($_COOKIE['nc_session_id'])) {
		// setcookie('cookie_test', 'test', time() + 3600);
		// // Do not initialize the session if a request is authenticated directly
		// // unless there is a session cookie already sent along
		// return;
		// }

		if ($request->getServerProtocol() === 'https') {
			ini_set('session.cookie_secure', 'true');
		}

		// prevents javascript from accessing php session cookies
		ini_set('session.cookie_httponly', 'true');

		// set the cookie path to the Nextcloud directory
		$cookie_path = OC::$WEBROOT ? : '/';
		ini_set('session.cookie_path', $cookie_path);

		// Let the session name be changed in the initSession Hook
		$sessionName = OC_Util::getInstanceId();

		try {
			// set the session name to the instance id - which is unique
			$session = new \OC\Session\Internal($sessionName);

			$cryptoWrapper = Server::get(\OC\Session\CryptoWrapper::class);
			$session = $cryptoWrapper->wrapSession($session);
			self::$server->setSession($session);

			// if session can't be started break with http 500 error
		} catch (Exception $e) {
			Server::get(LoggerInterface::class)->error($e->getMessage(), ['app' => 'base','exception' => $e]);
			//show the user a detailed error page
			OC_Template::printExceptionErrorPage($e, 500);
			die();

Using exit here is not recommended.

		}

		//try to set the session lifetime
		$sessionLifeTime = self::getSessionLifeTime();
		@ini_set('gc_maxlifetime', (string)$sessionLifeTime);

It seems like you do not handle an error condition for ini_set(). This can introduce security issues, and is generally not recommended.

		// session timeout
		if ($session->exists('LAST_ACTIVITY') && (time() - $session->get('LAST_ACTIVITY') > $sessionLifeTime)) {
			if (isset($_COOKIE[session_name()])) {
				setcookie(session_name(), '', -1, self::$WEBROOT ? : '/');
			}
			Server::get(IUserSession::class)->logout();
		}

		if (!self::hasSessionRelaxedExpiry()) {
			$session->set('LAST_ACTIVITY', time());
		}
		$session->close();
	}