|
1
|
|
|
<?php |
|
2
|
|
|
/** |
|
3
|
|
|
* osCommerce Online Merchant |
|
4
|
|
|
* |
|
5
|
|
|
* @copyright (c) 2016 osCommerce; https://www.oscommerce.com |
|
6
|
|
|
* @license GPL; https://www.oscommerce.com/gpllicense.txt |
|
7
|
|
|
*/ |
|
8
|
|
|
|
|
9
|
|
|
namespace OSC\OM; |
|
10
|
|
|
|
|
11
|
|
|
use OSC\OM\OSCOM; |
|
12
|
|
|
use OSC\OM\Registry; |
|
13
|
|
|
|
|
14
|
|
|
abstract class SessionAbstract |
|
15
|
|
|
{ |
|
16
|
|
|
protected $name; |
|
17
|
|
|
protected $force_cookies = true; |
|
18
|
|
|
|
|
19
|
|
|
/** |
|
20
|
|
|
* Checks if a session exists |
|
21
|
|
|
* |
|
22
|
|
|
* @param string $session_id The ID of the session |
|
23
|
|
|
*/ |
|
24
|
|
|
|
|
25
|
|
|
abstract public function exists($session_id); |
|
26
|
|
|
|
|
27
|
|
|
/** |
|
28
|
|
|
* Verify an existing session ID and create or resume the session if the existing session ID is valid |
|
29
|
|
|
* |
|
30
|
|
|
* @return boolean |
|
31
|
|
|
*/ |
|
32
|
|
|
|
|
33
|
|
|
public function start() |
|
34
|
|
|
{ |
|
35
|
|
|
$OSCOM_Cookies = Registry::get('Cookies'); |
|
36
|
|
|
|
|
37
|
|
|
// this class handles session.use_strict_mode already |
|
38
|
|
|
if ((int)ini_get('session.use_strict_mode') === 1) { |
|
39
|
|
|
ini_set('session.use_strict_mode', 0); |
|
40
|
|
|
} |
|
41
|
|
|
|
|
42
|
|
|
if (parse_url(OSCOM::getConfig('http_server'), PHP_URL_SCHEME) == 'https') { |
|
43
|
|
|
if ((int)ini_get('session.cookie_secure') === 0) { |
|
44
|
|
|
ini_set('session.cookie_secure', 1); |
|
45
|
|
|
} |
|
46
|
|
|
} |
|
47
|
|
|
|
|
48
|
|
|
if ((int)ini_get('session.cookie_httponly') === 0) { |
|
49
|
|
|
ini_set('session.cookie_httponly', 1); |
|
50
|
|
|
} |
|
51
|
|
|
|
|
52
|
|
|
if ((int)ini_get('session.use_only_cookies') !== 1) { |
|
53
|
|
|
ini_set('session.use_only_cookies', 1); |
|
54
|
|
|
} |
|
55
|
|
|
|
|
56
|
|
|
$session_can_start = true; |
|
57
|
|
|
|
|
58
|
|
|
Registry::get('Hooks')->call('Session', 'StartBefore', [ |
|
59
|
|
|
'can_start' => &$session_can_start |
|
60
|
|
|
]); |
|
61
|
|
|
|
|
62
|
|
|
session_set_cookie_params(0, $OSCOM_Cookies->getPath(), $OSCOM_Cookies->getDomain(), (bool)ini_get('session.cookie_secure'), (bool)ini_get('session.cookie_httponly')); |
|
63
|
|
|
|
|
64
|
|
View Code Duplication |
if (isset($_GET[$this->name]) && ($this->force_cookies || !(bool)preg_match('/^[a-zA-Z0-9,-]+$/', $_GET[$this->name]) || !$this->exists($_GET[$this->name]))) { |
|
|
|
|
|
|
65
|
|
|
unset($_GET[$this->name]); |
|
66
|
|
|
} |
|
67
|
|
|
|
|
68
|
|
View Code Duplication |
if (isset($_POST[$this->name]) && ($this->force_cookies || !(bool)preg_match('/^[a-zA-Z0-9,-]+$/', $_POST[$this->name]) || !$this->exists($_POST[$this->name]))) { |
|
|
|
|
|
|
69
|
|
|
unset($_POST[$this->name]); |
|
70
|
|
|
} |
|
71
|
|
|
|
|
72
|
|
|
if (isset($_COOKIE[$this->name]) && (!(bool)preg_match('/^[a-zA-Z0-9,-]+$/', $_COOKIE[$this->name]) || !$this->exists($_COOKIE[$this->name]))) { |
|
73
|
|
|
$OSCOM_Cookies->del($this->name, $OSCOM_Cookies->getPath(), $OSCOM_Cookies->getDomain(), (bool)ini_get('session.cookie_secure'), (bool)ini_get('session.cookie_httponly')); |
|
74
|
|
|
} |
|
75
|
|
|
|
|
76
|
|
|
if ($this->force_cookies === false) { |
|
77
|
|
|
if (isset($_GET[$this->name]) && (!isset($_COOKIE[$this->name]) || ($_COOKIE[$this->name] != $_GET[$this->name]))) { |
|
78
|
|
|
session_id($_GET[$this->name]); |
|
79
|
|
|
} elseif (isset($_POST[$this->name]) && (!isset($_COOKIE[$this->name]) || ($_COOKIE[$this->name] != $_POST[$this->name]))) { |
|
80
|
|
|
session_id($_POST[$this->name]); |
|
81
|
|
|
} |
|
82
|
|
|
} |
|
83
|
|
|
|
|
84
|
|
|
if (($session_can_start === true) && session_start()) { |
|
85
|
|
|
Registry::get('Hooks')->call('Session', 'StartAfter'); |
|
86
|
|
|
|
|
87
|
|
|
return true; |
|
88
|
|
|
} |
|
89
|
|
|
|
|
90
|
|
|
return false; |
|
91
|
|
|
} |
|
92
|
|
|
|
|
93
|
|
|
public function setForceCookies($force_cookies) |
|
94
|
|
|
{ |
|
95
|
|
|
$this->force_cookies = $force_cookies; |
|
96
|
|
|
} |
|
97
|
|
|
|
|
98
|
|
|
public function isForceCookies() |
|
99
|
|
|
{ |
|
100
|
|
|
return $this->force_cookies; |
|
101
|
|
|
} |
|
102
|
|
|
|
|
103
|
|
|
/** |
|
104
|
|
|
* Checks if the session has been started or not |
|
105
|
|
|
* |
|
106
|
|
|
* @return boolean |
|
107
|
|
|
*/ |
|
108
|
|
|
|
|
109
|
|
|
public function hasStarted() { |
|
110
|
|
|
return session_status() === PHP_SESSION_ACTIVE; |
|
111
|
|
|
} |
|
112
|
|
|
|
|
113
|
|
|
/** |
|
114
|
|
|
* Deletes an existing session |
|
115
|
|
|
*/ |
|
116
|
|
|
|
|
117
|
|
|
public function kill() |
|
118
|
|
|
{ |
|
119
|
|
|
$OSCOM_Cookies = Registry::get('Cookies'); |
|
120
|
|
|
|
|
121
|
|
|
$result = true; |
|
122
|
|
|
|
|
123
|
|
|
if (isset($_COOKIE[$this->name])) { |
|
124
|
|
|
$OSCOM_Cookies->del($this->name, $OSCOM_Cookies->getPath(), $OSCOM_Cookies->getDomain(), (bool)ini_get('session.cookie_secure'), (bool)ini_get('session.cookie_httponly')); |
|
125
|
|
|
} |
|
126
|
|
|
|
|
127
|
|
|
if ($this->hasStarted()) { |
|
128
|
|
|
$_SESSION = []; |
|
129
|
|
|
|
|
130
|
|
|
$result = session_destroy(); |
|
131
|
|
|
} |
|
132
|
|
|
|
|
133
|
|
|
return $result; |
|
134
|
|
|
} |
|
135
|
|
|
|
|
136
|
|
|
/** |
|
137
|
|
|
* Delete an existing session and move the session data to a new session with a new session ID |
|
138
|
|
|
*/ |
|
139
|
|
|
|
|
140
|
|
|
public function recreate() |
|
141
|
|
|
{ |
|
142
|
|
|
$delete_flag = true; |
|
143
|
|
|
|
|
144
|
|
|
if (!$this->exists(session_id())) { |
|
145
|
|
|
$delete_flag = false; |
|
146
|
|
|
} |
|
147
|
|
|
|
|
148
|
|
|
$session_old_id = session_id(); |
|
149
|
|
|
|
|
150
|
|
|
$result = session_regenerate_id($delete_flag); |
|
151
|
|
|
|
|
152
|
|
|
if ($result === true) { |
|
153
|
|
|
Registry::get('Hooks')->call('Session', 'Recreated', [ |
|
154
|
|
|
'old_id' => $session_old_id |
|
155
|
|
|
]); |
|
156
|
|
|
|
|
157
|
|
|
return true; |
|
158
|
|
|
} |
|
159
|
|
|
|
|
160
|
|
|
return false; |
|
161
|
|
|
} |
|
162
|
|
|
|
|
163
|
|
|
/** |
|
164
|
|
|
* Sets the name of the session |
|
165
|
|
|
* |
|
166
|
|
|
* @param string $name The name of the session |
|
167
|
|
|
*/ |
|
168
|
|
|
|
|
169
|
|
|
public function setName($name) |
|
170
|
|
|
{ |
|
171
|
|
|
return session_name($name); |
|
172
|
|
|
} |
|
173
|
|
|
|
|
174
|
|
|
/** |
|
175
|
|
|
* Sets the life time of the session (in seconds) |
|
176
|
|
|
* |
|
177
|
|
|
* @param int $time The life time of the session (in seconds) |
|
178
|
|
|
*/ |
|
179
|
|
|
|
|
180
|
|
|
public function setLifeTime($time) |
|
181
|
|
|
{ |
|
182
|
|
|
return ini_set('session.gc_maxlifetime', $time); |
|
183
|
|
|
} |
|
184
|
|
|
} |
|
185
|
|
|
|
osCommerce /
oscommerce2
Loading history...
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.