Quick Search:

Mode

Context

Displaying 3 lines of context. None | Less | More | Full

Other Diffs

Ignore

Blank Lines Whitespace:

Diff

1498
  
1859
  
1859
  
session.php
_> 11 <?php
  22 /*
<> 3 -  $Id: session.php 1498 2007-03-29 14:04:50Z hpdl $
   3+  $Id: session.php 1859 2009-03-06 23:21:50Z hpdl $
44 
  55   osCommerce, Open Source E-Commerce Solutions
  66   http://www.oscommerce.com
  77 
<> 8 -  Copyright (c) 2005 osCommerce
   8+  Copyright (c) 2007 osCommerce
99 
  1010   This program is free software; you can redistribute it and/or modify
  1111   it under the terms of the GNU General Public License v2 (1991)
  1212   as published by the Free Software Foundation.
  1313 */
  1414 
<>  15+/**
   16+ * The osC_Session class manages the session data and custom storage handlers
   17+ */
   18+
1519   class osC_Session {
  1620 
<> 17 -/* Private variables */
  18 -    var $_cookie_parameters,
  19 -        $_is_started = false,
  20 -        $_id,
  21 -        $_name,
  22 -        $_save_path;
   21+/**
   22+ * Holds the session cookie parameters (lifetime, path, domain, secure, httponly)
   23+ *
   24+ * @var array
   25+ * @access protected
   26+ */
2327 
<> 24 -// class constructor
  25 -    function osC_Session($name = 'sid') {
   28+    protected $_cookie_parameters = array();
   29+
   30+/**
   31+ * Defines if the session has been started or not
   32+ *
   33+ * @var boolean
   34+ * @access protected
   35+ */
   36+
   37+    protected $_is_started = false;
   38+
   39+/**
   40+ * Holds the name of the session
   41+ *
   42+ * @var string
   43+ * @access protected
   44+ */
   45+
   46+    protected $_name = 'osCsid';
   47+
   48+/**
   49+ * Holds the session id
   50+ *
   51+ * @var string
   52+ * @access protected
   53+ */
   54+
   55+    protected $_id = null;
   56+
   57+/**
   58+ * Holds the file system save path for file based session storage
   59+ *
   60+ * @var string
   61+ * @access protected
   62+ */
   63+
   64+    protected $_save_path = DIR_FS_WORK;
   65+
   66+/**
   67+ * Constructor, loads custom session handle module if defined
   68+ *
   69+ * @param string $name The name of the session
   70+ * @access public
   71+ */
   72+
   73+    public function __construct($name = null) {
2674       $this->setName($name);
<> 27 -      $this->setSavePath(DIR_FS_WORK);
2875       $this->setCookieParameters();
  2976 
<> 30 -      if (STORE_SESSIONS == 'mysql') {
  31 -        session_set_save_handler(array(&$this, '_open'),
  32 -                                 array(&$this, '_close'),
  33 -                                 array(&$this, '_read'),
  34 -                                 array(&$this, '_write'),
  35 -                                 array(&$this, '_destroy'),
  36 -                                 array(&$this, '_gc'));
   77+      if ( SERVICE_SESSION_EXPIRATION_TIME > 0 ) {
   78+        ini_set('session.gc_maxlifetime', SERVICE_SESSION_EXPIRATION_TIME * 60);
   79+      }
   80+    }
3781 
<> 38 -        register_shutdown_function('session_write_close');
   82+/**
   83+ * Destructor, closes the session
   84+ *
   85+ * @access public
   86+ */
   87+
   88+    public function __destruct() {
   89+      $this->close();
   90+    }
   91+
   92+/**
   93+ * Loads the session storage handler
   94+ *
   95+ * @param string $name The name of the session
   96+ * @access public
   97+ */
   98+
   99+    public static function load($name = null) {
   100+      $class_name = 'osC_Session';
   101+
   102+      if ( !osc_empty(basename(STORE_SESSIONS)) && file_exists(dirname(__FILE__) . '/session/' . basename(STORE_SESSIONS) . '.php') ) {
   103+        include(dirname(__FILE__) . '/session/' . basename(STORE_SESSIONS) . '.php');
   104+
   105+        $class_name = 'osC_Session_' . basename(STORE_SESSIONS);
39106       }
<>  107+
   108+      return new $class_name($name);
40109     }
  41110 
<> 42 -// class methods
  43 -    function start() {
   111+/**
   112+ * Verify an existing session ID and create or resume the session if the existing session ID is valid
   113+ *
   114+ * @access public
   115+ * @return boolean
   116+ */
   117+
   118+    public function start() {
44119       $sane_session_id = true;
  45120 
<> 46 -      if (isset($_GET[$this->_name]) && (empty($_GET[$this->_name]) || (ctype_alnum($_GET[$this->_name]) === false))) {
   121+      if ( isset($_GET[$this->_name]) && (empty($_GET[$this->_name]) || (ctype_alnum($_GET[$this->_name]) === false)) ) {
47122         $sane_session_id = false;
<> 48 -      } elseif (isset($_POST[$this->_name]) && (empty($_POST[$this->_name]) || (ctype_alnum($_POST[$this->_name]) === false))) {
   123+      } elseif ( isset($_POST[$this->_name]) && (empty($_POST[$this->_name]) || (ctype_alnum($_POST[$this->_name]) === false)) ) {
49124         $sane_session_id = false;
<> 50 -      } elseif (isset($_COOKIE[$this->_name]) && (empty($_COOKIE[$this->_name]) || (ctype_alnum($_COOKIE[$this->_name]) === false))) {
   125+      } elseif ( isset($_COOKIE[$this->_name]) && (empty($_COOKIE[$this->_name]) || (ctype_alnum($_COOKIE[$this->_name]) === false)) ) {
51126         $sane_session_id = false;
  52127       }
  53128 
<> 54 -      if ($sane_session_id === false) {
  55 -        if (isset($_COOKIE[$this->_name])) {
  56 -          setcookie($this->getName(), '', time()-42000, $this->getCookieParameters('path'), $this->getCookieParameters('domain'));
   129+      if ( $sane_session_id === false ) {
   130+        if ( isset($_COOKIE[$this->_name]) ) {
   131+          setcookie($this->_name, '', time()-42000, $this->getCookieParameters('path'), $this->getCookieParameters('domain'));
57132         }
  58133 
  59134         osc_redirect(osc_href_link(FILENAME_DEFAULT, null, 'NONSSL', false));
<> 60 -      } elseif (session_start()) {
  61 -        $this->setStarted(true);
  62 -        $this->setID();
   135+      } elseif ( session_start() ) {
   136+        $this->_is_started = true;
   137+        $this->_id = session_id();
63138 
  64139         return true;
  65140       }
  66141 
  67142       return false;
  68143     }
  69144 
<> 70 -    function hasStarted() {
   145+/**
   146+ * Checks if the session has been started or not
   147+ *
   148+ * @access public
   149+ * @return boolean
   150+ */
   151+
   152+    public function hasStarted() {
71153       return $this->_is_started;
  72154     }
  73155 
<> 74 -    function close() {
  75 -      return session_write_close();
  76 -    }
   156+/**
   157+ * Closes the session and writes the session data to the storage handler
   158+ *
   159+ * @access public
   160+ */
77161 
<> 78 -    function destroy() {
  79 -      if (isset($_COOKIE[$this->_name])) {
  80 -        unset($_COOKIE[$this->_name]);
   162+    public function close() {
   163+      if ( $this->_is_started === true ) {
   164+        $this->_is_started = false;
   165+
   166+        return session_write_close();
81167       }
<>  168+    }
82169 
<> 83 -      if (STORE_SESSIONS == '') {
  84 -        if (file_exists($this->_save_path . $this->_id)) {
  85 -          @unlink($this->_save_path . $this->_id);
   170+/**
   171+ * Deletes an existing session
   172+ *
   173+ * @access public
   174+ */
   175+
   176+    public function destroy() {
   177+      if ( $this->_is_started === true ) {
   178+        if ( isset($_COOKIE[$this->_name]) ) {
   179+          setcookie($this->_name, '', time()-42000, $this->getCookieParameters('path'), $this->getCookieParameters('domain'));
86180         }
<> 87 -      }
88181 
<> 89 -      return session_destroy();
   182+        $this->delete();
   183+
   184+        return session_destroy();
   185+      }
90186     }
  91187 
<> 92 -    function recreate() {
  93 -      $session_backup = $_SESSION;
   188+/**
   189+ * Deletes an existing session from the storage handler
   190+ *
   191+ * @param string $id The ID of the session
   192+ * @access public
   193+ */
94194 
<> 95 -      $this->destroy();
   195+    public function delete($id = null) {
   196+      if ( empty($id) ) {
   197+        $id = $this->_id;
   198+      }
96199 
<> 97 -      $this->osC_Session();
   200+      if ( file_exists($this->_save_path . '/' . $id) ) {
   201+        @unlink($this->_save_path . '/' . $id);
   202+      }
   203+    }
98204 
<> 99 -      $this->start();
   205+/**
   206+ * Delete an existing session and move the session data to a new session with a new session ID
   207+ *
   208+ * @access public
   209+ */
100210 
<> 101 -      $_SESSION = $session_backup;
  102 -
  103 -      unset($session_backup);
   211+    public function recreate() {
   212+      if ( $this->_is_started === true ) {
   213+        return session_regenerate_id(true);
   214+      }
104215     }
  105216 
<> 106 -    function getSavePath() {
   217+/**
   218+ * Return the session file based storage location
   219+ *
   220+ * @access public
   221+ * @return string
   222+ */
   223+
   224+    public function getSavePath() {
107225       return $this->_save_path;
  108226     }
  109227 
<> 110 -    function getID() {
   228+/**
   229+ * Return the session ID
   230+ *
   231+ * @access public
   232+ * @return string
   233+ */
   234+
   235+    public function getID() {
111236       return $this->_id;
  112237     }
  113238 
<> 114 -    function getName() {
   239+/**
   240+ * Return the name of the session
   241+ *
   242+ * @access public
   243+ * @return string
   244+ */
   245+
   246+    public function getName() {
115247       return $this->_name;
  116248     }
  117249 
<> 118 -    function setName($name) {
   250+/**
   251+ * Sets the name of the session
   252+ *
   253+ * @param string $name The name of the session
   254+ * @access public
   255+ */
   256+
   257+    public function setName($name) {
   258+      if ( empty($name) ) {
   259+        $name = 'osCsid';
   260+      }
   261+
119262       session_name($name);
  120263 
  121264       $this->_name = session_name();
  122265     }
  123266 
<> 124 -    function setID() {
  125 -      $this->_id = session_id();
  126 -    }
   267+/**
   268+ * Sets the storage location for the file based storage handler
   269+ *
   270+ * @param string $path The file path to store the session data in
   271+ * @access public
   272+ */
127273 
<> 128 -    function setSavePath($path) {
  129 -      if (substr($path, -1) == '/') {
   274+    public function setSavePath($path) {
   275+      if ( substr($path, -1) == '/' ) {
130276         $path = substr($path, 0, -1);
  131277       }
  132278 
      
 !
 
…
135281       $this->_save_path = session_save_path();
  136282     }
  137283 
<> 138 -    function setStarted($state) {
  139 -      if ($state === true) {
  140 -        $this->_is_started = true;
  141 -      } else {
  142 -        $this->_is_started = false;
  143 -      }
  144 -    }
   284+/**
   285+ * Sets the cookie parameters for the session (lifetime, path, domain, secure, httponly)
   286+ *
   287+ * @param integer $lifetime The amount of minutes to keep a cookie active for
   288+ * @param string $path The web path of the online store to limit cookies to
   289+ * @param string $domain The domain of the online store to limit cookies to
   290+ * @param boolean $secure Only access cookies over a secure HTTPS connection
   291+ * @param boolean $httponly Only access cookies over a HTTP protocol (disallows javascript access to cookies)
   292+ * @access public
   293+ */
145294 
<> 146 -    function setCookieParameters($lifetime = 0, $path = false, $domain = false, $secure = false) {
   295+    public function setCookieParameters($lifetime = null, $path = null, $domain = null, $secure = false, $httponly = false) {
147296       global $request_type;
  148297 
<> 149 -      if ($path === false) {
   298+      if ( !is_numeric($lifetime) ) {
   299+        $lifetime = SERVICE_SESSION_EXPIRATION_TIME * 60;
   300+      }
   301+
   302+      if ( empty($path) ) {
150303         $path = (($request_type == 'NONSSL') ? HTTP_COOKIE_PATH : HTTPS_COOKIE_PATH);
  151304       }
  152305 
<> 153 -      if ($domain === false) {
   306+      if ( empty($domain) ) {
154307         $domain = (($request_type == 'NONSSL') ? HTTP_COOKIE_DOMAIN : HTTPS_COOKIE_DOMAIN);
  155308       }
  156309 
<> 157 -      return session_set_cookie_params($lifetime, $path, $domain, $secure);
   310+      return session_set_cookie_params($lifetime, $path, $domain, $secure, $httponly);
158311     }
  159312 
<> 160 -    function getCookieParameters($key = '') {
  161 -      if (isset($this->_cookie_parameters) === false) {
   313+/**
   314+ * Returns the cookie parameters for the session (lifetime, path, domain, secure, httponly)
   315+ *
   316+ * @param string $key If specified, return only the value of this cookie parameter setting
   317+ * @access public
   318+ */
   319+
   320+    public function getCookieParameters($key = null) {
   321+      if ( empty($this->_cookie_parameters) ) {
162322         $this->_cookie_parameters = session_get_cookie_params();
  163323       }
  164324 
<> 165 -      if (isset($this->_cookie_parameters[$key])) {
   325+      if ( !empty($key) ) {
166326         return $this->_cookie_parameters[$key];
  167327       }
  168328 
  169329       return $this->_cookie_parameters;
  170330     }
<> 171 -
  172 -    function _open() {
  173 -      return true;
  174 -    }
  175 -
  176 -    function _close() {
  177 -      return true;
  178 -    }
  179 -
  180 -    function _read($key) {
  181 -      global $osC_Database;
  182 -
  183 -      $Qsession = $osC_Database->query('select value from :table_sessions where sesskey = :sesskey and expiry > :expiry');
  184 -      $Qsession->bindRaw(':table_sessions', TABLE_SESSIONS);
  185 -      $Qsession->bindValue(':sesskey', $key);
  186 -      $Qsession->bindRaw(':expiry', time());
  187 -      $Qsession->execute();
  188 -
  189 -      if ($Qsession->numberOfRows() > 0) {
  190 -        $value = $Qsession->value('value');
  191 -
  192 -        $Qsession->freeResult();
  193 -
  194 -        return $value;
  195 -      }
  196 -
  197 -      return false;
  198 -    }
  199 -
  200 -    function _write($key, $value) {
  201 -      global $osC_Database;
  202 -
  203 -      if (!$SESS_LIFE = get_cfg_var('session.gc_maxlifetime')) {
  204 -        $SESS_LIFE = 1440;
  205 -      }
  206 -
  207 -      $expiry = time() + $SESS_LIFE;
  208 -
  209 -      $Qsession = $osC_Database->query('select count(*) as total from :table_sessions where sesskey = :sesskey');
  210 -      $Qsession->bindRaw(':table_sessions', TABLE_SESSIONS);
  211 -      $Qsession->bindValue(':sesskey', $key);
  212 -      $Qsession->execute();
  213 -
  214 -      if ($Qsession->valueInt('total') > 0) {
  215 -        $Qsession = $osC_Database->query('update :table_sessions set expiry = :expiry, value = :value where sesskey = :sesskey');
  216 -      } else {
  217 -        $Qsession = $osC_Database->query('insert into :table_sessions values (:sesskey, :expiry, :value)');
  218 -      }
  219 -      $Qsession->bindRaw(':table_sessions', TABLE_SESSIONS);
  220 -      $Qsession->bindValue(':sesskey', $key);
  221 -      $Qsession->bindValue(':expiry', $expiry);
  222 -      $Qsession->bindValue(':value', $value);
  223 -
  224 -      if ($Qsession->execute()) {
  225 -        $write = true;
  226 -      } else {
  227 -        $write = false;
  228 -      }
  229 -
  230 -      $Qsession->freeResult();
  231 -
  232 -      return $write;
  233 -    }
  234 -
  235 -    function _destroy($key) {
  236 -      global $osC_Database;
  237 -
  238 -      $Qsession = $osC_Database->query('delete from :table_sessions where sesskey = :sesskey');
  239 -      $Qsession->bindRaw(':table_sessions', TABLE_SESSIONS);
  240 -      $Qsession->bindValue(':sesskey', $key);
  241 -      $Qsession->execute();
  242 -
  243 -      $Qsession->freeResult();
  244 -    }
  245 -
  246 -    function _gc($maxlifetime) {
  247 -      global $osC_Database;
  248 -
  249 -      $Qsession = $osC_Database->query('delete from :table_sessions where expiry < :expiry');
  250 -      $Qsession->bindRaw(':table_sessions', TABLE_SESSIONS);
  251 -      $Qsession->bindValue(':expiry', time());
  252 -      $Qsession->execute();
  253 -
  254 -      $Qsession->freeResult();
  255 -    }
<_ 256331   }
  257332 ?>