Internal.php 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2016, ownCloud, Inc.
  5. *
  6. * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
  7. * @author cetra3 <peter@parashift.com.au>
  8. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  9. * @author Lukas Reschke <lukas@statuscode.ch>
  10. * @author MartB <mart.b@outlook.de>
  11. * @author Morris Jobke <hey@morrisjobke.de>
  12. * @author Robin Appelman <robin@icewind.nl>
  13. * @author Roeland Jago Douma <roeland@famdouma.nl>
  14. * @author Thomas Müller <thomas.mueller@tmit.eu>
  15. * @author Victor Dubiniuk <dubiniuk@owncloud.com>
  16. *
  17. * @license AGPL-3.0
  18. *
  19. * This code is free software: you can redistribute it and/or modify
  20. * it under the terms of the GNU Affero General Public License, version 3,
  21. * as published by the Free Software Foundation.
  22. *
  23. * This program is distributed in the hope that it will be useful,
  24. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. * GNU Affero General Public License for more details.
  27. *
  28. * You should have received a copy of the GNU Affero General Public License, version 3,
  29. * along with this program. If not, see <http://www.gnu.org/licenses/>
  30. *
  31. */
  32. namespace OC\Session;
  33. use OC\Authentication\Exceptions\InvalidTokenException;
  34. use OC\Authentication\Token\IProvider;
  35. use OCP\Session\Exceptions\SessionNotAvailableException;
  36. /**
  37. * Class Internal
  38. *
  39. * wrap php's internal session handling into the Session interface
  40. *
  41. * @package OC\Session
  42. */
  43. class Internal extends Session {
  44. /**
  45. * @param string $name
  46. * @throws \Exception
  47. */
  48. public function __construct(string $name) {
  49. set_error_handler([$this, 'trapError']);
  50. $this->invoke('session_name', [$name]);
  51. try {
  52. $this->startSession();
  53. } catch (\Exception $e) {
  54. setcookie($this->invoke('session_name'), '', -1, \OC::$WEBROOT ?: '/');
  55. }
  56. restore_error_handler();
  57. if (!isset($_SESSION)) {
  58. throw new \Exception('Failed to start session');
  59. }
  60. }
  61. /**
  62. * @param string $key
  63. * @param integer $value
  64. */
  65. public function set(string $key, $value) {
  66. $reopened = $this->reopen();
  67. $_SESSION[$key] = $value;
  68. if ($reopened) {
  69. $this->close();
  70. }
  71. }
  72. /**
  73. * @param string $key
  74. * @return mixed
  75. */
  76. public function get(string $key) {
  77. if (!$this->exists($key)) {
  78. return null;
  79. }
  80. return $_SESSION[$key];
  81. }
  82. /**
  83. * @param string $key
  84. * @return bool
  85. */
  86. public function exists(string $key): bool {
  87. return isset($_SESSION[$key]);
  88. }
  89. /**
  90. * @param string $key
  91. */
  92. public function remove(string $key) {
  93. if (isset($_SESSION[$key])) {
  94. unset($_SESSION[$key]);
  95. }
  96. }
  97. public function clear() {
  98. $this->reopen();
  99. $this->invoke('session_unset');
  100. $this->regenerateId();
  101. $this->startSession(true);
  102. $_SESSION = [];
  103. }
  104. public function close() {
  105. $this->invoke('session_write_close');
  106. parent::close();
  107. }
  108. /**
  109. * Wrapper around session_regenerate_id
  110. *
  111. * @param bool $deleteOldSession Whether to delete the old associated session file or not.
  112. * @param bool $updateToken Wheater to update the associated auth token
  113. * @return void
  114. */
  115. public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
  116. $this->reopen();
  117. $oldId = null;
  118. if ($updateToken) {
  119. // Get the old id to update the token
  120. try {
  121. $oldId = $this->getId();
  122. } catch (SessionNotAvailableException $e) {
  123. // We can't update a token if there is no previous id
  124. $updateToken = false;
  125. }
  126. }
  127. try {
  128. @session_regenerate_id($deleteOldSession);
  129. } catch (\Error $e) {
  130. $this->trapError($e->getCode(), $e->getMessage());
  131. }
  132. if ($updateToken) {
  133. // Get the new id to update the token
  134. $newId = $this->getId();
  135. /** @var IProvider $tokenProvider */
  136. $tokenProvider = \OC::$server->query(IProvider::class);
  137. try {
  138. $tokenProvider->renewSessionToken($oldId, $newId);
  139. } catch (InvalidTokenException $e) {
  140. // Just ignore
  141. }
  142. }
  143. }
  144. /**
  145. * Wrapper around session_id
  146. *
  147. * @return string
  148. * @throws SessionNotAvailableException
  149. * @since 9.1.0
  150. */
  151. public function getId(): string {
  152. $id = $this->invoke('session_id', [], true);
  153. if ($id === '') {
  154. throw new SessionNotAvailableException();
  155. }
  156. return $id;
  157. }
  158. /**
  159. * @throws \Exception
  160. */
  161. public function reopen(): bool {
  162. if ($this->sessionClosed) {
  163. $this->startSession(false, false);
  164. $this->sessionClosed = false;
  165. return true;
  166. }
  167. return false;
  168. }
  169. /**
  170. * @param int $errorNumber
  171. * @param string $errorString
  172. * @throws \ErrorException
  173. */
  174. public function trapError(int $errorNumber, string $errorString) {
  175. if ($errorNumber & E_ERROR) {
  176. throw new \ErrorException($errorString);
  177. }
  178. }
  179. /**
  180. * @throws \Exception
  181. */
  182. private function validateSession() {
  183. if ($this->sessionClosed) {
  184. throw new SessionNotAvailableException('Session has been closed - no further changes to the session are allowed');
  185. }
  186. }
  187. /**
  188. * @param string $functionName the full session_* function name
  189. * @param array $parameters
  190. * @param bool $silence whether to suppress warnings
  191. * @throws \ErrorException via trapError
  192. * @return mixed
  193. */
  194. private function invoke(string $functionName, array $parameters = [], bool $silence = false) {
  195. try {
  196. if ($silence) {
  197. return @call_user_func_array($functionName, $parameters);
  198. } else {
  199. return call_user_func_array($functionName, $parameters);
  200. }
  201. } catch (\Error $e) {
  202. $this->trapError($e->getCode(), $e->getMessage());
  203. }
  204. }
  205. private function startSession(bool $silence = false, bool $readAndClose = true) {
  206. $sessionParams = ['cookie_samesite' => 'Lax'];
  207. if (\OC::hasSessionRelaxedExpiry()) {
  208. $sessionParams['read_and_close'] = $readAndClose;
  209. }
  210. $this->invoke('session_start', [$sessionParams], $silence);
  211. }
  212. }