Internal.php 5.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2016, ownCloud, Inc.
  5. *
  6. * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
  7. * @author cetra3 <peter@parashift.com.au>
  8. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  9. * @author Lukas Reschke <lukas@statuscode.ch>
  10. * @author MartB <mart.b@outlook.de>
  11. * @author Morris Jobke <hey@morrisjobke.de>
  12. * @author Robin Appelman <robin@icewind.nl>
  13. * @author Roeland Jago Douma <roeland@famdouma.nl>
  14. * @author Thomas Müller <thomas.mueller@tmit.eu>
  15. * @author Victor Dubiniuk <dubiniuk@owncloud.com>
  16. *
  17. * @license AGPL-3.0
  18. *
  19. * This code is free software: you can redistribute it and/or modify
  20. * it under the terms of the GNU Affero General Public License, version 3,
  21. * as published by the Free Software Foundation.
  22. *
  23. * This program is distributed in the hope that it will be useful,
  24. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. * GNU Affero General Public License for more details.
  27. *
  28. * You should have received a copy of the GNU Affero General Public License, version 3,
  29. * along with this program. If not, see <http://www.gnu.org/licenses/>
  30. *
  31. */
  32. namespace OC\Session;
  33. use OC\Authentication\Token\IProvider;
  34. use OCP\Authentication\Exceptions\InvalidTokenException;
  35. use OCP\Session\Exceptions\SessionNotAvailableException;
  36. /**
  37. * Class Internal
  38. *
  39. * wrap php's internal session handling into the Session interface
  40. *
  41. * @package OC\Session
  42. */
  43. class Internal extends Session {
  44. /**
  45. * @param string $name
  46. * @throws \Exception
  47. */
  48. public function __construct(string $name) {
  49. set_error_handler([$this, 'trapError']);
  50. $this->invoke('session_name', [$name]);
  51. try {
  52. $this->startSession();
  53. } catch (\Exception $e) {
  54. setcookie($this->invoke('session_name'), '', -1, \OC::$WEBROOT ?: '/');
  55. }
  56. restore_error_handler();
  57. if (!isset($_SESSION)) {
  58. throw new \Exception('Failed to start session');
  59. }
  60. }
  61. /**
  62. * @param string $key
  63. * @param integer $value
  64. */
  65. public function set(string $key, $value) {
  66. $reopened = $this->reopen();
  67. $_SESSION[$key] = $value;
  68. if ($reopened) {
  69. $this->close();
  70. }
  71. }
  72. /**
  73. * @param string $key
  74. * @return mixed
  75. */
  76. public function get(string $key) {
  77. if (!$this->exists($key)) {
  78. return null;
  79. }
  80. return $_SESSION[$key];
  81. }
  82. /**
  83. * @param string $key
  84. * @return bool
  85. */
  86. public function exists(string $key): bool {
  87. return isset($_SESSION[$key]);
  88. }
  89. /**
  90. * @param string $key
  91. */
  92. public function remove(string $key) {
  93. if (isset($_SESSION[$key])) {
  94. unset($_SESSION[$key]);
  95. }
  96. }
  97. public function clear() {
  98. $this->reopen();
  99. $this->invoke('session_unset');
  100. $this->regenerateId();
  101. $this->invoke('session_write_close');
  102. $this->startSession(true);
  103. $_SESSION = [];
  104. }
  105. public function close() {
  106. $this->invoke('session_write_close');
  107. parent::close();
  108. }
  109. /**
  110. * Wrapper around session_regenerate_id
  111. *
  112. * @param bool $deleteOldSession Whether to delete the old associated session file or not.
  113. * @param bool $updateToken Whether to update the associated auth token
  114. * @return void
  115. */
  116. public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
  117. $this->reopen();
  118. $oldId = null;
  119. if ($updateToken) {
  120. // Get the old id to update the token
  121. try {
  122. $oldId = $this->getId();
  123. } catch (SessionNotAvailableException $e) {
  124. // We can't update a token if there is no previous id
  125. $updateToken = false;
  126. }
  127. }
  128. try {
  129. @session_regenerate_id($deleteOldSession);
  130. } catch (\Error $e) {
  131. $this->trapError($e->getCode(), $e->getMessage());
  132. }
  133. if ($updateToken) {
  134. // Get the new id to update the token
  135. $newId = $this->getId();
  136. /** @var IProvider $tokenProvider */
  137. $tokenProvider = \OCP\Server::get(IProvider::class);
  138. try {
  139. $tokenProvider->renewSessionToken($oldId, $newId);
  140. } catch (InvalidTokenException $e) {
  141. // Just ignore
  142. }
  143. }
  144. }
  145. /**
  146. * Wrapper around session_id
  147. *
  148. * @return string
  149. * @throws SessionNotAvailableException
  150. * @since 9.1.0
  151. */
  152. public function getId(): string {
  153. $id = $this->invoke('session_id', [], true);
  154. if ($id === '') {
  155. throw new SessionNotAvailableException();
  156. }
  157. return $id;
  158. }
  159. /**
  160. * @throws \Exception
  161. */
  162. public function reopen(): bool {
  163. if ($this->sessionClosed) {
  164. $this->startSession(false, false);
  165. $this->sessionClosed = false;
  166. return true;
  167. }
  168. return false;
  169. }
  170. /**
  171. * @param int $errorNumber
  172. * @param string $errorString
  173. * @throws \ErrorException
  174. */
  175. public function trapError(int $errorNumber, string $errorString) {
  176. if ($errorNumber & E_ERROR) {
  177. throw new \ErrorException($errorString);
  178. }
  179. }
  180. /**
  181. * @param string $functionName the full session_* function name
  182. * @param array $parameters
  183. * @param bool $silence whether to suppress warnings
  184. * @throws \ErrorException via trapError
  185. * @return mixed
  186. */
  187. private function invoke(string $functionName, array $parameters = [], bool $silence = false) {
  188. try {
  189. if ($silence) {
  190. return @call_user_func_array($functionName, $parameters);
  191. } else {
  192. return call_user_func_array($functionName, $parameters);
  193. }
  194. } catch (\Error $e) {
  195. $this->trapError($e->getCode(), $e->getMessage());
  196. }
  197. }
  198. private function startSession(bool $silence = false, bool $readAndClose = true) {
  199. $sessionParams = ['cookie_samesite' => 'Lax'];
  200. if (\OC::hasSessionRelaxedExpiry()) {
  201. $sessionParams['read_and_close'] = $readAndClose;
  202. }
  203. $this->invoke('session_start', [$sessionParams], $silence);
  204. }
  205. }