[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * Joomla! Content Management System
   5   *
   6   * @copyright  (C) 2005 Open Source Matters, Inc. <https://www.joomla.org>
   7   * @license    GNU General Public License version 2 or later; see LICENSE
   8   */
   9  
  10  namespace Joomla\CMS\Session\Storage;
  11  
  12  use Joomla\CMS\Factory;
  13  use Joomla\Input\Input;
  14  use Joomla\Registry\Registry;
  15  use Joomla\Session\Storage\NativeStorage;
  16  
  17  // phpcs:disable PSR1.Files.SideEffects
  18  \defined('JPATH_PLATFORM') or die;
  19  // phpcs:enable PSR1.Files.SideEffects
  20  
  21  /**
  22   * Service provider for the application's session dependency
  23   *
  24   * @since  4.0.0
  25   */
  26  class JoomlaStorage extends NativeStorage
  27  {
  28      /**
  29       * Internal data store for the session data
  30       *
  31       * @var    Registry
  32       * @since  4.0.0
  33       */
  34      private $data;
  35  
  36      /**
  37       * Force cookies to be SSL only
  38       *
  39       * @var    boolean
  40       * @since  4.0.0
  41       */
  42      private $forceSSL = false;
  43  
  44      /**
  45       * Input object
  46       *
  47       * @var    Input
  48       * @since  4.0.0
  49       */
  50      private $input;
  51  
  52      /**
  53       * Constructor
  54       *
  55       * @param   Input                     $input    Input object
  56       * @param   \SessionHandlerInterface  $handler  Session save handler
  57       * @param   array                     $options  Session options
  58       *
  59       * @since   4.0.0
  60       */
  61      public function __construct(Input $input, \SessionHandlerInterface $handler = null, array $options = [])
  62      {
  63          // Disable transparent sid support and default use cookies
  64          $options += [
  65              'use_cookies'   => 1,
  66              'use_trans_sid' => 0,
  67          ];
  68  
  69          if (!headers_sent() && !$this->isActive()) {
  70              session_cache_limiter('none');
  71          }
  72  
  73          $this->setOptions($options);
  74          $this->setHandler($handler);
  75          $this->setCookieParams();
  76  
  77          $this->data = new Registry();
  78          $this->input = $input;
  79  
  80          // Register our function as shutdown method, so we can manipulate it
  81          register_shutdown_function([$this, 'close']);
  82      }
  83  
  84      /**
  85       * Retrieves all variables from the session store
  86       *
  87       * @return  array
  88       *
  89       * @since   4.0.0
  90       */
  91      public function all(): array
  92      {
  93          return $this->data->toArray();
  94      }
  95  
  96      /**
  97       * Clears all variables from the session store
  98       *
  99       * @return  void
 100       *
 101       * @since   4.0.0
 102       */
 103      public function clear(): void
 104      {
 105          $session_name = $this->getName();
 106  
 107          /*
 108           * In order to kill the session altogether, such as to log the user out, the session id
 109           * must also be unset. If a cookie is used to propagate the session id (default behavior),
 110           * then the session cookie must be deleted.
 111           */
 112          if (isset($_COOKIE[$session_name])) {
 113              $app           = Factory::getApplication();
 114              $cookie_domain = $app->get('cookie_domain', '');
 115              $cookie_path   = $app->get('cookie_path', '/');
 116              $cookie = session_get_cookie_params();
 117              setcookie($session_name, '', time() - 42000, $cookie_path, $cookie_domain, $cookie['secure'], true);
 118          }
 119  
 120          $this->data = new Registry();
 121      }
 122  
 123      /**
 124       * Writes session data and ends session
 125       *
 126       * @return  void
 127       *
 128       * @see     session_write_close()
 129       * @since   4.0.0
 130       */
 131      public function close(): void
 132      {
 133          // Before storing data to the session, we serialize and encode the Registry
 134          $_SESSION['joomla'] = base64_encode(serialize(clone $this->data));
 135  
 136          parent::close();
 137      }
 138  
 139      /**
 140       * Get data from the session store
 141       *
 142       * @param   string  $name     Name of a variable
 143       * @param   mixed   $default  Default value of a variable if not set
 144       *
 145       * @return  mixed  Value of a variable
 146       *
 147       * @since   4.0.0
 148       */
 149      public function get(string $name, $default)
 150      {
 151          if (!$this->isStarted()) {
 152              $this->start();
 153          }
 154  
 155          return $this->data->get($name, $default);
 156      }
 157  
 158      /**
 159       * Check whether data exists in the session store
 160       *
 161       * @param   string  $name  Name of variable
 162       *
 163       * @return  boolean  True if the variable exists
 164       *
 165       * @since   4.0.0
 166       */
 167      public function has(string $name): bool
 168      {
 169          if (!$this->isStarted()) {
 170              $this->start();
 171          }
 172  
 173          return $this->data->exists($name);
 174      }
 175  
 176      /**
 177       * Unset a variable from the session store
 178       *
 179       * @param   string  $name  Name of variable
 180       *
 181       * @return  mixed  The value from session or NULL if not set
 182       *
 183       * @since   4.0.0
 184       */
 185      public function remove(string $name)
 186      {
 187          if (!$this->isStarted()) {
 188              $this->start();
 189          }
 190  
 191          $old = $this->data->get($name);
 192  
 193          unset($this->data[$name]);
 194  
 195          return $old;
 196      }
 197  
 198      /**
 199       * Set data into the session store
 200       *
 201       * @param   string  $name   Name of a variable.
 202       * @param   mixed   $value  Value of a variable.
 203       *
 204       * @return  mixed  Old value of a variable.
 205       *
 206       * @since   4.0.0
 207       */
 208      public function set(string $name, $value = null)
 209      {
 210          if (!$this->isStarted()) {
 211              $this->start();
 212          }
 213  
 214          $old = $this->data->get($name);
 215  
 216          $this->data->set($name, $value);
 217  
 218          return $old;
 219      }
 220  
 221      /**
 222       * Set session cookie parameters
 223       *
 224       * @return  void
 225       *
 226       * @since   4.0.0
 227       */
 228      protected function setCookieParams(): void
 229      {
 230          if (headers_sent() || $this->isActive()) {
 231              return;
 232          }
 233  
 234          $cookie = session_get_cookie_params();
 235  
 236          if ($this->forceSSL) {
 237              $cookie['secure'] = true;
 238          }
 239  
 240          $app = Factory::getApplication();
 241  
 242          if ($app->get('cookie_domain', '') != '') {
 243              $cookie['domain'] = $app->get('cookie_domain');
 244          }
 245  
 246          if ($app->get('cookie_path', '') != '') {
 247              $cookie['path'] = $app->get('cookie_path');
 248          }
 249  
 250          session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure'], true);
 251      }
 252  
 253      /**
 254       * Sets session options
 255       *
 256       * @param   array  $options  Session ini directives array(key => value).
 257       *
 258       * @return  $this
 259       *
 260       * @see     http://php.net/session.configuration
 261       * @since   4.0.0
 262       */
 263      public function setOptions(array $options): NativeStorage
 264      {
 265          if (isset($options['force_ssl'])) {
 266              $this->forceSSL = (bool) $options['force_ssl'];
 267          }
 268  
 269          return parent::setOptions($options);
 270      }
 271  
 272      /**
 273       * Start a session
 274       *
 275       * @return  void
 276       *
 277       * @since   4.0.0
 278       */
 279      public function start(): void
 280      {
 281          $session_name = $this->getName();
 282  
 283          // Get the cookie object
 284          $cookie = $this->input->cookie;
 285  
 286          if (\is_null($cookie->get($session_name))) {
 287              $session_clean = $this->input->getString($session_name);
 288  
 289              if ($session_clean) {
 290                  $this->setId($session_clean);
 291                  $cookie->set($session_name, '', time() - 3600);
 292              }
 293          }
 294  
 295          parent::start();
 296  
 297          // Try loading data from the session
 298          if (isset($_SESSION['joomla']) && !empty($_SESSION['joomla'])) {
 299              $this->data = unserialize(base64_decode($_SESSION['joomla']));
 300          }
 301      }
 302  }