[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * Part of the Joomla Framework Session Package
   4   *
   5   * @copyright  Copyright (C) 2005 - 2021 Open Source Matters, Inc. All rights reserved.
   6   * @license    GNU General Public License version 2 or later; see LICENSE
   7   */
   8  
   9  namespace Joomla\Session\Validator;
  10  
  11  use Joomla\Input\Input;
  12  use Joomla\Session\Exception\InvalidSessionException;
  13  use Joomla\Session\SessionInterface;
  14  use Joomla\Session\ValidatorInterface;
  15  use Joomla\Utilities\IpHelper;
  16  
  17  /**
  18   * Interface for validating a part of the session
  19   *
  20   * @since  2.0.0
  21   */
  22  class AddressValidator implements ValidatorInterface
  23  {
  24      /**
  25       * The Input object.
  26       *
  27       * @var    Input
  28       * @since  2.0.0
  29       */
  30      private $input;
  31  
  32      /**
  33       * The session object.
  34       *
  35       * @var    SessionInterface
  36       * @since  2.0.0
  37       */
  38      private $session;
  39  
  40      /**
  41       * Constructor
  42       *
  43       * @param   Input             $input    The input object
  44       * @param   SessionInterface  $session  DispatcherInterface for the session to use.
  45       *
  46       * @since   2.0.0
  47       */
  48  	public function __construct(Input $input, SessionInterface $session)
  49      {
  50          $this->input   = $input;
  51          $this->session = $session;
  52      }
  53  
  54      /**
  55       * Validates the session
  56       *
  57       * @param   boolean  $restart  Flag if the session should be restarted
  58       *
  59       * @return  void
  60       *
  61       * @since   2.0.0
  62       * @throws  InvalidSessionException
  63       */
  64  	public function validate(bool $restart = false): void
  65      {
  66          if ($restart)
  67          {
  68              $this->session->set('session.client.address', null);
  69          }
  70  
  71          $remoteAddr = IpHelper::getIp();
  72  
  73          // Check for client address
  74          if (!empty($remoteAddr) && filter_var($remoteAddr, FILTER_VALIDATE_IP) !== false)
  75          {
  76              $ip = $this->session->get('session.client.address');
  77  
  78              if ($ip === null)
  79              {
  80                  $this->session->set('session.client.address', $remoteAddr);
  81              }
  82              elseif ($remoteAddr !== $ip)
  83              {
  84                  throw new InvalidSessionException('Invalid client IP');
  85              }
  86          }
  87      }
  88  }