charitable / includes / libraries / wp-session / class-wp-session-utils.php

class-wp-session-utils.php in Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) 1.8.12.2, at includes/libraries/wp-session/class-wp-session-utils.php

140 lines 4.6 KB

Raw Download Zip

1	<?php
2
3	/**
4	* Utility class for sesion utilities
5	*
6	* THIS CLASS SHOULD NEVER BE INSTANTIATED
7	*/
8	class WP_Session_Utils { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- This is a bundled library class. Changing it would break existing functionality.
9	/**
10	* Count the total sessions in the database.
11	*
12	* @global wpdb $wpdb
13	*
14	* @return int
15	*/
16	public static function count_sessions() {
17	global $wpdb;
18
19	$query = "SELECT COUNT(*) FROM $wpdb->options WHERE option_name LIKE '_wp_session_expires_%'";
20
21	/**
22	* Filter the query in case tables are non-standard.
23	*
24	* @param string $query Database count query
25	*/
26	$query = apply_filters( 'wp_session_count_query', $query ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- 'wp_session_count_query' is a third-party hook from the WP Session library.
27
28	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter -- Filtered query allows customization for non-standard table setups. Filter should be used responsibly.
29	$sessions = $wpdb->get_var( $query ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter
30
31	return absint( $sessions );
32	}
33
34	/**
35	* Create a new, random session in the database.
36	*
37	* @param null\|string $date
38	*/
39	public static function create_dummy_session( $date = null ) {
40	// Generate our date
41	if ( null !== $date ) {
42	$time = strtotime( $date );
43
44	if ( false === $time ) {
45	$date = null;
46	} else {
47	$expires = date( 'U', strtotime( $date ) ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date
48	}
49	}
50
51	// If null was passed, or if the string parsing failed, fall back on a default
52	if ( null === $date ) {
53	/**
54	* Filter the expiration of the session in the database
55	*
56	* @param int
57	*/
58	$expires = time() + (int) apply_filters( 'wp_session_expiration', 30 * 60 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- 'wp_session_expiration' is a third-party hook from the WP Session library.
59	}
60
61	$session_id = self::generate_id();
62
63	// Store the session
64	add_option( "_wp_session_{$session_id}", array(), '', 'no' );
65	add_option( "_wp_session_expires_{$session_id}", $expires, '', 'no' );
66	}
67
68	/**
69	* Delete old sessions from the database.
70	*
71	* @param int $limit Maximum number of sessions to delete.
72	*
73	* @global wpdb $wpdb
74	*
75	* @return int Sessions deleted.
76	*/
77	public static function delete_old_sessions( $limit = 1000 ) {
78	global $wpdb;
79
80	$limit = absint( $limit );
81	$keys = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE option_name LIKE '_wp_session_expires_%' ORDER BY option_value ASC LIMIT 0, {$limit}" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared
82
83	$now = time();
84	$expired = array();
85	$count = 0;
86
87	foreach( $keys as $expiration ) {
88	$key = $expiration->option_name;
89	$expires = $expiration->option_value;
90
91	if ( $now > $expires ) {
92	$session_id = preg_replace("/[^A-Za-z0-9_]/", '', substr( $key, 20 ) );
93
94	$expired[] = $key;
95	$expired[] = "_wp_session_{$session_id}";
96
97	$count += 1;
98	}
99	}
100
101	// Delete expired sessions
102	if ( ! empty( $expired ) ) {
103	$placeholders = array_fill( 0, count( $expired ), '%s' );
104	$format = implode( ', ', $placeholders );
105	$query = "DELETE FROM $wpdb->options WHERE option_name IN ($format)";
106
107	$prepared = $wpdb->prepare( $query, $expired ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
108	$wpdb->query( $prepared ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared
109	}
110
111	return $count;
112	}
113
114	/**
115	* Remove all sessions from the database, regardless of expiration.
116	*
117	* @global wpdb $wpdb
118	*
119	* @return int Sessions deleted
120	*/
121	public static function delete_all_sessions() {
122	global $wpdb;
123
124	$count = $wpdb->query( "DELETE FROM $wpdb->options WHERE option_name LIKE '_wp_session_%'" ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
125
126	return (int) ( $count / 2 );
127	}
128
129	/**
130	* Generate a new, random session ID.
131	*
132	* @return string
133	*/
134	public static function generate_id() {
135	require_once( ABSPATH . 'wp-includes/class-phpass.php' );
136	$hash = new PasswordHash( 8, false );
137
138	return md5( $hash->get_random_bytes( 32 ) );
139	}
140	}