← All changes
|
includes/libraries/wp-session/class-wp-session.php
+14
-10
1.6.8
→
1.8.13
View file →
| @@ -10,9 +10,11 @@ | ||
| 10 | 10 | * @since 3.7.0 |
| 11 | 11 | */ |
| 12 | 12 | |
| 13 | 13 | // Exit if accessed directly. |
| 14 | -if ( ! defined( 'ABSPATH' ) ) { exit; } | |
| 14 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 15 | + exit; | |
| 16 | +} | |
| 15 | 17 | |
| 16 | 18 | /** |
| 17 | 19 | * WordPress Session class for managing user session data. |
| 18 | 20 | * |
| @@ -18,9 +20,9 @@ | ||
| 18 | 20 | * |
| 19 | 21 | * @package WordPress |
| 20 | 22 | * @since 3.7.0 |
| 21 | 23 | */ |
| 22 | -final class WP_Session extends Recursive_ArrayAccess { | |
| 24 | +final class WP_Session extends Recursive_ArrayAccess { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- This is a bundled library class. Changing it would break existing functionality. | |
| 23 | 25 | /** |
| 24 | 26 | * ID of the current session. |
| 25 | 27 | * |
| 26 | 28 | * @var string |
| @@ -65,13 +67,15 @@ | ||
| 65 | 67 | * Default constructor. |
| 66 | 68 | * Will rebuild the session collection from the given session ID if it exists. Otherwise, will |
| 67 | 69 | * create a new session with that ID. |
| 68 | 70 | * |
| 69 | - * @param $session_id | |
| 71 | + * @param $session_id | |
| 70 | 72 | */ |
| 71 | 73 | protected function __construct() { |
| 74 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Cookie data, handled by stripslashes and sanitized by preg_replace below | |
| 72 | 75 | if ( isset( $_COOKIE[WP_SESSION_COOKIE] ) ) { |
| 73 | - $cookie = stripslashes( $_COOKIE[WP_SESSION_COOKIE] ); | |
| 76 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Cookie data, sanitized by preg_replace below | |
| 77 | + $cookie = stripslashes( wp_unslash( $_COOKIE[WP_SESSION_COOKIE] ) ); | |
| 74 | 78 | $cookie_crumbs = explode( '||', $cookie ); |
| 75 | 79 | |
| 76 | 80 | $this->session_id = preg_replace("/[^A-Za-z0-9_]/", '', $cookie_crumbs[0] ); |
| 77 | 81 | $this->expires = absint( $cookie_crumbs[1] ); |
| @@ -83,9 +87,9 @@ | ||
| 83 | 87 | delete_option( "_wp_session_expires_{$this->session_id}" ); |
| 84 | 88 | add_option( "_wp_session_expires_{$this->session_id}", $this->expires, '', 'no' ); |
| 85 | 89 | } |
| 86 | 90 | |
| 87 | - $this->read_data(); | |
| 91 | + $this->read_data(); | |
| 88 | 92 | } else { |
| 89 | 93 | $this->session_id = ''; |
| 90 | 94 | $this->container = array(); |
| 91 | 95 | } |
| @@ -109,10 +113,10 @@ | ||
| 109 | 113 | * @uses apply_filters Calls `wp_session_expiration_variant` to get the max update window for session data. |
| 110 | 114 | * @uses apply_filters Calls `wp_session_expiration` to get the standard expiration time for sessions. |
| 111 | 115 | */ |
| 112 | 116 | protected function set_expiration() { |
| 113 | - $this->exp_variant = time() + (int) apply_filters( 'wp_session_expiration_variant', 24 * 60 ); | |
| 114 | - $this->expires = time() + (int) apply_filters( 'wp_session_expiration', 30 * 60 ); | |
| 117 | + $this->exp_variant = time() + (int) apply_filters( 'wp_session_expiration_variant', 24 * 60 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 118 | + $this->expires = time() + (int) apply_filters( 'wp_session_expiration', 30 * 60 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 115 | 119 | } |
| 116 | 120 | |
| 117 | 121 | /** |
| 118 | 122 | * Set the session cookie |
| @@ -120,10 +124,10 @@ | ||
| 120 | 124 | * @uses apply_filters Calls `wp_session_cookie_secure` to set the $secure parameter of setcookie() |
| 121 | 125 | * @uses apply_filters Calls `wp_session_cookie_httponly` to set the $httponly parameter of setcookie() |
| 122 | 126 | */ |
| 123 | 127 | protected function set_cookie() { |
| 124 | - $secure = apply_filters( 'wp_session_cookie_secure', false ); | |
| 125 | - $httponly = apply_filters( 'wp_session_cookie_httponly', false ); | |
| 128 | + $secure = apply_filters( 'wp_session_cookie_secure', false ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 129 | + $httponly = apply_filters( 'wp_session_cookie_httponly', false ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 126 | 130 | setcookie( WP_SESSION_COOKIE, $this->session_id . '||' . $this->expires . '||' . $this->exp_variant, |
| 127 | 131 | $this->expires, |
| 128 | 132 | COOKIEPATH, |
| 129 | 133 | COOKIE_DOMAIN, |
| @@ -174,9 +178,9 @@ | ||
| 174 | 178 | * |
| 175 | 179 | * @return string |
| 176 | 180 | */ |
| 177 | 181 | public function json_out() { |
| 178 | - return json_encode( $this->container ); | |
| 182 | + return wp_json_encode( $this->container ); | |
| 179 | 183 | } |
| 180 | 184 | |
| 181 | 185 | /** |
| 182 | 186 | * Decodes a JSON string and, if the object is an array, overwrites the session container with its contents. |