← All changes
|
includes/libraries/wp-session/class-wp-session.php
+9
-7
1.7.0.3
→
1.8.13
View file →
| @@ -20,9 +20,9 @@ | ||
| 20 | 20 | * |
| 21 | 21 | * @package WordPress |
| 22 | 22 | * @since 3.7.0 |
| 23 | 23 | */ |
| 24 | -final class WP_Session extends Recursive_ArrayAccess { | |
| 24 | +final class WP_Session extends Recursive_ArrayAccess { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- This is a bundled library class. Changing it would break existing functionality. | |
| 25 | 25 | /** |
| 26 | 26 | * ID of the current session. |
| 27 | 27 | * |
| 28 | 28 | * @var string |
| @@ -70,10 +70,12 @@ | ||
| 70 | 70 | * |
| 71 | 71 | * @param $session_id |
| 72 | 72 | */ |
| 73 | 73 | protected function __construct() { |
| 74 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Cookie data, handled by stripslashes and sanitized by preg_replace below | |
| 74 | 75 | if ( isset( $_COOKIE[WP_SESSION_COOKIE] ) ) { |
| 75 | - $cookie = stripslashes( $_COOKIE[WP_SESSION_COOKIE] ); | |
| 76 | + // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Cookie data, sanitized by preg_replace below | |
| 77 | + $cookie = stripslashes( wp_unslash( $_COOKIE[WP_SESSION_COOKIE] ) ); | |
| 76 | 78 | $cookie_crumbs = explode( '||', $cookie ); |
| 77 | 79 | |
| 78 | 80 | $this->session_id = preg_replace("/[^A-Za-z0-9_]/", '', $cookie_crumbs[0] ); |
| 79 | 81 | $this->expires = absint( $cookie_crumbs[1] ); |
| @@ -111,10 +113,10 @@ | ||
| 111 | 113 | * @uses apply_filters Calls `wp_session_expiration_variant` to get the max update window for session data. |
| 112 | 114 | * @uses apply_filters Calls `wp_session_expiration` to get the standard expiration time for sessions. |
| 113 | 115 | */ |
| 114 | 116 | protected function set_expiration() { |
| 115 | - $this->exp_variant = time() + (int) apply_filters( 'wp_session_expiration_variant', 24 * 60 ); | |
| 116 | - $this->expires = time() + (int) apply_filters( 'wp_session_expiration', 30 * 60 ); | |
| 117 | + $this->exp_variant = time() + (int) apply_filters( 'wp_session_expiration_variant', 24 * 60 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 118 | + $this->expires = time() + (int) apply_filters( 'wp_session_expiration', 30 * 60 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 117 | 119 | } |
| 118 | 120 | |
| 119 | 121 | /** |
| 120 | 122 | * Set the session cookie |
| @@ -122,10 +124,10 @@ | ||
| 122 | 124 | * @uses apply_filters Calls `wp_session_cookie_secure` to set the $secure parameter of setcookie() |
| 123 | 125 | * @uses apply_filters Calls `wp_session_cookie_httponly` to set the $httponly parameter of setcookie() |
| 124 | 126 | */ |
| 125 | 127 | protected function set_cookie() { |
| 126 | - $secure = apply_filters( 'wp_session_cookie_secure', false ); | |
| 127 | - $httponly = apply_filters( 'wp_session_cookie_httponly', false ); | |
| 128 | + $secure = apply_filters( 'wp_session_cookie_secure', false ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 129 | + $httponly = apply_filters( 'wp_session_cookie_httponly', false ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality. | |
| 128 | 130 | setcookie( WP_SESSION_COOKIE, $this->session_id . '||' . $this->expires . '||' . $this->exp_variant, |
| 129 | 131 | $this->expires, |
| 130 | 132 | COOKIEPATH, |
| 131 | 133 | COOKIE_DOMAIN, |
| @@ -176,9 +178,9 @@ | ||
| 176 | 178 | * |
| 177 | 179 | * @return string |
| 178 | 180 | */ |
| 179 | 181 | public function json_out() { |
| 180 | - return json_encode( $this->container ); | |
| 182 | + return wp_json_encode( $this->container ); | |
| 181 | 183 | } |
| 182 | 184 | |
| 183 | 185 | /** |
| 184 | 186 | * Decodes a JSON string and, if the object is an array, overwrites the session container with its contents. |