← All changes | includes/libraries/wp-session/class-wp-session.php +9 -7 1.7.0 → 1.8.13 View file →

		@@ -20,9 +20,9 @@
20	20	*
21	21	* @package WordPress
22	22	* @since 3.7.0
23	23	*/
24		-final class WP_Session extends Recursive_ArrayAccess {
	24	+final class WP_Session extends Recursive_ArrayAccess { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- This is a bundled library class. Changing it would break existing functionality.
25	25	/**
26	26	* ID of the current session.
27	27	*
28	28	* @var string
		@@ -70,10 +70,12 @@
70	70	*
71	71	* @param $session_id
72	72	*/
73	73	protected function __construct() {
	74	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Cookie data, handled by stripslashes and sanitized by preg_replace below
74	75	if ( isset( $_COOKIE[WP_SESSION_COOKIE] ) ) {
75		- $cookie = stripslashes( $_COOKIE[WP_SESSION_COOKIE] );
	76	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Cookie data, sanitized by preg_replace below
	77	+ $cookie = stripslashes( wp_unslash( $_COOKIE[WP_SESSION_COOKIE] ) );
76	78	$cookie_crumbs = explode( '||', $cookie );
77	79
78	80	$this->session_id = preg_replace("/[^A-Za-z0-9_]/", '', $cookie_crumbs[0] );
79	81	$this->expires = absint( $cookie_crumbs[1] );
		@@ -111,10 +113,10 @@
111	113	* @uses apply_filters Calls `wp_session_expiration_variant` to get the max update window for session data.
112	114	* @uses apply_filters Calls `wp_session_expiration` to get the standard expiration time for sessions.
113	115	*/
114	116	protected function set_expiration() {
115		- $this->exp_variant = time() + (int) apply_filters( 'wp_session_expiration_variant', 24 * 60 );
116		- $this->expires = time() + (int) apply_filters( 'wp_session_expiration', 30 * 60 );
	117	+ $this->exp_variant = time() + (int) apply_filters( 'wp_session_expiration_variant', 24 * 60 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality.
	118	+ $this->expires = time() + (int) apply_filters( 'wp_session_expiration', 30 * 60 ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality.
117	119	}
118	120
119	121	/**
120	122	* Set the session cookie
		@@ -122,10 +124,10 @@
122	124	* @uses apply_filters Calls `wp_session_cookie_secure` to set the $secure parameter of setcookie()
123	125	* @uses apply_filters Calls `wp_session_cookie_httponly` to set the $httponly parameter of setcookie()
124	126	*/
125	127	protected function set_cookie() {
126		- $secure = apply_filters( 'wp_session_cookie_secure', false );
127		- $httponly = apply_filters( 'wp_session_cookie_httponly', false );
	128	+ $secure = apply_filters( 'wp_session_cookie_secure', false ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality.
	129	+ $httponly = apply_filters( 'wp_session_cookie_httponly', false ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- This is a bundled library hook. Changing it would break existing functionality.
128	130	setcookie( WP_SESSION_COOKIE, $this->session_id . '||' . $this->expires . '||' . $this->exp_variant,
129	131	$this->expires,
130	132	COOKIEPATH,
131	133	COOKIE_DOMAIN,
		@@ -176,9 +178,9 @@
176	178	*
177	179	* @return string
178	180	*/
179	181	public function json_out() {
180		- return json_encode( $this->container );
	182	+ return wp_json_encode( $this->container );
181	183	}
182	184
183	185	/**
184	186	* Decodes a JSON string and, if the object is an array, overwrites the session container with its contents.