elFinderSession.php
| 1 | <?php |
| 2 | |
| 3 | /** |
| 4 | * elFinder - file manager for web. |
| 5 | * Session Wrapper Class. |
| 6 | * |
| 7 | * @package elfinder |
| 8 | * @author Naoki Sawada |
| 9 | **/ |
| 10 | |
| 11 | class elFinderSession implements elFinderSessionInterface |
| 12 | { |
| 13 | /** |
| 14 | * A flag of session started |
| 15 | * |
| 16 | * @var boolean |
| 17 | */ |
| 18 | protected $started = false; |
| 19 | |
| 20 | /** |
| 21 | * Array of session keys of this instance |
| 22 | * |
| 23 | * @var array |
| 24 | */ |
| 25 | protected $keys = array(); |
| 26 | |
| 27 | /** |
| 28 | * Is enabled base64encode |
| 29 | * |
| 30 | * @var boolean |
| 31 | */ |
| 32 | protected $base64encode = false; |
| 33 | |
| 34 | /** |
| 35 | * Read session data and close immediately |
| 36 | * |
| 37 | * @var boolean |
| 38 | */ |
| 39 | protected $readOnly = false; |
| 40 | |
| 41 | /** |
| 42 | * Default options array |
| 43 | * |
| 44 | * @var array |
| 45 | */ |
| 46 | protected $opts = array( |
| 47 | 'base64encode' => false, |
| 48 | 'keys' => array( |
| 49 | 'default' => 'elFinderCaches', |
| 50 | 'netvolume' => 'elFinderNetVolumes' |
| 51 | ), |
| 52 | 'cookieParams' => array(), |
| 53 | 'readOnly' => false |
| 54 | ); |
| 55 | |
| 56 | /** |
| 57 | * Constractor |
| 58 | * |
| 59 | * @param array $opts The options |
| 60 | * |
| 61 | * @return self Instanse of this class |
| 62 | */ |
| 63 | public function __construct($opts) |
| 64 | { |
| 65 | $this->opts = array_merge($this->opts, $opts); |
| 66 | $this->base64encode = !empty($this->opts['base64encode']); |
| 67 | $this->keys = $this->opts['keys']; |
| 68 | $this->readOnly = !empty($this->opts['readOnly']); |
| 69 | } |
| 70 | |
| 71 | /** |
| 72 | * Normalize cookie params for session_set_cookie_params() |
| 73 | * |
| 74 | * @return array |
| 75 | */ |
| 76 | protected function getSessionCookieParams() |
| 77 | { |
| 78 | $secure = (!empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off'); |
| 79 | |
| 80 | $params = array( |
| 81 | 'lifetime' => 0, |
| 82 | 'path' => '/', |
| 83 | 'domain' => '', |
| 84 | 'secure' => $secure, |
| 85 | 'httponly' => true |
| 86 | ); |
| 87 | |
| 88 | if (!empty($this->opts['cookieParams']) && is_array($this->opts['cookieParams'])) { |
| 89 | $params = array_merge($params, $this->opts['cookieParams']); |
| 90 | } |
| 91 | |
| 92 | // absorb key case variations |
| 93 | if (isset($params['SameSite']) && !isset($params['samesite'])) { |
| 94 | $params['samesite'] = $params['SameSite']; |
| 95 | unset($params['SameSite']); |
| 96 | } |
| 97 | if (isset($params['HttpOnly']) && !isset($params['httponly'])) { |
| 98 | $params['httponly'] = $params['HttpOnly']; |
| 99 | unset($params['HttpOnly']); |
| 100 | } |
| 101 | |
| 102 | return $params; |
| 103 | } |
| 104 | |
| 105 | /** |
| 106 | * Apply session cookie params before session_start() |
| 107 | * |
| 108 | * @return void |
| 109 | */ |
| 110 | protected function applySessionCookieParams() |
| 111 | { |
| 112 | $p = $this->getSessionCookieParams(); |
| 113 | |
| 114 | if (version_compare(PHP_VERSION, '7.3.0', '>=')) { |
| 115 | session_set_cookie_params(array( |
| 116 | 'lifetime' => isset($p['lifetime']) ? (int)$p['lifetime'] : 0, |
| 117 | 'path' => isset($p['path']) ? $p['path'] : '/', |
| 118 | 'domain' => isset($p['domain']) ? $p['domain'] : '', |
| 119 | 'secure' => !empty($p['secure']), |
| 120 | 'httponly' => !empty($p['httponly']), |
| 121 | 'samesite' => isset($p['samesite']) ? $p['samesite'] : 'Lax' |
| 122 | )); |
| 123 | } else { |
| 124 | // PHP 5.5 compatible |
| 125 | $path = isset($p['path']) ? $p['path'] : '/'; |
| 126 | if (!empty($p['samesite'])) { |
| 127 | $path .= '; SameSite=' . $p['samesite']; |
| 128 | } |
| 129 | |
| 130 | session_set_cookie_params( |
| 131 | isset($p['lifetime']) ? (int)$p['lifetime'] : 0, |
| 132 | $path, |
| 133 | isset($p['domain']) ? $p['domain'] : '', |
| 134 | !empty($p['secure']), |
| 135 | !empty($p['httponly']) |
| 136 | ); |
| 137 | } |
| 138 | } |
| 139 | |
| 140 | /** |
| 141 | * {@inheritdoc} |
| 142 | */ |
| 143 | public function get($key, $empty = null) |
| 144 | { |
| 145 | $openedHere = false; |
| 146 | |
| 147 | if (!$this->started) { |
| 148 | $openedHere = true; |
| 149 | $this->start(); |
| 150 | } |
| 151 | |
| 152 | $data = null; |
| 153 | $session =& $this->getSessionRef($key); |
| 154 | $data = $session; |
| 155 | |
| 156 | if ($data && $this->base64encode) { |
| 157 | $data = $this->decodeData($data); |
| 158 | } |
| 159 | |
| 160 | $checkFn = null; |
| 161 | if (!is_null($empty)) { |
| 162 | if (is_string($empty)) { |
| 163 | $checkFn = 'is_string'; |
| 164 | } elseif (is_array($empty)) { |
| 165 | $checkFn = 'is_array'; |
| 166 | } elseif (is_object($empty)) { |
| 167 | $checkFn = 'is_object'; |
| 168 | } elseif (is_float($empty)) { |
| 169 | $checkFn = 'is_float'; |
| 170 | } elseif (is_int($empty)) { |
| 171 | $checkFn = 'is_int'; |
| 172 | } |
| 173 | } |
| 174 | |
| 175 | if (is_null($data) || ($checkFn && !$checkFn($data))) { |
| 176 | $data = $empty; |
| 177 | } |
| 178 | |
| 179 | if ($openedHere && !$this->readOnly) { |
| 180 | $this->close(); |
| 181 | } |
| 182 | |
| 183 | return $data; |
| 184 | } |
| 185 | |
| 186 | |
| 187 | /** |
| 188 | * {@inheritdoc} |
| 189 | */ |
| 190 | public function start() |
| 191 | { |
| 192 | if ($this->started) { |
| 193 | return $this; |
| 194 | } |
| 195 | |
| 196 | set_error_handler(array($this, 'session_start_error'), E_NOTICE | E_WARNING); |
| 197 | |
| 198 | $this->applySessionCookieParams(); |
| 199 | |
| 200 | if (version_compare(PHP_VERSION, '5.4.0', '>=')) { |
| 201 | if (session_status() !== PHP_SESSION_ACTIVE) { |
| 202 | if ($this->readOnly && version_compare(PHP_VERSION, '7.0.0', '>=')) { |
| 203 | session_start(array('read_and_close' => true)); |
| 204 | // read_and_close closes the PHP session immediately, |
| 205 | // but mark this wrapper as initialized for the current operation. |
| 206 | // close() is not needed after get() in this mode. |
| 207 | $this->started = true; |
| 208 | restore_error_handler(); |
| 209 | return $this; |
| 210 | } else { |
| 211 | session_start(); |
| 212 | } |
| 213 | } |
| 214 | } else { |
| 215 | session_start(); |
| 216 | } |
| 217 | |
| 218 | $this->started = (session_id() !== ''); |
| 219 | |
| 220 | restore_error_handler(); |
| 221 | |
| 222 | return $this; |
| 223 | } |
| 224 | |
| 225 | /** |
| 226 | * Get variable reference of $_SESSION |
| 227 | * |
| 228 | * @param string $key key of $_SESSION array |
| 229 | * |
| 230 | * @return mixed|null |
| 231 | */ |
| 232 | protected function & getSessionRef($key) |
| 233 | { |
| 234 | $session = null; |
| 235 | if ($this->started) { |
| 236 | list($cat, $name) = array_pad(explode('.', $key, 2), 2, null); |
| 237 | if (is_null($name)) { |
| 238 | if (!isset($this->keys[$cat])) { |
| 239 | $name = $cat; |
| 240 | $cat = 'default'; |
| 241 | } |
| 242 | } |
| 243 | if (isset($this->keys[$cat])) { |
| 244 | $cat = $this->keys[$cat]; |
| 245 | } else { |
| 246 | $name = $cat . '.' . $name; |
| 247 | $cat = $this->keys['default']; |
| 248 | } |
| 249 | if (is_null($name)) { |
| 250 | if (!isset($_SESSION[$cat])) { |
| 251 | $_SESSION[$cat] = null; |
| 252 | } |
| 253 | $session =& $_SESSION[$cat]; |
| 254 | } else { |
| 255 | if (!isset($_SESSION[$cat]) || !is_array($_SESSION[$cat])) { |
| 256 | $_SESSION[$cat] = array(); |
| 257 | } |
| 258 | if (!isset($_SESSION[$cat][$name])) { |
| 259 | $_SESSION[$cat][$name] = null; |
| 260 | } |
| 261 | $session =& $_SESSION[$cat][$name]; |
| 262 | } |
| 263 | } |
| 264 | return $session; |
| 265 | } |
| 266 | |
| 267 | /** |
| 268 | * base64 decode of session val |
| 269 | * |
| 270 | * @param $data |
| 271 | * |
| 272 | * @return bool|mixed|string|null |
| 273 | */ |
| 274 | protected function decodeData($data) |
| 275 | { |
| 276 | if ($this->base64encode) { |
| 277 | if (is_string($data)) { |
| 278 | if (($data = base64_decode($data)) !== false) { |
| 279 | $data = unserialize($data); |
| 280 | } else { |
| 281 | $data = null; |
| 282 | } |
| 283 | } else { |
| 284 | $data = null; |
| 285 | } |
| 286 | } |
| 287 | return $data; |
| 288 | } |
| 289 | |
| 290 | /** |
| 291 | * {@inheritdoc} |
| 292 | */ |
| 293 | public function close() |
| 294 | { |
| 295 | if ($this->started) { |
| 296 | session_write_close(); |
| 297 | } |
| 298 | $this->started = false; |
| 299 | |
| 300 | return $this; |
| 301 | } |
| 302 | |
| 303 | /** |
| 304 | * {@inheritdoc} |
| 305 | */ |
| 306 | public function set($key, $data) |
| 307 | { |
| 308 | $closed = false; |
| 309 | if (!$this->started) { |
| 310 | $closed = true; |
| 311 | $this->start(); |
| 312 | } |
| 313 | $session =& $this->getSessionRef($key); |
| 314 | if ($this->base64encode) { |
| 315 | $data = $this->encodeData($data); |
| 316 | } |
| 317 | $session = $data; |
| 318 | |
| 319 | if ($closed) { |
| 320 | $this->close(); |
| 321 | } |
| 322 | |
| 323 | return $this; |
| 324 | } |
| 325 | |
| 326 | /** |
| 327 | * base64 encode for session val |
| 328 | * |
| 329 | * @param $data |
| 330 | * |
| 331 | * @return string |
| 332 | */ |
| 333 | protected function encodeData($data) |
| 334 | { |
| 335 | if ($this->base64encode) { |
| 336 | $data = base64_encode(serialize($data)); |
| 337 | } |
| 338 | return $data; |
| 339 | } |
| 340 | |
| 341 | /** |
| 342 | * {@inheritdoc} |
| 343 | */ |
| 344 | public function remove($key) |
| 345 | { |
| 346 | $closed = false; |
| 347 | if (!$this->started) { |
| 348 | $closed = true; |
| 349 | $this->start(); |
| 350 | } |
| 351 | |
| 352 | list($cat, $name) = array_pad(explode('.', $key, 2), 2, null); |
| 353 | if (is_null($name)) { |
| 354 | if (!isset($this->keys[$cat])) { |
| 355 | $name = $cat; |
| 356 | $cat = 'default'; |
| 357 | } |
| 358 | } |
| 359 | if (isset($this->keys[$cat])) { |
| 360 | $cat = $this->keys[$cat]; |
| 361 | } else { |
| 362 | $name = $cat . '.' . $name; |
| 363 | $cat = $this->keys['default']; |
| 364 | } |
| 365 | if (is_null($name)) { |
| 366 | unset($_SESSION[$cat]); |
| 367 | } else { |
| 368 | if (isset($_SESSION[$cat]) && is_array($_SESSION[$cat])) { |
| 369 | unset($_SESSION[$cat][$name]); |
| 370 | } |
| 371 | } |
| 372 | |
| 373 | if ($closed) { |
| 374 | $this->close(); |
| 375 | } |
| 376 | |
| 377 | return $this; |
| 378 | } |
| 379 | |
| 380 | /** |
| 381 | * sessioin error handler (Only for suppression of error at session start) |
| 382 | * |
| 383 | * @param $errno |
| 384 | * @param $errstr |
| 385 | */ |
| 386 | protected function session_start_error($errno, $errstr) |
| 387 | { |
| 388 | } |
| 389 | } |
| 390 |