API
3 years ago
Access
3 years ago
Application
4 years ago
Archive
3 years ago
ArchiveProcessor
3 years ago
Archiver
5 years ago
AssetManager
3 years ago
Auth
3 years ago
Category
5 years ago
Changes
4 years ago
CliMulti
4 years ago
Columns
3 years ago
Concurrency
3 years ago
Config
4 years ago
Container
4 years ago
CronArchive
3 years ago
DataAccess
3 years ago
DataFiles
5 years ago
DataTable
3 years ago
Db
3 years ago
DeviceDetector
3 years ago
Email
5 years ago
Exception
4 years ago
Http
4 years ago
Intl
4 years ago
Mail
4 years ago
Measurable
5 years ago
Menu
3 years ago
Metrics
4 years ago
Notification
4 years ago
Period
4 years ago
Plugin
3 years ago
ProfessionalServices
4 years ago
Report
5 years ago
ReportRenderer
3 years ago
Scheduler
4 years ago
Segment
3 years ago
Session
4 years ago
Settings
3 years ago
Tracker
3 years ago
Translation
4 years ago
UpdateCheck
5 years ago
Updater
3 years ago
Updates
3 years ago
Validators
4 years ago
View
4 years ago
ViewDataTable
3 years ago
Visualization
4 years ago
Widget
5 years ago
.htaccess
6 years ago
Access.php
4 years ago
Archive.php
4 years ago
ArchiveProcessor.php
4 years ago
AssetManager.php
4 years ago
Auth.php
5 years ago
AuthResult.php
5 years ago
BaseFactory.php
5 years ago
Cache.php
5 years ago
CacheId.php
5 years ago
CliMulti.php
4 years ago
Common.php
3 years ago
Config.php
3 years ago
Console.php
4 years ago
Context.php
5 years ago
Cookie.php
3 years ago
CronArchive.php
3 years ago
DataArray.php
4 years ago
DataTable.php
3 years ago
Date.php
4 years ago
Db.php
4 years ago
DbHelper.php
4 years ago
Development.php
5 years ago
ErrorHandler.php
5 years ago
EventDispatcher.php
3 years ago
ExceptionHandler.php
4 years ago
FileIntegrity.php
5 years ago
Filechecks.php
4 years ago
Filesystem.php
3 years ago
FrontController.php
3 years ago
Http.php
3 years ago
IP.php
4 years ago
Log.php
4 years ago
LogDeleter.php
4 years ago
Mail.php
4 years ago
Metrics.php
3 years ago
NoAccessException.php
5 years ago
Nonce.php
3 years ago
Notification.php
5 years ago
NumberFormatter.php
4 years ago
Option.php
4 years ago
Period.php
5 years ago
Piwik.php
3 years ago
Plugin.php
4 years ago
Profiler.php
4 years ago
ProxyHeaders.php
5 years ago
ProxyHttp.php
3 years ago
QuickForm2.php
5 years ago
RankingQuery.php
3 years ago
ReportRenderer.php
4 years ago
Segment.php
4 years ago
Sequence.php
5 years ago
Session.php
3 years ago
SettingsPiwik.php
3 years ago
SettingsServer.php
5 years ago
Singleton.php
5 years ago
Site.php
3 years ago
SiteContentDetector.php
3 years ago
SupportedBrowser.php
3 years ago
TCPDF.php
5 years ago
Theme.php
5 years ago
Timer.php
5 years ago
Tracker.php
4 years ago
Twig.php
4 years ago
Unzip.php
5 years ago
UpdateCheck.php
5 years ago
Updater.php
4 years ago
UpdaterErrorException.php
5 years ago
Updates.php
5 years ago
Url.php
4 years ago
UrlHelper.php
3 years ago
Version.php
3 years ago
View.php
3 years ago
bootstrap.php
3 years ago
dispatch.php
5 years ago
testMinimumPhpVersion.php
3 years ago
Session.php
237 lines
| 1 | <?php |
| 2 | /** |
| 3 | * Matomo - free/libre analytics platform |
| 4 | * |
| 5 | * @link https://matomo.org |
| 6 | * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later |
| 7 | * |
| 8 | */ |
| 9 | namespace Piwik; |
| 10 | |
| 11 | use Exception; |
| 12 | use Piwik\Container\StaticContainer; |
| 13 | use Piwik\Exception\MissingFilePermissionException; |
| 14 | use Piwik\Plugins\Overlay\Overlay; |
| 15 | use Piwik\Session\SaveHandler\DbTable; |
| 16 | use Psr\Log\LoggerInterface; |
| 17 | use Zend_Session; |
| 18 | |
| 19 | /** |
| 20 | * Session initialization. |
| 21 | */ |
| 22 | class Session extends Zend_Session |
| 23 | { |
| 24 | const SESSION_NAME = 'MATOMO_SESSID'; |
| 25 | |
| 26 | public static $sessionName = self::SESSION_NAME; |
| 27 | |
| 28 | protected static $sessionStarted = false; |
| 29 | |
| 30 | /** |
| 31 | * Start the session |
| 32 | * |
| 33 | * @param array|bool $options An array of configuration options; the auto-start (bool) setting is ignored |
| 34 | * @return void |
| 35 | * @throws Exception if starting a session fails |
| 36 | */ |
| 37 | public static function start($options = false) |
| 38 | { |
| 39 | if (headers_sent() |
| 40 | || self::$sessionStarted |
| 41 | || (defined('PIWIK_ENABLE_SESSION_START') && !PIWIK_ENABLE_SESSION_START) |
| 42 | || session_status() == PHP_SESSION_ACTIVE |
| 43 | ) { |
| 44 | return; |
| 45 | } |
| 46 | self::$sessionStarted = true; |
| 47 | |
| 48 | if (defined('PIWIK_SESSION_NAME')) { |
| 49 | self::$sessionName = PIWIK_SESSION_NAME; |
| 50 | } |
| 51 | |
| 52 | $config = Config::getInstance(); |
| 53 | |
| 54 | // use cookies to store session id on the client side |
| 55 | @ini_set('session.use_cookies', '1'); |
| 56 | |
| 57 | // prevent attacks involving session ids passed in URLs |
| 58 | @ini_set('session.use_only_cookies', '1'); |
| 59 | |
| 60 | // advise browser that session cookie should only be sent over secure connection |
| 61 | if (ProxyHttp::isHttps()) { |
| 62 | @ini_set('session.cookie_secure', '1'); |
| 63 | } |
| 64 | |
| 65 | // advise browser that session cookie should only be accessible through the HTTP protocol (i.e., not JavaScript) |
| 66 | @ini_set('session.cookie_httponly', '1'); |
| 67 | |
| 68 | // don't use the default: PHPSESSID |
| 69 | @ini_set('session.name', self::$sessionName); |
| 70 | |
| 71 | // proxies may cause the referer check to fail and |
| 72 | // incorrectly invalidate the session |
| 73 | @ini_set('session.referer_check', ''); |
| 74 | |
| 75 | // to preserve previous behavior matomo_auth provided when it contained a token_auth, we ensure |
| 76 | // the session data won't be deleted until the cookie expires. |
| 77 | @ini_set('session.gc_maxlifetime', $config->General['login_cookie_expire']); |
| 78 | |
| 79 | @ini_set('session.cookie_path', empty($config->General['login_cookie_path']) ? '/' : $config->General['login_cookie_path']); |
| 80 | |
| 81 | $currentSaveHandler = ini_get('session.save_handler'); |
| 82 | |
| 83 | if (!SettingsPiwik::isMatomoInstalled()) { |
| 84 | // Note: this handler doesn't work well in load-balanced environments and may have a concurrency issue with locked session files |
| 85 | |
| 86 | // for "files", use our own folder to prevent local session file hijacking |
| 87 | $sessionPath = self::getSessionsDirectory(); |
| 88 | // We always call mkdir since it also chmods the directory which might help when permissions were reverted for some reasons |
| 89 | Filesystem::mkdir($sessionPath); |
| 90 | |
| 91 | @ini_set('session.save_handler', 'files'); |
| 92 | @ini_set('session.save_path', $sessionPath); |
| 93 | } else { |
| 94 | // as of Matomo 3.7.0 we only support files session handler during installation |
| 95 | |
| 96 | // We consider these to be misconfigurations, in that: |
| 97 | // - user - we can't verify that user-defined session handler functions have already been set via session_set_save_handler() |
| 98 | // - mm - this handler is not recommended, unsupported, not available for Windows, and has a potential concurrency issue |
| 99 | |
| 100 | if (@ini_get('session.serialize_handler') !== 'php_serialize') { |
| 101 | @ini_set('session.serialize_handler', 'php_serialize'); |
| 102 | } |
| 103 | |
| 104 | $config = self::getDbTableConfig(); |
| 105 | |
| 106 | $saveHandler = new DbTable($config); |
| 107 | if ($saveHandler) { |
| 108 | self::setSaveHandler($saveHandler); |
| 109 | } |
| 110 | } |
| 111 | |
| 112 | // set garbage collection according to user preferences (on by default) |
| 113 | @ini_set('session.gc_probability', Config::getInstance()->General['session_gc_probability']); |
| 114 | |
| 115 | try { |
| 116 | parent::start(); |
| 117 | register_shutdown_function(array('Zend_Session', 'writeClose'), true); |
| 118 | } catch (Exception $e) { |
| 119 | StaticContainer::get(LoggerInterface::class)->error('Unable to start session: {exception}', [ |
| 120 | 'exception' => $e, |
| 121 | 'ignoreInScreenWriter' => true, |
| 122 | ]); |
| 123 | |
| 124 | if (SettingsPiwik::isMatomoInstalled()) { |
| 125 | $pathToSessions = ''; |
| 126 | } else { |
| 127 | $pathToSessions = Filechecks::getErrorMessageMissingPermissions(self::getSessionsDirectory()); |
| 128 | } |
| 129 | |
| 130 | $message = sprintf("Error: %s %s\n<pre>Debug: the original error was \n%s</pre>", |
| 131 | Piwik::translate('General_ExceptionUnableToStartSession'), |
| 132 | $pathToSessions, |
| 133 | $e->getMessage() |
| 134 | ); |
| 135 | |
| 136 | $ex = new MissingFilePermissionException($message, $e->getCode(), $e); |
| 137 | $ex->setIsHtmlMessage(); |
| 138 | |
| 139 | throw $ex; |
| 140 | } |
| 141 | } |
| 142 | |
| 143 | /** |
| 144 | * Returns the directory session files are stored in. |
| 145 | * |
| 146 | * @return string |
| 147 | */ |
| 148 | public static function getSessionsDirectory() |
| 149 | { |
| 150 | return StaticContainer::get('path.tmp') . '/sessions'; |
| 151 | } |
| 152 | |
| 153 | public static function close() |
| 154 | { |
| 155 | if (self::isSessionStarted()) { |
| 156 | // only write/close session if the session was actually started by us |
| 157 | // otherwise we will set the session values to base64 encoded and whoever the session started might not expect the values in that way |
| 158 | parent::writeClose(); |
| 159 | } |
| 160 | } |
| 161 | |
| 162 | public static function isSessionStarted() |
| 163 | { |
| 164 | return self::$sessionStarted; |
| 165 | } |
| 166 | |
| 167 | public static function getSameSiteCookieValue() |
| 168 | { |
| 169 | $config = Config::getInstance(); |
| 170 | $general = $config->General; |
| 171 | |
| 172 | $module = Piwik::getModule(); |
| 173 | $action = Piwik::getAction(); |
| 174 | $method = Common::getRequestVar('method', '', 'string'); |
| 175 | $referer = Url::getReferrer(); |
| 176 | |
| 177 | $isOptOutRequest = $module == 'CoreAdminHome' && ($action == 'optOut' || $action == 'optOutJS'); |
| 178 | $shouldUseNone = !empty($general['enable_framed_pages']) || $isOptOutRequest || Overlay::isOverlayRequest($module, $action, $method, $referer); |
| 179 | |
| 180 | if ($shouldUseNone && ProxyHttp::isHttps()) { |
| 181 | return 'None'; |
| 182 | } |
| 183 | |
| 184 | return 'Lax'; |
| 185 | } |
| 186 | |
| 187 | /** |
| 188 | * Write cookie header. Similar to the native setcookie() function but also supports |
| 189 | * the SameSite cookie property. |
| 190 | * @param $name |
| 191 | * @param $value |
| 192 | * @param int $expires |
| 193 | * @param string $path |
| 194 | * @param string $domain |
| 195 | * @param bool $secure |
| 196 | * @param bool $httpOnly |
| 197 | * @param string $sameSite |
| 198 | * @return string |
| 199 | */ |
| 200 | public static function writeCookie($name, $value, $expires = 0, $path = '/', $domain = '/', $secure = false, $httpOnly = false, $sameSite = 'lax') |
| 201 | { |
| 202 | $headerStr = 'Set-Cookie: ' . rawurlencode($name) . '=' . rawurlencode($value); |
| 203 | if ($expires) { |
| 204 | $headerStr .= '; expires=' . gmdate('D, d-M-Y H:i:s', $expires) . ' GMT'; |
| 205 | } |
| 206 | if ($path) { |
| 207 | $headerStr .= '; path=' . $path; |
| 208 | } |
| 209 | if ($domain) { |
| 210 | $headerStr .= '; domain=' . rawurlencode($domain); |
| 211 | } |
| 212 | if ($secure) { |
| 213 | $headerStr .= '; secure'; |
| 214 | } |
| 215 | if ($httpOnly) { |
| 216 | $headerStr .= '; httponly'; |
| 217 | } |
| 218 | if ($sameSite) { |
| 219 | $headerStr .= '; SameSite=' . $sameSite; |
| 220 | } |
| 221 | |
| 222 | Common::sendHeader($headerStr); |
| 223 | return $headerStr; |
| 224 | } |
| 225 | |
| 226 | public static function getDbTableConfig() |
| 227 | { |
| 228 | return array( |
| 229 | 'name' => Common::prefixTable(DbTable::TABLE_NAME), |
| 230 | 'primary' => 'id', |
| 231 | 'modifiedColumn' => 'modified', |
| 232 | 'dataColumn' => 'data', |
| 233 | 'lifetimeColumn' => 'lifetime', |
| 234 | ); |
| 235 | } |
| 236 | } |
| 237 |