SessionFingerprint.php — Matomo Analytics – Powerful, Privacy-First Insights for WordPress 4.13.5

matomo / app / core / Session / SessionFingerprint.php

matomo / app / core / Session Last commit date

SaveHandler 4 years ago SessionAuth.php 4 years ago SessionFingerprint.php 4 years ago SessionInitializer.php 5 years ago SessionNamespace.php 5 years ago

SessionFingerprint.php

180 lines

1	<?php
2	/**
3	* Matomo - free/libre analytics platform
4	*
5	* @link https://matomo.org
6	* @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
7	*
8	*/
9
10	namespace Piwik\Session;
11
12	use Piwik\Config;
13	use Piwik\Date;
14
15	/**
16	* Manages session information that is used to identify who the session
17	* is for.
18	*
19	* Once a session is authenticated using either a user name & password or
20	* token auth, some information about the user is stored in the session.
21	* This info includes the user name and the user agent
22	* string of the user's client, and a random session secret.
23	*
24	* In subsequent requests that use this session, we use the above information
25	* to verify that the session is allowed to be used by the person sending the
26	* request.
27	*
28	* This is accomplished by checking the request's user agent
29	* against what is stored in the session. If it doesn't then this is a
30	* session hijacking attempt.
31	*
32	* We also check that a hash in the matomo_auth cookie matches the hash
33	* of the time the user last changed their password + the session secret.
34	* If they don't match, the password has been changed since this session
35	* started, and is no longer valid.
36	*/
37	class SessionFingerprint
38	{
39	// used in case the global.ini.php becomes corrupt or doesn't update properly
40	const DEFAULT_IDLE_TIMEOUT = 3600;
41
42	const USER_NAME_SESSION_VAR_NAME = 'user.name';
43	const SESSION_INFO_SESSION_VAR_NAME = 'session.info';
44	const SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED = 'twofactorauth.verified';
45	const SESSION_INFO_TEMP_TOKEN_AUTH = 'user.token_auth_temp';
46
47	public function getUser()
48	{
49	if (isset($_SESSION[self::USER_NAME_SESSION_VAR_NAME])) {
50	return $_SESSION[self::USER_NAME_SESSION_VAR_NAME];
51	}
52
53	return null;
54	}
55
56	public function getUserInfo()
57	{
58	if (isset($_SESSION[self::SESSION_INFO_SESSION_VAR_NAME])) {
59	return $_SESSION[self::SESSION_INFO_SESSION_VAR_NAME];
60	}
61
62	return null;
63	}
64
65	public function getSessionTokenAuth()
66	{
67	if (!empty($_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH])) {
68	return $_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH];
69	}
70
71	return null;
72	}
73
74	public function hasVerifiedTwoFactor()
75	{
76	if (isset($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED])) {
77	return !empty($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED]);
78	}
79
80	return null;
81	}
82
83	public function setTwoFactorAuthenticationVerified()
84	{
85	$_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED] = 1;
86	}
87
88	public function initialize($userName, $tokenAuth, $isRemembered = false, $time = null)
89	{
90	$time = $time ?: Date::now()->getTimestampUTC();
91	$_SESSION[self::USER_NAME_SESSION_VAR_NAME] = $userName;
92	$_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED] = 0;
93	$_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH] = $tokenAuth;
94	$_SESSION[self::SESSION_INFO_SESSION_VAR_NAME] = [
95	'ts' => $time,
96	'remembered' => $isRemembered,
97	'expiration' => $this->getExpirationTimeFromNow($time),
98	];
99	}
100
101	public function clear()
102	{
103	if (isset($_SESSION[self::USER_NAME_SESSION_VAR_NAME])) { // may not be available during tests
104	unset($_SESSION[self::USER_NAME_SESSION_VAR_NAME]);
105	}
106
107	if (isset($_SESSION[self::SESSION_INFO_SESSION_VAR_NAME])) { // may not be available during tests
108	unset($_SESSION[self::SESSION_INFO_SESSION_VAR_NAME]);
109	}
110
111	if (isset($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED])) { // may not be available during tests
112	unset($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED]);
113	}
114
115	if (isset($_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH])) { // may not be available during tests
116	unset($_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH]);
117	}
118	}
119
120	public function getSessionStartTime()
121	{
122	$userInfo = $this->getUserInfo();
123	if (empty($userInfo)
124	\|\| empty($userInfo['ts'])
125	) {
126	return null;
127	}
128
129	return $userInfo['ts'];
130	}
131
132	public function getExpirationTime()
133	{
134	$userInfo = $this->getUserInfo();
135	if (empty($userInfo)
136	\|\| empty($userInfo['expiration'])
137	) {
138	return null;
139	}
140
141	return $userInfo['expiration'];
142	}
143
144	public function isRemembered()
145	{
146	$userInfo = $this->getUserInfo();
147	return !empty($userInfo['remembered']);
148	}
149
150	public function updateSessionExpirationTime()
151	{
152	$_SESSION[self::SESSION_INFO_SESSION_VAR_NAME]['expiration'] = $this->getExpirationTimeFromNow();
153	}
154
155	private function getExpirationTimeFromNow($time = null)
156	{
157	$time = $time ?: Date::now()->getTimestampUTC();
158
159	$general = Config::getInstance()->General;
160
161	if (!isset($general['login_session_not_remembered_idle_timeout'])
162	\|\| (int) $general['login_session_not_remembered_idle_timeout'] <= 0
163	) {
164	$nonRememberedSessionExpireTime = self::DEFAULT_IDLE_TIMEOUT;
165	} else {
166	$nonRememberedSessionExpireTime = (int) $general['login_session_not_remembered_idle_timeout'];
167	}
168
169	$sessionCookieLifetime = $general['login_cookie_expire'];
170
171	if ($this->isRemembered()) {
172	$expireDuration = $sessionCookieLifetime;
173	} else {
174	$expireDuration = $nonRememberedSessionExpireTime;
175	}
176
177	return $time + $expireDuration;
178	}
179	}
180