SessionFingerprint.php — Matomo Analytics – Powerful, Privacy-First Insights for WordPress 5.0.3

matomo / app / core / Session / SessionFingerprint.php

matomo / app / core / Session Last commit date

SaveHandler 2 years ago SessionAuth.php 2 years ago SessionFingerprint.php 2 years ago SessionInitializer.php 2 years ago SessionNamespace.php 2 years ago

SessionFingerprint.php

146 lines

1	<?php
2
3	/**
4	* Matomo - free/libre analytics platform
5	*
6	* @link https://matomo.org
7	* @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
8	*
9	*/
10	namespace Piwik\Session;
11
12	use Piwik\Config;
13	use Piwik\Date;
14	/**
15	* Manages session information that is used to identify who the session
16	* is for.
17	*
18	* Once a session is authenticated using either a user name & password or
19	* token auth, some information about the user is stored in the session.
20	* This info includes the user name and the user agent
21	* string of the user's client, and a random session secret.
22	*
23	* In subsequent requests that use this session, we use the above information
24	* to verify that the session is allowed to be used by the person sending the
25	* request.
26	*
27	* This is accomplished by checking the request's user agent
28	* against what is stored in the session. If it doesn't then this is a
29	* session hijacking attempt.
30	*
31	* We also check that a hash in the matomo_auth cookie matches the hash
32	* of the time the user last changed their password + the session secret.
33	* If they don't match, the password has been changed since this session
34	* started, and is no longer valid.
35	*/
36	class SessionFingerprint
37	{
38	// used in case the global.ini.php becomes corrupt or doesn't update properly
39	const DEFAULT_IDLE_TIMEOUT = 3600;
40	const USER_NAME_SESSION_VAR_NAME = 'user.name';
41	const SESSION_INFO_SESSION_VAR_NAME = 'session.info';
42	const SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED = 'twofactorauth.verified';
43	const SESSION_INFO_TEMP_TOKEN_AUTH = 'user.token_auth_temp';
44	public function getUser()
45	{
46	if (isset($_SESSION[self::USER_NAME_SESSION_VAR_NAME])) {
47	return $_SESSION[self::USER_NAME_SESSION_VAR_NAME];
48	}
49	return null;
50	}
51	public function getUserInfo()
52	{
53	if (isset($_SESSION[self::SESSION_INFO_SESSION_VAR_NAME])) {
54	return $_SESSION[self::SESSION_INFO_SESSION_VAR_NAME];
55	}
56	return null;
57	}
58	public function getSessionTokenAuth()
59	{
60	if (!empty($_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH])) {
61	return $_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH];
62	}
63	return null;
64	}
65	public function hasVerifiedTwoFactor()
66	{
67	if (isset($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED])) {
68	return !empty($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED]);
69	}
70	return null;
71	}
72	public function setTwoFactorAuthenticationVerified()
73	{
74	$_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED] = 1;
75	}
76	public function initialize($userName, $tokenAuth, $isRemembered = false, $time = null)
77	{
78	$time = $time ?: Date::now()->getTimestampUTC();
79	$_SESSION[self::USER_NAME_SESSION_VAR_NAME] = $userName;
80	$_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED] = 0;
81	$_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH] = $tokenAuth;
82	$_SESSION[self::SESSION_INFO_SESSION_VAR_NAME] = ['ts' => $time, 'remembered' => $isRemembered, 'expiration' => $this->getExpirationTimeFromNow($time)];
83	}
84	public function clear()
85	{
86	if (isset($_SESSION[self::USER_NAME_SESSION_VAR_NAME])) {
87	// may not be available during tests
88	unset($_SESSION[self::USER_NAME_SESSION_VAR_NAME]);
89	}
90	if (isset($_SESSION[self::SESSION_INFO_SESSION_VAR_NAME])) {
91	// may not be available during tests
92	unset($_SESSION[self::SESSION_INFO_SESSION_VAR_NAME]);
93	}
94	if (isset($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED])) {
95	// may not be available during tests
96	unset($_SESSION[self::SESSION_INFO_TWO_FACTOR_AUTH_VERIFIED]);
97	}
98	if (isset($_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH])) {
99	// may not be available during tests
100	unset($_SESSION[self::SESSION_INFO_TEMP_TOKEN_AUTH]);
101	}
102	}
103	public function getSessionStartTime()
104	{
105	$userInfo = $this->getUserInfo();
106	if (empty($userInfo) \|\| empty($userInfo['ts'])) {
107	return null;
108	}
109	return $userInfo['ts'];
110	}
111	public function getExpirationTime()
112	{
113	$userInfo = $this->getUserInfo();
114	if (empty($userInfo) \|\| empty($userInfo['expiration'])) {
115	return null;
116	}
117	return $userInfo['expiration'];
118	}
119	public function isRemembered()
120	{
121	$userInfo = $this->getUserInfo();
122	return !empty($userInfo['remembered']);
123	}
124	public function updateSessionExpirationTime()
125	{
126	$_SESSION[self::SESSION_INFO_SESSION_VAR_NAME]['expiration'] = $this->getExpirationTimeFromNow();
127	}
128	private function getExpirationTimeFromNow($time = null)
129	{
130	$time = $time ?: Date::now()->getTimestampUTC();
131	$general = Config::getInstance()->General;
132	if (!isset($general['login_session_not_remembered_idle_timeout']) \|\| (int) $general['login_session_not_remembered_idle_timeout'] <= 0) {
133	$nonRememberedSessionExpireTime = self::DEFAULT_IDLE_TIMEOUT;
134	} else {
135	$nonRememberedSessionExpireTime = (int) $general['login_session_not_remembered_idle_timeout'];
136	}
137	$sessionCookieLifetime = $general['login_cookie_expire'];
138	if ($this->isRemembered()) {
139	$expireDuration = $sessionCookieLifetime;
140	} else {
141	$expireDuration = $nonRememberedSessionExpireTime;
142	}
143	return $time + $expireDuration;
144	}
145	}
146