Session.php — Matomo Analytics – Powerful, Privacy-First Insights for WordPress 5.0.7

matomo / app / core / Session.php

matomo / app / core Last commit date

API 2 years ago Access 2 years ago Application 2 years ago Archive 2 years ago ArchiveProcessor 2 years ago Archiver 2 years ago AssetManager 2 years ago Auth 2 years ago Category 2 years ago Changes 2 years ago CliMulti 2 years ago Columns 2 years ago Concurrency 2 years ago Config 2 years ago Container 2 years ago CronArchive 2 years ago DataAccess 2 years ago DataFiles 2 years ago DataTable 2 years ago Db 2 years ago DeviceDetector 2 years ago Email 2 years ago Exception 2 years ago Http 2 years ago Intl 2 years ago Log 2 years ago Mail 2 years ago Measurable 2 years ago Menu 2 years ago Metrics 2 years ago Notification 2 years ago Period 2 years ago Plugin 2 years ago ProfessionalServices 2 years ago Report 2 years ago ReportRenderer 2 years ago Scheduler 2 years ago Segment 2 years ago Session 2 years ago Settings 2 years ago Tracker 2 years ago Translation 2 years ago Twig 2 years ago UpdateCheck 2 years ago Updater 2 years ago Updates 2 years ago Validators 2 years ago View 2 years ago ViewDataTable 2 years ago Visualization 2 years ago Widget 2 years ago .htaccess 2 years ago Access.php 2 years ago Archive.php 2 years ago ArchiveProcessor.php 2 years ago AssetManager.php 2 years ago Auth.php 2 years ago AuthResult.php 2 years ago BaseFactory.php 2 years ago Cache.php 2 years ago CacheId.php 2 years ago CliMulti.php 2 years ago Common.php 2 years ago Config.php 2 years ago Console.php 2 years ago Context.php 2 years ago Cookie.php 2 years ago CronArchive.php 2 years ago DI.php 2 years ago DataArray.php 2 years ago DataTable.php 2 years ago Date.php 2 years ago Db.php 2 years ago DbHelper.php 2 years ago Development.php 2 years ago ErrorHandler.php 2 years ago EventDispatcher.php 2 years ago ExceptionHandler.php 2 years ago FileIntegrity.php 2 years ago Filechecks.php 2 years ago Filesystem.php 2 years ago FrontController.php 2 years ago Http.php 2 years ago IP.php 2 years ago Log.php 2 years ago LogDeleter.php 2 years ago Mail.php 2 years ago Metrics.php 2 years ago NoAccessException.php 2 years ago Nonce.php 2 years ago Notification.php 2 years ago NumberFormatter.php 2 years ago Option.php 2 years ago Period.php 2 years ago Piwik.php 2 years ago Plugin.php 2 years ago Profiler.php 2 years ago ProxyHeaders.php 2 years ago ProxyHttp.php 2 years ago QuickForm2.php 2 years ago RankingQuery.php 2 years ago ReportRenderer.php 2 years ago Request.php 2 years ago Segment.php 2 years ago Sequence.php 2 years ago Session.php 2 years ago SettingsPiwik.php 2 years ago SettingsServer.php 2 years ago Singleton.php 2 years ago Site.php 2 years ago SiteContentDetector.php 2 years ago SupportedBrowser.php 2 years ago TCPDF.php 2 years ago Theme.php 2 years ago Timer.php 2 years ago Tracker.php 2 years ago Twig.php 2 years ago Unzip.php 2 years ago UpdateCheck.php 2 years ago Updater.php 2 years ago UpdaterErrorException.php 2 years ago Updates.php 2 years ago Url.php 2 years ago UrlHelper.php 2 years ago Version.php 2 years ago View.php 2 years ago bootstrap.php 2 years ago dispatch.php 2 years ago testMinimumPhpVersion.php 2 years ago

Session.php

182 lines

1	<?php
2
3	/**
4	* Matomo - free/libre analytics platform
5	*
6	* @link https://matomo.org
7	* @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
8	*
9	*/
10	namespace Piwik;
11
12	use Exception;
13	use Piwik\Container\StaticContainer;
14	use Piwik\Exception\MissingFilePermissionException;
15	use Piwik\Plugins\Overlay\Overlay;
16	use Piwik\Session\SaveHandler\DbTable;
17	use Piwik\Log\LoggerInterface;
18	use Zend_Session;
19	/**
20	* Session initialization.
21	*/
22	class Session extends Zend_Session
23	{
24	const SESSION_NAME = 'MATOMO_SESSID';
25	public static $sessionName = self::SESSION_NAME;
26	protected static $sessionStarted = false;
27	/**
28	* Start the session
29	*
30	* @param array\|bool $options An array of configuration options; the auto-start (bool) setting is ignored
31	* @return void
32	* @throws Exception if starting a session fails
33	*/
34	public static function start($options = false)
35	{
36	if (headers_sent() \|\| self::$sessionStarted \|\| defined('PIWIK_ENABLE_SESSION_START') && !PIWIK_ENABLE_SESSION_START \|\| session_status() == PHP_SESSION_ACTIVE) {
37	return;
38	}
39	self::$sessionStarted = true;
40	if (defined('PIWIK_SESSION_NAME')) {
41	self::$sessionName = PIWIK_SESSION_NAME;
42	}
43	$config = \Piwik\Config::getInstance();
44	// use cookies to store session id on the client side
45	@ini_set('session.use_cookies', '1');
46	// prevent attacks involving session ids passed in URLs
47	@ini_set('session.use_only_cookies', '1');
48	// advise browser that session cookie should only be sent over secure connection
49	if (\Piwik\ProxyHttp::isHttps()) {
50	@ini_set('session.cookie_secure', '1');
51	}
52	// advise browser that session cookie should only be accessible through the HTTP protocol (i.e., not JavaScript)
53	@ini_set('session.cookie_httponly', '1');
54	// don't use the default: PHPSESSID
55	@ini_set('session.name', self::$sessionName);
56	// proxies may cause the referer check to fail and
57	// incorrectly invalidate the session
58	@ini_set('session.referer_check', '');
59	// to preserve previous behavior matomo_auth provided when it contained a token_auth, we ensure
60	// the session data won't be deleted until the cookie expires.
61	@ini_set('session.gc_maxlifetime', $config->General['login_cookie_expire']);
62	@ini_set('session.cookie_path', empty($config->General['login_cookie_path']) ? '/' : $config->General['login_cookie_path']);
63	$currentSaveHandler = ini_get('session.save_handler');
64	if (!\Piwik\SettingsPiwik::isMatomoInstalled()) {
65	// Note: this handler doesn't work well in load-balanced environments and may have a concurrency issue with locked session files
66	// for "files", use our own folder to prevent local session file hijacking
67	$sessionPath = self::getSessionsDirectory();
68	// We always call mkdir since it also chmods the directory which might help when permissions were reverted for some reasons
69	\Piwik\Filesystem::mkdir($sessionPath);
70	@ini_set('session.save_handler', 'files');
71	@ini_set('session.save_path', $sessionPath);
72	} else {
73	// as of Matomo 3.7.0 we only support files session handler during installation
74	// We consider these to be misconfigurations, in that:
75	// - user - we can't verify that user-defined session handler functions have already been set via session_set_save_handler()
76	// - mm - this handler is not recommended, unsupported, not available for Windows, and has a potential concurrency issue
77	if (@ini_get('session.serialize_handler') !== 'php_serialize') {
78	@ini_set('session.serialize_handler', 'php_serialize');
79	}
80	$config = self::getDbTableConfig();
81	$saveHandler = new DbTable($config);
82	if ($saveHandler) {
83	self::setSaveHandler($saveHandler);
84	}
85	}
86	// set garbage collection according to user preferences (on by default)
87	@ini_set('session.gc_probability', \Piwik\Config::getInstance()->General['session_gc_probability']);
88	try {
89	parent::start();
90	register_shutdown_function(array('Zend_Session', 'writeClose'), true);
91	} catch (Exception $e) {
92	StaticContainer::get(LoggerInterface::class)->error('Unable to start session: {exception}', ['exception' => $e, 'ignoreInScreenWriter' => true]);
93	if (\Piwik\SettingsPiwik::isMatomoInstalled()) {
94	$pathToSessions = '';
95	} else {
96	$pathToSessions = \Piwik\Filechecks::getErrorMessageMissingPermissions(self::getSessionsDirectory());
97	}
98	$message = sprintf("Error: %s %s\n<pre>Debug: the original error was \n%s</pre>", \Piwik\Piwik::translate('General_ExceptionUnableToStartSession'), $pathToSessions, $e->getMessage());
99	$ex = new MissingFilePermissionException($message, $e->getCode(), $e);
100	$ex->setIsHtmlMessage();
101	throw $ex;
102	}
103	}
104	/**
105	* Returns the directory session files are stored in.
106	*
107	* @return string
108	*/
109	public static function getSessionsDirectory()
110	{
111	return StaticContainer::get('path.tmp') . '/sessions';
112	}
113	public static function close()
114	{
115	if (self::isSessionStarted()) {
116	// only write/close session if the session was actually started by us
117	// otherwise we will set the session values to base64 encoded and whoever the session started might not expect the values in that way
118	parent::writeClose();
119	}
120	}
121	public static function isSessionStarted()
122	{
123	return self::$sessionStarted;
124	}
125	public static function getSameSiteCookieValue()
126	{
127	$config = \Piwik\Config::getInstance();
128	$general = $config->General;
129	$module = \Piwik\Piwik::getModule();
130	$action = \Piwik\Piwik::getAction();
131	$method = \Piwik\Common::getRequestVar('method', '', 'string');
132	$referer = \Piwik\Url::getReferrer();
133	$isOptOutRequest = $module == 'CoreAdminHome' && ($action == 'optOut' \|\| $action == 'optOutJS');
134	$shouldUseNone = !empty($general['enable_framed_pages']) \|\| $isOptOutRequest \|\| Overlay::isOverlayRequest($module, $action, $method, $referer);
135	if ($shouldUseNone && \Piwik\ProxyHttp::isHttps()) {
136	return 'None';
137	}
138	return 'Lax';
139	}
140	/**
141	* Write cookie header. Similar to the native setcookie() function but also supports
142	* the SameSite cookie property.
143	* @param $name
144	* @param $value
145	* @param int $expires
146	* @param string $path
147	* @param string $domain
148	* @param bool $secure
149	* @param bool $httpOnly
150	* @param string $sameSite
151	* @return string
152	*/
153	public static function writeCookie($name, $value, $expires = 0, $path = '/', $domain = '/', $secure = false, $httpOnly = false, $sameSite = 'lax')
154	{
155	$headerStr = 'Set-Cookie: ' . rawurlencode($name) . '=' . rawurlencode($value);
156	if ($expires) {
157	$headerStr .= '; expires=' . gmdate('D, d-M-Y H:i:s', $expires) . ' GMT';
158	}
159	if ($path) {
160	$headerStr .= '; path=' . $path;
161	}
162	if ($domain) {
163	$headerStr .= '; domain=' . rawurlencode($domain);
164	}
165	if ($secure) {
166	$headerStr .= '; secure';
167	}
168	if ($httpOnly) {
169	$headerStr .= '; httponly';
170	}
171	if ($sameSite) {
172	$headerStr .= '; SameSite=' . $sameSite;
173	}
174	\Piwik\Common::sendHeader($headerStr);
175	return $headerStr;
176	}
177	public static function getDbTableConfig()
178	{
179	return array('name' => \Piwik\Common::prefixTable(DbTable::TABLE_NAME), 'primary' => 'id', 'modifiedColumn' => 'modified', 'dataColumn' => 'data', 'lifetimeColumn' => 'lifetime');
180	}
181	}
182