Session.php — Matomo Analytics – Powerful, Privacy-First Insights for WordPress 5.1.4

matomo / app / core / Session.php

matomo / app / core Last commit date

API 2 years ago Access 2 years ago Application 2 years ago Archive 2 years ago ArchiveProcessor 2 years ago Archiver 2 years ago AssetManager 2 years ago Auth 2 years ago Category 2 years ago Changes 2 years ago CliMulti 2 years ago Columns 2 years ago Concurrency 2 years ago Config 2 years ago Container 2 years ago CronArchive 2 years ago DataAccess 2 years ago DataFiles 2 years ago DataTable 2 years ago Db 1 year ago DeviceDetector 2 years ago Email 2 years ago Exception 2 years ago Http 2 years ago Intl 2 years ago Log 2 years ago Mail 2 years ago Measurable 2 years ago Menu 2 years ago Metrics 2 years ago Notification 2 years ago Period 1 year ago Plugin 2 years ago ProfessionalServices 2 years ago Report 2 years ago ReportRenderer 2 years ago Scheduler 2 years ago Segment 2 years ago Session 2 years ago Settings 2 years ago Tracker 1 year ago Translation 2 years ago Twig 2 years ago UpdateCheck 2 years ago Updater 1 year ago Updates 1 year ago Validators 2 years ago View 2 years ago ViewDataTable 2 years ago Visualization 2 years ago Widget 2 years ago .htaccess 2 years ago Access.php 2 years ago Archive.php 2 years ago ArchiveProcessor.php 2 years ago AssetManager.php 2 years ago Auth.php 2 years ago AuthResult.php 2 years ago BaseFactory.php 2 years ago Cache.php 2 years ago CacheId.php 2 years ago CliMulti.php 2 years ago Common.php 2 years ago Config.php 2 years ago Console.php 2 years ago Context.php 2 years ago Cookie.php 2 years ago CronArchive.php 2 years ago DI.php 2 years ago DataArray.php 2 years ago DataTable.php 2 years ago Date.php 2 years ago Db.php 1 year ago DbHelper.php 1 year ago Development.php 2 years ago ErrorHandler.php 2 years ago EventDispatcher.php 2 years ago ExceptionHandler.php 2 years ago FileIntegrity.php 2 years ago Filechecks.php 2 years ago Filesystem.php 2 years ago FrontController.php 2 years ago Http.php 2 years ago IP.php 2 years ago Log.php 2 years ago LogDeleter.php 2 years ago Mail.php 2 years ago Metrics.php 2 years ago NoAccessException.php 2 years ago Nonce.php 2 years ago Notification.php 2 years ago NumberFormatter.php 2 years ago Option.php 2 years ago Period.php 2 years ago Piwik.php 2 years ago Plugin.php 2 years ago Profiler.php 2 years ago ProxyHeaders.php 2 years ago ProxyHttp.php 2 years ago QuickForm2.php 2 years ago RankingQuery.php 2 years ago ReportRenderer.php 2 years ago Request.php 2 years ago Segment.php 2 years ago Sequence.php 2 years ago Session.php 2 years ago SettingsPiwik.php 2 years ago SettingsServer.php 2 years ago Singleton.php 2 years ago Site.php 2 years ago SiteContentDetector.php 2 years ago SupportedBrowser.php 2 years ago TCPDF.php 2 years ago Theme.php 2 years ago Timer.php 2 years ago Tracker.php 2 years ago Twig.php 2 years ago Unzip.php 2 years ago UpdateCheck.php 2 years ago Updater.php 2 years ago UpdaterErrorException.php 2 years ago Updates.php 2 years ago Url.php 2 years ago UrlHelper.php 1 year ago Version.php 1 year ago View.php 2 years ago bootstrap.php 2 years ago dispatch.php 2 years ago testMinimumPhpVersion.php 2 years ago

Session.php

181 lines

1	<?php
2
3	/**
4	* Matomo - free/libre analytics platform
5	*
6	* @link https://matomo.org
7	* @license https://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
8	*/
9	namespace Piwik;
10
11	use Exception;
12	use Piwik\Container\StaticContainer;
13	use Piwik\Exception\MissingFilePermissionException;
14	use Piwik\Plugins\Overlay\Overlay;
15	use Piwik\Session\SaveHandler\DbTable;
16	use Piwik\Log\LoggerInterface;
17	use Zend_Session;
18	/**
19	* Session initialization.
20	*/
21	class Session extends Zend_Session
22	{
23	public const SESSION_NAME = 'MATOMO_SESSID';
24	public static $sessionName = self::SESSION_NAME;
25	protected static $sessionStarted = false;
26	/**
27	* Start the session
28	*
29	* @param array\|bool $options An array of configuration options; the auto-start (bool) setting is ignored
30	* @return void
31	* @throws Exception if starting a session fails
32	*/
33	public static function start($options = false)
34	{
35	if (headers_sent() \|\| self::$sessionStarted \|\| defined('PIWIK_ENABLE_SESSION_START') && !PIWIK_ENABLE_SESSION_START \|\| session_status() == PHP_SESSION_ACTIVE) {
36	return;
37	}
38	self::$sessionStarted = true;
39	if (defined('PIWIK_SESSION_NAME')) {
40	self::$sessionName = PIWIK_SESSION_NAME;
41	}
42	$config = \Piwik\Config::getInstance();
43	// use cookies to store session id on the client side
44	@ini_set('session.use_cookies', '1');
45	// prevent attacks involving session ids passed in URLs
46	@ini_set('session.use_only_cookies', '1');
47	// advise browser that session cookie should only be sent over secure connection
48	if (\Piwik\ProxyHttp::isHttps()) {
49	@ini_set('session.cookie_secure', '1');
50	}
51	// advise browser that session cookie should only be accessible through the HTTP protocol (i.e., not JavaScript)
52	@ini_set('session.cookie_httponly', '1');
53	// don't use the default: PHPSESSID
54	@ini_set('session.name', self::$sessionName);
55	// proxies may cause the referer check to fail and
56	// incorrectly invalidate the session
57	@ini_set('session.referer_check', '');
58	// to preserve previous behavior matomo_auth provided when it contained a token_auth, we ensure
59	// the session data won't be deleted until the cookie expires.
60	@ini_set('session.gc_maxlifetime', $config->General['login_cookie_expire']);
61	@ini_set('session.cookie_path', empty($config->General['login_cookie_path']) ? '/' : $config->General['login_cookie_path']);
62	$currentSaveHandler = ini_get('session.save_handler');
63	if (!\Piwik\SettingsPiwik::isMatomoInstalled()) {
64	// Note: this handler doesn't work well in load-balanced environments and may have a concurrency issue with locked session files
65	// for "files", use our own folder to prevent local session file hijacking
66	$sessionPath = self::getSessionsDirectory();
67	// We always call mkdir since it also chmods the directory which might help when permissions were reverted for some reasons
68	\Piwik\Filesystem::mkdir($sessionPath);
69	@ini_set('session.save_handler', 'files');
70	@ini_set('session.save_path', $sessionPath);
71	} else {
72	// as of Matomo 3.7.0 we only support files session handler during installation
73	// We consider these to be misconfigurations, in that:
74	// - user - we can't verify that user-defined session handler functions have already been set via session_set_save_handler()
75	// - mm - this handler is not recommended, unsupported, not available for Windows, and has a potential concurrency issue
76	if (@ini_get('session.serialize_handler') !== 'php_serialize') {
77	@ini_set('session.serialize_handler', 'php_serialize');
78	}
79	$config = self::getDbTableConfig();
80	$saveHandler = new DbTable($config);
81	if ($saveHandler) {
82	self::setSaveHandler($saveHandler);
83	}
84	}
85	// set garbage collection according to user preferences (on by default)
86	@ini_set('session.gc_probability', \Piwik\Config::getInstance()->General['session_gc_probability']);
87	try {
88	parent::start();
89	register_shutdown_function(array('Zend_Session', 'writeClose'), true);
90	} catch (Exception $e) {
91	StaticContainer::get(LoggerInterface::class)->error('Unable to start session: {exception}', ['exception' => $e, 'ignoreInScreenWriter' => true]);
92	if (\Piwik\SettingsPiwik::isMatomoInstalled()) {
93	$pathToSessions = '';
94	} else {
95	$pathToSessions = \Piwik\Filechecks::getErrorMessageMissingPermissions(self::getSessionsDirectory());
96	}
97	$message = sprintf("Error: %s %s\n<pre>Debug: the original error was \n%s</pre>", \Piwik\Piwik::translate('General_ExceptionUnableToStartSession'), $pathToSessions, $e->getMessage());
98	$ex = new MissingFilePermissionException($message, $e->getCode(), $e);
99	$ex->setIsHtmlMessage();
100	throw $ex;
101	}
102	}
103	/**
104	* Returns the directory session files are stored in.
105	*
106	* @return string
107	*/
108	public static function getSessionsDirectory()
109	{
110	return StaticContainer::get('path.tmp') . '/sessions';
111	}
112	public static function close()
113	{
114	if (self::isSessionStarted()) {
115	// only write/close session if the session was actually started by us
116	// otherwise we will set the session values to base64 encoded and whoever the session started might not expect the values in that way
117	parent::writeClose();
118	}
119	}
120	public static function isSessionStarted()
121	{
122	return self::$sessionStarted;
123	}
124	public static function getSameSiteCookieValue()
125	{
126	$config = \Piwik\Config::getInstance();
127	$general = $config->General;
128	$module = \Piwik\Piwik::getModule();
129	$action = \Piwik\Piwik::getAction();
130	$method = \Piwik\Common::getRequestVar('method', '', 'string');
131	$referer = \Piwik\Url::getReferrer();
132	$isOptOutRequest = $module == 'CoreAdminHome' && ($action == 'optOut' \|\| $action == 'optOutJS');
133	$shouldUseNone = !empty($general['enable_framed_pages']) \|\| $isOptOutRequest \|\| Overlay::isOverlayRequest($module, $action, $method, $referer);
134	if ($shouldUseNone && \Piwik\ProxyHttp::isHttps()) {
135	return 'None';
136	}
137	return 'Lax';
138	}
139	/**
140	* Write cookie header. Similar to the native setcookie() function but also supports
141	* the SameSite cookie property.
142	* @param $name
143	* @param $value
144	* @param int $expires
145	* @param string $path
146	* @param string $domain
147	* @param bool $secure
148	* @param bool $httpOnly
149	* @param string $sameSite
150	* @return string
151	*/
152	public static function writeCookie($name, $value, $expires = 0, $path = '/', $domain = '/', $secure = false, $httpOnly = false, $sameSite = 'lax')
153	{
154	$headerStr = 'Set-Cookie: ' . rawurlencode($name) . '=' . rawurlencode($value);
155	if ($expires) {
156	$headerStr .= '; expires=' . gmdate('D, d-M-Y H:i:s', $expires) . ' GMT';
157	}
158	if ($path) {
159	$headerStr .= '; path=' . $path;
160	}
161	if ($domain) {
162	$headerStr .= '; domain=' . rawurlencode($domain);
163	}
164	if ($secure) {
165	$headerStr .= '; secure';
166	}
167	if ($httpOnly) {
168	$headerStr .= '; httponly';
169	}
170	if ($sameSite) {
171	$headerStr .= '; SameSite=' . $sameSite;
172	}
173	\Piwik\Common::sendHeader($headerStr);
174	return $headerStr;
175	}
176	public static function getDbTableConfig()
177	{
178	return array('name' => \Piwik\Common::prefixTable(DbTable::TABLE_NAME), 'primary' => 'id', 'modifiedColumn' => 'modified', 'dataColumn' => 'data', 'lifetimeColumn' => 'lifetime');
179	}
180	}
181