class-session.php — NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall trunk

ninjafirewall / lib / class-session.php

ninjafirewall / lib Last commit date

class-session.php

246 lines

1	<?php
2	/*
3	+=====================================================================+
4	\| _ _ _ _ _____ _ _ _ \|
5	\| \| \ \| (_)_ __ (_) __ _\| ___(_)_ __ _____ ____ _\| \| \| \|
6	\| \| \\| \| \| '_ \ \| \|/ _` \| \|_ \| \| '__/ _ \ \ /\ / / _` \| \| \| \|
7	\| \| \|\ \| \| \| \| \|\| \| (_\| \| _\| \| \| \| \| __/\ V V / (_\| \| \| \| \|
8	\| \|_\| \_\|_\|_\| \|_\|/ \|\__,_\|_\| \|_\|_\| \___\| \_/\_/ \__,_\|_\|_\| \|
9	\| \|__/ \|
10	\| (c) NinTechNet Limited ~ https://nintechnet.com/ \|
11	+=====================================================================+
12	*/
13
14	if ( class_exists('NinjaFirewall_session') ) {
15	return;
16	}
17
18
19	class NinjaFirewall_session {
20
21	public static $SESSION_NAME = 'NFWSESSID';
22	public static $SESSION_DATA = [];
23	private static $session_dir = '';
24	private static $session_status = false;
25	private static $session_id = 0;
26
27
28	/**
29	* Start a NinjaFirewall session.
30	*/
31	public static function start() {
32	/**
33	* Make sure no header was sent already and no session exists.
34	*/
35	if ( headers_sent() \|\| self::$session_status === true ) {
36	return false;
37	}
38	/**
39	* Create session dir if it doesn't exist.
40	* Note: NFWSESSION_DIR can be defined in the .htninja file.
41	*/
42	if (! self::$session_dir ) {
43	if ( defined('NFWSESSION_DIR') ) {
44	self::$session_dir = NFWSESSION_DIR;
45	} else {
46	self::$session_dir = NFW_LOG_DIR .'/nfwlog/session';
47	}
48	if (! is_dir( self::$session_dir ) ) {
49	$res = mkdir( self::$session_dir, 0700, true );
50	if ( $res === false ) {
51	return false;
52	}
53	}
54	touch( self::$session_dir .'/index.html');
55	}
56	/**
57	* Callback function to close and save the session.
58	*/
59	register_shutdown_function( ['NinjaFirewall_session', 'close'] );
60	/**
61	* Check whether the user already has a session cookie
62	* or if we need to create a new one.
63	*/
64	if (! empty( $_COOKIE[ self::$SESSION_NAME ] ) ) {
65	self::$session_id = $_COOKIE[ self::$SESSION_NAME ];
66	/**
67	* Validate session ID.
68	*/
69	if ( preg_match('`^[-,a-zA-Z0-9]{1,128}$`', self::$session_id ) ) {
70	if ( is_file( self::$session_dir .'/sess_'. hash('sha256', self::$session_id ) ) ) {
71	self::$SESSION_DATA = json_decode(
72	file_get_contents( self::$session_dir .'/sess_'. hash('sha256', self::$session_id ) ),
73	true
74	);
75	if ( self::$SESSION_DATA !== null ) {
76	self::$session_status = true;
77	return true;
78	}
79	}
80	}
81	/**
82	* Not the right cookie, ignore it.
83	*/
84	unset( $_COOKIE[ self::$SESSION_NAME ] );
85	}
86	/**
87	* Create a session ID and its corresponding file.
88	*/
89	self::$session_status = true;
90	self::$SESSION_DATA = [];
91	self::$session_id = session_create_id();
92	file_put_contents( self::$session_dir .'/sess_'. hash('sha256', self::$session_id ), '[]');
93	/**
94	* Set the cookie.
95	*/
96	if ( version_compare( PHP_VERSION, '7.3.0', '<') ) {
97	setcookie(
98	self::$SESSION_NAME,
99	self::$session_id,
100	0,
101	'/',
102	'',
103	self::is_ssl(),
104	true
105	);
106
107	} else {
108	setcookie( self::$SESSION_NAME, self::$session_id, [
109	'expires' => 0,
110	'path' => '/',
111	'domain' => '',
112	'secure' => self::is_ssl(),
113	'httponly' => true
114	] );
115	}
116	return true;
117	}
118
119
120	/**
121	* Read session data.
122	*/
123	public static function read( $key ) {
124
125	if ( isset( self::$SESSION_DATA[ $key ] ) ) {
126	return self::$SESSION_DATA[ $key ];
127	}
128	return null;
129	}
130
131
132	/**
133	* Write session data.
134	*/
135	public static function write( $data = [] ) {
136
137	foreach( $data as $key => $value ) {
138	self::$SESSION_DATA[ $key ] = $value;
139	}
140	}
141
142
143	/**
144	* Unset a key or the whole session array.
145	*/
146	public static function delete( $key = '') {
147
148	if ( $key ) {
149	unset ( self::$SESSION_DATA[ $key ] );
150	} else {
151	self::$SESSION_DATA = [];
152	}
153	}
154
155
156	/**
157	* Destroy a session (cookie, ID and file).
158	*/
159	public static function destroy() {
160	/**
161	* User has a session cookie, delete it and the matching file.
162	*/
163	if ( isset( $_COOKIE[ self::$SESSION_NAME ] ) ) {
164	if ( $_COOKIE[ self::$SESSION_NAME ] === self::$session_id ) {
165	if ( is_file( self::$session_dir .'/sess_'. hash('sha256', self::$session_id ) ) ) {
166	unlink( self::$session_dir .'/sess_'. hash('sha256', self::$session_id ) );
167	}
168	}
169	unset( $_COOKIE[ self::$SESSION_NAME ] );
170	}
171	self::$SESSION_DATA = [];
172	self::$session_status = false;
173	self::$session_id = 0;
174	}
175
176
177	/**
178	* Write session data and end session, but keep $SESSION_DATA.
179	*/
180	public static function close() {
181
182	if ( isset( $_COOKIE[ self::$SESSION_NAME ] ) ) {
183	if ( $_COOKIE[ self::$SESSION_NAME ] === self::$session_id ) {
184	if ( is_file( self::$session_dir .'/sess_'. hash('sha256', self::$session_id ) ) ) {
185	file_put_contents(
186	self::$session_dir .'/sess_'. hash('sha256', self::$session_id ),
187	json_encode( self::$SESSION_DATA )
188	);
189	self::$session_status = false;
190	return true;
191	}
192	}
193	/**
194	* Wrong cookie, unset it.
195	*/
196	unset( $_COOKIE[ self::$SESSION_NAME ] );
197	}
198	/**
199	* First run, no cookie has been set yet.
200	*/
201	if ( self::$session_id ) {
202	file_put_contents(
203	self::$session_dir .'/sess_'. hash('sha256', self::$session_id ),
204	json_encode( self::$SESSION_DATA )
205	);
206	self::$session_status = false;
207	return true;
208	}
209	return false;
210	}
211
212
213	/**
214	* Return the session name.
215	*/
216	public static function name() {
217
218	return self::$SESSION_NAME;
219	}
220
221
222	/**
223	* Check if we're over TLS.
224	* Note: we use the same code as WordPress wp-includes/load.php
225	* so that we're sure to match WP's behaviour.
226	*/
227	private static function is_ssl() {
228	if ( isset( $_SERVER['HTTPS'] ) ) {
229	if ('on' === $_SERVER['HTTPS'] ) {
230	return true;
231	}
232	if ('1' === $_SERVER['HTTPS'] ) {
233	return true;
234	}
235	} elseif ( isset( $_SERVER['SERVER_PORT'] ) &&
236	'443' === $_SERVER['SERVER_PORT'] ) {
237
238	return true;
239	}
240	return false;
241	}
242
243	}
244	// =====================================================================
245	// EOF
246