vikbooking / libraries / adapter / session / handler.php

handler.php in VikBooking Hotel Booking Engine & PMS 1.8.6, at libraries/adapter/session/handler.php

167 lines 4.2 KB

Raw Download Zip

1	<?php
2	/**
3	* @package VikWP - Libraries
4	* @subpackage adapter.session
5	* @author E4J s.r.l.
6	* @copyright Copyright (C) 2023 E4J s.r.l. All Rights Reserved.
7	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
8	* @link https://vikwp.com
9	*/
10
11	// No direct access
12	defined('ABSPATH') or die('No script kiddies please!');
13
14	/**
15	* Class used to handle the PHP session.
16	* Provides the methods to begin a new session and to destroy it.
17	*
18	* @since 10.0
19	*/
20	class JSessionHandler
21	{
22	/**
23	* Starts a new session, only if it doesn't already exist.
24	*
25	* @return void
26	*/
27	public static function start()
28	{
29	/**
30	* Prevent the handler from starting a new session in case the process was launched
31	* from wp-cron.php, which manually sends some headers at the beginning of the file.
32	*
33	* @since 10.1.65
34	*/
35	if (defined('DOING_CRON') && DOING_CRON)
36	{
37	return;
38	}
39
40	if (!self::isStarted())
41	{
42	session_start();
43	}
44
45	/**
46	* Filters whether to preempt an HTTP request's return value.
47	* It is needed to support concurrent cURL requests (see Site Health).
48	*
49	* Returning a non-false value from the filter will short-circuit the HTTP request and return
50	* early with that value. A filter should return either:
51	*
52	* - An array containing 'headers', 'body', 'response', 'cookies', and 'filename' elements
53	* - A WP_Error instance
54	* - boolean false (to avoid short-circuiting the response)
55	*
56	* Returning any other value may result in unexpected behaviour.
57	*
58	* @since 2.9.0
59	*
60	* @param false\|array\|WP_Error $preempt Whether to preempt an HTTP request's return value. Default false.
61	* @param array $r HTTP request arguments.
62	* @param string $url The request URL.
63	*/
64	add_filter('pre_http_request', function($preempt, $r, $url)
65	{
66	$input = JFactory::getApplication()->input;
67
68	$httpUrl = new JUri($url);
69	$baseUrl = new JUri(site_url());
70
71	/**
72	* As WP Site Health suggests, an active session might close timeouts for loopback connection.
73	* For this reason, every time an HTTP request is made, we should try to detect whether the
74	* provided end-point has the same root of the current website, meaning that we are performing
75	* a self connection, probably through the REST API.
76	*
77	* @since 10.1.39
78	*/
79	if (strpos($httpUrl->toString(['host', 'path']), $baseUrl->toString(['host', 'path'])) !== false)
80	{
81	// loopback detected, terminate the session before starting a request
82	session_write_close();
83	}
84
85	return $preempt;
86	}, 10, 3);
87
88	/**
89	* Suppress "session active" critical error when Site Health performs its tests.
90	*
91	* Even if the session is active on Site Health, the plugin always call the
92	* `session_write_close` method before making any HTTP requests.
93	*
94	* @since 5.5.0
95	*/
96	add_action('init', function() {
97	global $pagenow;
98
99	// check if the current page is Site Health
100	if (preg_match("/^site-health/i", $pagenow))
101	{
102	// always write session to avoid receiving a critical issue
103	session_write_close();
104	}
105	});
106	}
107
108	/**
109	* Destroys the current active session, only if it already exists.
110	*
111	* @param boolean $restart True to immediately restart a new session.
112	*
113	* @return void
114	*/
115	public static function destroy($restart = true)
116	{
117	if (!self::isStarted())
118	{
119	return;
120	}
121
122	session_destroy();
123
124	if ($restart)
125	{
126	self::start();
127	}
128	}
129
130	/**
131	* Checks if a session has been started.
132	*
133	* @return boolean True if active, otherwise false.
134	*/
135	public static function isStarted()
136	{
137	/**
138	* Make sure the session status is currently active. This because,
139	* in case someone had manually closed the session, this method would
140	* have improperly returned true.
141	*
142	* @since 10.1.43
143	*/
144	return session_status() === PHP_SESSION_ACTIVE && self::getId();
145	}
146
147	/**
148	* Returns the session ID, if any.
149	*
150	* @return string The unique session ID if active, otherwise an empty string.
151	*/
152	public static function getId()
153	{
154	return session_id();
155	}
156
157	/**
158	* Returns the session name, if any.
159	*
160	* @return string The session name.
161	*/
162	public static function getName()
163	{
164	return session_name();
165	}
166	}
167