vikbooking / libraries / adapter / session / session.php

session.php in VikBooking Hotel Booking Engine & PMS trunk, at libraries/adapter/session/session.php

262 lines 6.2 KB

Raw Download Zip

1	<?php
2	/**
3	* @package VikWP - Libraries
4	* @subpackage adapter.session
5	* @author E4J s.r.l.
6	* @copyright Copyright (C) 2023 E4J s.r.l. All Rights Reserved.
7	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
8	* @link https://vikwp.com
9	*/
10
11	// No direct access
12	defined('ABSPATH') or die('No script kiddies please!');
13
14	/**
15	* Class adapter for managing HTTP sessions using the Joomla standard interface.
16	*
17	* @since 10.0
18	*/
19	class JSession
20	{
21	/**
22	* The session adapter instance.
23	*
24	* @var JSession
25	*/
26	private static $instance = null;
27
28	/**
29	* Session data pool.
30	*
31	* @var array
32	*/
33	private $data;
34
35	/**
36	* Class constructor.
37	*/
38	public function __construct()
39	{
40	$this->data = &$_SESSION;
41	}
42
43	/**
44	* Returns the global Session object, only creating it if it doesn't already exist.
45	*
46	* @return self The session object.
47	*/
48	public static function getInstance()
49	{
50	if (static::$instance === null)
51	{
52	static::$instance = new JSession();
53	}
54
55	return static::$instance;
56	}
57
58	/**
59	* Gets data from the session store.
60	*
61	* @param string $name Name of a variable.
62	* @param mixed $default Default value of a variable if not set.
63	* @param string $namespace Namespace to use.
64	*
65	* @return mixed Value of a variable.
66	*/
67	public function get($name, $default = null, $namespace = 'default')
68	{
69	// add prefix and namespace to avoid collisions
70	$key = '__' . $namespace . '.' . $name;
71
72	// check if the key is contained in the SESSION
73	if (isset($this->data[$key]))
74	{
75	return $this->data[$key];
76	}
77
78	return $default;
79	}
80
81	/**
82	* Sets data into the session store.
83	*
84	* @param string $name Name of a variable.
85	* @param mixed $value Value of a variable.
86	* @param string $namespace Namespace to use.
87	*
88	* @return mixed Old value of a variable.
89	*
90	* @uses get()
91	*/
92	public function set($name, $value = null, $namespace = 'default')
93	{
94	$prev = $this->get($name, null, $namespace);
95
96	// add prefix and namespace to avoid collisions
97	$key = '__' . $namespace . '.' . $name;
98
99	// push the value in the session
100	$this->data[$key] = $value;
101
102	return $prev;
103	}
104
105	/**
106	* Checks whether data exists in the session store.
107	*
108	* @param string $name Name of variable.
109	* @param string $namespace Namespace to use.
110	*
111	* @return boolean True if the variable exists.
112	*
113	* @uses get()
114	*/
115	public function has($name, $namespace = 'default')
116	{
117	return !is_null($this->get($name, null, $namespace));
118	}
119
120	/**
121	* Unsets data from the session store.
122	*
123	* @param string $name Name of variable.
124	* @param string $namespace Namespace to use.
125	*
126	* @return mixed The value from session or NULL if not set.
127	*
128	* @uses set()
129	*/
130	public function clear($name, $namespace = 'default')
131	{
132	return $this->set($name, null, $namespace);
133	}
134
135	/**
136	* Returns our internal nonce identifier.
137	*
138	* @param boolean $forceNew If true, the action will be randomly changed,
139	* instructing WP to use a different token.
140	*
141	* @return string The action name that will be used by WordPress to create
142	* a matching token hash.
143	*
144	* @since 10.1.33
145	*/
146	public static function getFormTokenAction($forceNew = false)
147	{
148	// create initial identifier
149	static $id = 1;
150
151	if ($forceNew)
152	{
153	// Refresh identifier when requested.
154	// Use a random ID to prevent predictability.
155	$id = uniqid();
156	}
157
158	// merge method name with our unique identifier
159	$action = __METHOD__ . '.' . $id;
160
161	/**
162	* Plugins can use this hook to change at runtime the action to
163	* use while creating/validating a WordPress nonce.
164	*
165	* @param string $action The action to filter.
166	*
167	* @since 10.1.33
168	*/
169	return apply_filters('vik_csrf_token_action', $action);
170	}
171
172	/**
173	* Returns the name that will be used while generating the token input
174	* and during its validation.
175	*
176	* @return string The input name.
177	*/
178	public static function getFormTokenName()
179	{
180	/**
181	* Plugins can use this hook to change at runtime the name to
182	* use while creating/validating a WordPress nonce.
183	*
184	* @param string $name The name to filter.
185	*
186	* @since 10.1.33
187	*/
188	return apply_filters('vik_csrf_token_name', 'vikwp_nonce');
189	}
190
191	/**
192	* Method to determine a hash for anti-spoofing variable names.
193	*
194	* @param boolean $forceNew If true, force a new token to be created.
195	*
196	* @return string Hashed var name.
197	*
198	* @uses getToken()
199	*/
200	public static function getFormToken($forceNew = false)
201	{
202	// create nonce by using our internal action
203	return wp_create_nonce(static::getFormTokenAction($forceNew));
204	}
205
206	/**
207	* Checks for a form token in the request.
208	* Use with JHtml::fetch('form.token') or Session::getFormToken().
209	*
210	* @param string $method The request method in which to look for the token key.
211	*
212	* @return boolean True if found and valid, false otherwise.
213	*/
214	public static function checkToken($method = 'post')
215	{
216	/**
217	* Plugins can use this hook to change the default behavior used to validate
218	* the CSRF tokens.
219	*
220	* @param boolean\|null $valid True whether the token is valid, false in case
221	* it is invalid, null to let the system uses its
222	* own validation.
223	*
224	* @since 10.1.33
225	*/
226	$validated = apply_filters('vik_csrf_token_check', null);
227
228	if (!is_null($validated))
229	{
230	// A plugin validated the token itself.
231	// Even if we cannot trust that validation, we have to return the status
232	// fetched by the attached plugins.
233	return (bool) $validated;
234	}
235
236	$action = static::getFormTokenAction();
237	$app = JFactory::getApplication();
238
239	// check from header first, since AJAX request might specify the
240	// X-CSRF-Token directive within the server headers
241	$nonce = $app->input->server->get('HTTP_X_CSRF_TOKEN', '', 'alnum');
242
243	if ($nonce && wp_verify_nonce($nonce, $action))
244	{
245	return true;
246	}
247
248	// get the name of the data set in request
249	$name = static::getFormTokenName();
250
251	// then fallback to HTTP query
252	$nonce = $app->input->$method->get($name, '', 'alnum');
253
254	if ($nonce && wp_verify_nonce($nonce, $action))
255	{
256	return true;
257	}
258
259	return false;
260	}
261	}
262