class-wc-session-handler.php — WooCommerce 3.0.3

woocommerce / includes / class-wc-session-handler.php

woocommerce / includes Last commit date

class-wc-session-handler.php

311 lines

1	<?php
2	if ( ! defined( 'ABSPATH' ) ) {
3	exit;
4	}
5
6	/**
7	* Handle data for the current customers session.
8	* Implements the WC_Session abstract class.
9	*
10	* From 2.5 this uses a custom table for session storage. Based on https://github.com/kloon/woocommerce-large-sessions.
11	*
12	* @class WC_Session_Handler
13	* @version 2.5.0
14	* @package WooCommerce/Classes
15	* @category Class
16	* @author WooThemes
17	*/
18	class WC_Session_Handler extends WC_Session {
19
20	/** @var string cookie name */
21	private $_cookie;
22
23	/** @var string session due to expire timestamp */
24	private $_session_expiring;
25
26	/** @var string session expiration timestamp */
27	private $_session_expiration;
28
29	/ $var bool Bool based on whether a cookie exists /
30	private $_has_cookie = false;
31
32	/** @var string Custom session table name */
33	private $_table;
34
35	/**
36	* Constructor for the session class.
37	*/
38	public function __construct() {
39	global $wpdb;
40
41	$this->_cookie = 'wp_woocommerce_session_' . COOKIEHASH;
42	$this->_table = $wpdb->prefix . 'woocommerce_sessions';
43
44	if ( $cookie = $this->get_session_cookie() ) {
45	$this->_customer_id = $cookie[0];
46	$this->_session_expiration = $cookie[1];
47	$this->_session_expiring = $cookie[2];
48	$this->_has_cookie = true;
49
50	// Update session if its close to expiring
51	if ( time() > $this->_session_expiring ) {
52	$this->set_session_expiration();
53	$this->update_session_timestamp( $this->_customer_id, $this->_session_expiration );
54	}
55	} else {
56	$this->set_session_expiration();
57	$this->_customer_id = $this->generate_customer_id();
58	}
59
60	$this->_data = $this->get_session_data();
61
62	// Actions
63	add_action( 'woocommerce_set_cart_cookies', array( $this, 'set_customer_session_cookie' ), 10 );
64	add_action( 'woocommerce_cleanup_sessions', array( $this, 'cleanup_sessions' ), 10 );
65	add_action( 'shutdown', array( $this, 'save_data' ), 20 );
66	add_action( 'wp_logout', array( $this, 'destroy_session' ) );
67	if ( ! is_user_logged_in() ) {
68	add_filter( 'nonce_user_logged_out', array( $this, 'nonce_user_logged_out' ) );
69	}
70	}
71
72	/**
73	* Sets the session cookie on-demand (usually after adding an item to the cart).
74	*
75	* Since the cookie name (as of 2.1) is prepended with wp, cache systems like batcache will not cache pages when set.
76	*
77	* Warning: Cookies will only be set if this is called before the headers are sent.
78	*/
79	public function set_customer_session_cookie( $set ) {
80	if ( $set ) {
81	// Set/renew our cookie
82	$to_hash = $this->_customer_id . '\|' . $this->_session_expiration;
83	$cookie_hash = hash_hmac( 'md5', $to_hash, wp_hash( $to_hash ) );
84	$cookie_value = $this->_customer_id . '\|\|' . $this->_session_expiration . '\|\|' . $this->_session_expiring . '\|\|' . $cookie_hash;
85	$this->_has_cookie = true;
86
87	// Set the cookie
88	wc_setcookie( $this->_cookie, $cookie_value, $this->_session_expiration, apply_filters( 'wc_session_use_secure_cookie', false ) );
89	}
90	}
91
92	/**
93	* Return true if the current user has an active session, i.e. a cookie to retrieve values.
94	*
95	* @return bool
96	*/
97	public function has_session() {
98	return isset( $_COOKIE[ $this->_cookie ] ) \|\| $this->_has_cookie \|\| is_user_logged_in();
99	}
100
101	/**
102	* Set session expiration.
103	*/
104	public function set_session_expiration() {
105	$this->_session_expiring = time() + intval( apply_filters( 'wc_session_expiring', 60 * 60 * 47 ) ); // 47 Hours.
106	$this->_session_expiration = time() + intval( apply_filters( 'wc_session_expiration', 60 * 60 * 48 ) ); // 48 Hours.
107	}
108
109	/**
110	* Generate a unique customer ID for guests, or return user ID if logged in.
111	*
112	* Uses Portable PHP password hashing framework to generate a unique cryptographically strong ID.
113	*
114	* @return int\|string
115	*/
116	public function generate_customer_id() {
117	if ( is_user_logged_in() ) {
118	return get_current_user_id();
119	} else {
120	require_once( ABSPATH . 'wp-includes/class-phpass.php' );
121	$hasher = new PasswordHash( 8, false );
122	return md5( $hasher->get_random_bytes( 32 ) );
123	}
124	}
125
126	/**
127	* Get session cookie.
128	*
129	* @return bool\|array
130	*/
131	public function get_session_cookie() {
132	if ( empty( $_COOKIE[ $this->_cookie ] ) \|\| ! is_string( $_COOKIE[ $this->_cookie ] ) ) {
133	return false;
134	}
135
136	list( $customer_id, $session_expiration, $session_expiring, $cookie_hash ) = explode( '\|\|', $_COOKIE[ $this->_cookie ] );
137
138	// Validate hash
139	$to_hash = $customer_id . '\|' . $session_expiration;
140	$hash = hash_hmac( 'md5', $to_hash, wp_hash( $to_hash ) );
141
142	if ( empty( $cookie_hash ) \|\| ! hash_equals( $hash, $cookie_hash ) ) {
143	return false;
144	}
145
146	return array( $customer_id, $session_expiration, $session_expiring, $cookie_hash );
147	}
148
149	/**
150	* Get session data.
151	*
152	* @return array
153	*/
154	public function get_session_data() {
155	return $this->has_session() ? (array) $this->get_session( $this->_customer_id, array() ) : array();
156	}
157
158	/**
159	* Gets a cache prefix. This is used in session names so the entire cache can be invalidated with 1 function call.
160	*
161	* @return string
162	*/
163	private function get_cache_prefix() {
164	return WC_Cache_Helper::get_cache_prefix( WC_SESSION_CACHE_GROUP );
165	}
166
167	/**
168	* Save data.
169	*/
170	public function save_data() {
171	// Dirty if something changed - prevents saving nothing new
172	if ( $this->_dirty && $this->has_session() ) {
173	global $wpdb;
174
175	$wpdb->replace(
176	$this->_table,
177	array(
178	'session_key' => $this->_customer_id,
179	'session_value' => maybe_serialize( $this->_data ),
180	'session_expiry' => $this->_session_expiration,
181	),
182	array(
183	'%s',
184	'%s',
185	'%d',
186	)
187	);
188
189	// Set cache
190	wp_cache_set( $this->get_cache_prefix() . $this->_customer_id, $this->_data, WC_SESSION_CACHE_GROUP, $this->_session_expiration - time() );
191
192	// Mark session clean after saving
193	$this->_dirty = false;
194	}
195	}
196
197	/**
198	* Destroy all session data.
199	*/
200	public function destroy_session() {
201	// Clear cookie
202	wc_setcookie( $this->_cookie, '', time() - YEAR_IN_SECONDS, apply_filters( 'wc_session_use_secure_cookie', false ) );
203
204	$this->delete_session( $this->_customer_id );
205
206	// Clear cart
207	wc_empty_cart();
208
209	// Clear data
210	$this->_data = array();
211	$this->_dirty = false;
212	$this->_customer_id = $this->generate_customer_id();
213	}
214
215	/**
216	* When a user is logged out, ensure they have a unique nonce by using the customer/session ID.
217	*
218	* @return string
219	*/
220	public function nonce_user_logged_out( $uid ) {
221	return $this->has_session() && $this->_customer_id ? $this->_customer_id : $uid;
222	}
223
224	/**
225	* Cleanup sessions.
226	*/
227	public function cleanup_sessions() {
228	global $wpdb;
229
230	if ( ! defined( 'WP_SETUP_CONFIG' ) && ! defined( 'WP_INSTALLING' ) ) {
231
232	// Delete expired sessions
233	$wpdb->query( $wpdb->prepare( "DELETE FROM $this->_table WHERE session_expiry < %d", time() ) );
234
235	// Invalidate cache
236	WC_Cache_Helper::incr_cache_prefix( WC_SESSION_CACHE_GROUP );
237	}
238	}
239
240	/**
241	* Returns the session.
242	*
243	* @param string $customer_id
244	* @param mixed $default
245	* @return string\|array
246	*/
247	public function get_session( $customer_id, $default = false ) {
248	global $wpdb;
249
250	if ( defined( 'WP_SETUP_CONFIG' ) ) {
251	return false;
252	}
253
254	// Try get it from the cache, it will return false if not present or if object cache not in use
255	$value = wp_cache_get( $this->get_cache_prefix() . $customer_id, WC_SESSION_CACHE_GROUP );
256
257	if ( false === $value ) {
258	$value = $wpdb->get_var( $wpdb->prepare( "SELECT session_value FROM $this->_table WHERE session_key = %s", $customer_id ) );
259
260	if ( is_null( $value ) ) {
261	$value = $default;
262	}
263
264	wp_cache_add( $this->get_cache_prefix() . $customer_id, $value, WC_SESSION_CACHE_GROUP, $this->_session_expiration - time() );
265	}
266
267	return maybe_unserialize( $value );
268	}
269
270	/**
271	* Delete the session from the cache and database.
272	*
273	* @param int $customer_id
274	*/
275	public function delete_session( $customer_id ) {
276	global $wpdb;
277
278	wp_cache_delete( $this->get_cache_prefix() . $customer_id, WC_SESSION_CACHE_GROUP );
279
280	$wpdb->delete(
281	$this->_table,
282	array(
283	'session_key' => $customer_id,
284	)
285	);
286	}
287
288	/**
289	* Update the session expiry timestamp.
290	*
291	* @param string $customer_id
292	* @param int $timestamp
293	*/
294	public function update_session_timestamp( $customer_id, $timestamp ) {
295	global $wpdb;
296
297	$wpdb->update(
298	$this->_table,
299	array(
300	'session_expiry' => $timestamp,
301	),
302	array(
303	'session_key' => $customer_id,
304	),
305	array(
306	'%d'
307	)
308	);
309	}
310	}
311