xref: /webtrees/app/Session.php (revision a60f9d1ccee601cdd2b331c7189262edc5e380f2) 
1<?php
2
3/**
4 * webtrees: online genealogy
5 * Copyright (C) 2019 webtrees development team
6 * This program is free software: you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, either version 3 of the License, or
9 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program. If not, see <http://www.gnu.org/licenses/>.
16 */
17
18declare(strict_types=1);
19
20namespace Fisharebest\Webtrees;
21
22use Illuminate\Support\Str;
23use Psr\Http\Message\ServerRequestInterface;
24
25use function array_map;
26use function explode;
27use function implode;
28use function parse_url;
29use function session_name;
30use function session_regenerate_id;
31use function session_register_shutdown;
32use function session_set_cookie_params;
33use function session_set_save_handler;
34use function session_start;
35use function session_status;
36use function session_write_close;
37
38use const PHP_SESSION_ACTIVE;
39use const PHP_URL_HOST;
40use const PHP_URL_PATH;
41use const PHP_URL_SCHEME;
42
43/**
44 * Session handling
45 */
46class Session
47{
48    private const SESSION_NAME = 'WT2_SESSION';
49
50    /**
51     * Start a session
52     *
53     * @param ServerRequestInterface $request
54     *
55     * @return void
56     */
57    public static function start(ServerRequestInterface $request): void
58    {
59        // Store sessions in the database
60        session_set_save_handler(new SessionDatabaseHandler($request));
61
62        $url    = $request->getAttribute('base_url');
63        $secure = parse_url($url, PHP_URL_SCHEME) === 'https';
64        $domain = parse_url($url, PHP_URL_HOST);
65        $path   = parse_url($url, PHP_URL_PATH) ?? '';
66
67        // Paths containing UTF-8 characters need special handling.
68        $path = implode('/', array_map('rawurlencode', explode('/', $path)));
69
70        session_name(self::SESSION_NAME);
71        session_register_shutdown();
72        session_set_cookie_params(0, $path . '/', $domain, $secure, true);
73        session_start();
74
75        // A new session? Prevent session fixation attacks by choosing a new session ID.
76        if (self::get('initiated') !== true) {
77            self::regenerate(true);
78            self::put('initiated', true);
79        }
80    }
81
82    /**
83     * Save/close the session.  This releases the session lock.
84     * Closing early can help concurrent connections.
85     */
86    public static function save(): void
87    {
88        if (session_status() === PHP_SESSION_ACTIVE) {
89            session_write_close();
90        }
91    }
92
93    /**
94     * Read a value from the session
95     *
96     * @param string $name
97     * @param mixed  $default
98     *
99     * @return mixed
100     */
101    public static function get(string $name, $default = null)
102    {
103        return $_SESSION[$name] ?? $default;
104    }
105
106    /**
107     * Read a value from the session and remove it.
108     *
109     * @param string $name
110     * @param mixed  $default
111     *
112     * @return mixed
113     */
114    public static function pull(string $name, $default = null)
115    {
116        $value = self::get($name, $default);
117        self::forget($name);
118
119        return $value;
120    }
121
122    /**
123     * After any change in authentication level, we should use a new session ID.
124     *
125     * @param bool $destroy
126     *
127     * @return void
128     */
129    public static function regenerate(bool $destroy = false): void
130    {
131        if ($destroy) {
132            self::clear();
133        }
134
135        if (session_status() === PHP_SESSION_ACTIVE) {
136            session_regenerate_id($destroy);
137        }
138    }
139
140    /**
141     * Remove all stored data from the session.
142     *
143     * @return void
144     */
145    public static function clear(): void
146    {
147        $_SESSION = [];
148    }
149
150    /**
151     * Write a value to the session
152     *
153     * @param string $name
154     * @param mixed  $value
155     *
156     * @return void
157     */
158    public static function put(string $name, $value): void
159    {
160        $_SESSION[$name] = $value;
161    }
162
163    /**
164     * Remove a value from the session
165     *
166     * @param string $name
167     *
168     * @return void
169     */
170    public static function forget(string $name): void
171    {
172        unset($_SESSION[$name]);
173    }
174
175    /**
176     * Cross-Site Request Forgery tokens - ensure that the user is submitting
177     * a form that was generated by the current session.
178     *
179     * @return string
180     */
181    public static function getCsrfToken(): string
182    {
183        if (!self::has('CSRF_TOKEN')) {
184            self::put('CSRF_TOKEN', Str::random(32));
185        }
186
187        return self::get('CSRF_TOKEN');
188    }
189
190    /**
191     * Does a session variable exist?
192     *
193     * @param string $name
194     *
195     * @return bool
196     */
197    public static function has(string $name): bool
198    {
199        return isset($_SESSION[$name]);
200    }
201}
202