X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=inc%2FSession.class.php;fp=inc%2FSession.class.php;h=0000000000000000000000000000000000000000;hb=a4565e88edbc8e3bd092a475469769c86a4c350c;hp=eff924ccdb06dddf8c68bcfab1a15fc967bfc000;hpb=f6c9baab3efeec1d0efa151e276fc08d5b58f9e9;p=github%2Fwallabag%2Fwallabag.git

diff --git a/inc/Session.class.php b/inc/Session.class.php
deleted file mode 100644
index eff924cc..00000000
--- a/inc/Session.class.php
+++ /dev/null
@@ -1,136 +0,0 @@
-<?php
-/**
- * Session management class
- * http://www.developpez.net/forums/d51943/php/langage/sessions/
- * http://sebsauvage.net/wiki/doku.php?id=php:session
- * http://sebsauvage.net/wiki/doku.php?id=php:shaarli
- *
- * Features:
- * - Everything is stored on server-side (we do not trust client-side data,
- *   such as cookie expiration)
- * - IP addresses + user agent are checked on each access to prevent session
- *   cookie hijacking (such as Firesheep)
- * - Session expires on user inactivity (Session expiration date is
- *   automatically updated everytime the user accesses a page.)
- * - A unique secret key is generated on server-side for this session
- *   (and never sent over the wire) which can be used
- *   to sign forms (HMAC) (See $_SESSION['uid'] )
- * - Token management to prevent XSRF attacks.
- *
- * TODO:
- * - log login fail
- * - prevent brute force (ban IP)
- *
- * HOWTOUSE:
- * - Just call Session::init(); to initialize session and
- *   check if connected with Session::isLogged()
- */
-
-class Session
-{
-    // If the user does not access any page within this time,
-    // his/her session is considered expired (in seconds).
-    public static $inactivity_timeout = 3600;
-    private static $_instance;
-
-    // constructor
-    private function __construct()
-    {
-        // Use cookies to store session.
-        ini_set('session.use_cookies', 1);
-        // Force cookies for session  (phpsessionID forbidden in URL)
-        ini_set('session.use_only_cookies', 1);
-        if (!session_id()){
-            // Prevent php to use sessionID in URL if cookies are disabled.
-            ini_set('session.use_trans_sid', false);
-            session_start('poche');
-        }
-    }
-
-    // initialize session
-    public static function init()
-    {
-        if (!isset(self::$_instance)) {
-            self::$_instance = new Session();
-        }
-    }
-
-    // Returns the IP address, user agent and language of the client
-    // (Used to prevent session cookie hijacking.)
-    private static function _allInfos()
-    {
-        $infos = $_SERVER["REMOTE_ADDR"];
-        if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
-            $infos.=$_SERVER['HTTP_X_FORWARDED_FOR'];
-        }
-        if (isset($_SERVER['HTTP_CLIENT_IP'])) {
-            $infos.='_'.$_SERVER['HTTP_CLIENT_IP'];
-        }
-        $infos.='_'.$_SERVER['HTTP_USER_AGENT'];
-        $infos.='_'.$_SERVER['HTTP_ACCEPT_LANGUAGE'];
-        return sha1($infos);
-    }
-
-    // Check that user/password is correct and init some SESSION variables.
-    public static function login($login,$password,$login_test,$password_test,
-                                 $pValues = array())
-    {
-        foreach ($pValues as $key => $value) {
-            $_SESSION[$key] = $value;
-        }
-        if ($login==$login_test && $password==$password_test){
-            // generate unique random number to sign forms (HMAC)
-            $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand());
-            $_SESSION['info']=Session::_allInfos();
-            $_SESSION['username']=$login;
-            // Set session expiration.
-            $_SESSION['expires_on']=time()+Session::$inactivity_timeout;
-            return true;
-        }
-        return false;
-    }
-
-    // Force logout
-    public static function logout()
-    {
-        unset($_SESSION['uid'],$_SESSION['info'],$_SESSION['expires_on'],$_SESSION['tokens'], $_SESSION['login'], $_SESSION['pass']);
-    }
-
-    // Make sure user is logged in.
-    public static function isLogged()
-    {
-        if (!isset ($_SESSION['uid'])
-            || $_SESSION['info']!=Session::_allInfos()
-            || time()>=$_SESSION['expires_on']){
-            Session::logout();
-            return false;
-        }
-        // User accessed a page : Update his/her session expiration date.
-        $_SESSION['expires_on']=time()+Session::$inactivity_timeout;
-        return true;
-    }
-
-    // Returns a token.
-    public static function getToken()
-    {
-        if (!isset($_SESSION['tokens'])){
-            $_SESSION['tokens']=array();
-        }
-        // We generate a random string and store it on the server side.
-        $rnd = sha1(uniqid('',true).'_'.mt_rand());
-        $_SESSION['tokens'][$rnd]=1;
-        return $rnd;
-    }
-
-    // Tells if a token is ok. Using this function will destroy the token.
-    // return true if token is ok.
-    public static function isToken($token)
-    {
-        if (isset($_SESSION['tokens'][$token]))
-        {
-            unset($_SESSION['tokens'][$token]); // Token is used: destroy it.
-            return true; // Token is ok.
-        }
-        return false; // Wrong token, or already used.
-    }
-}
\ No newline at end of file