application/security/SessionManager.php

   1 <?php
   2 namespace Shaarli\Security;
   3
   4 use Shaarli\Config\ConfigManager;
   5
   6 /**
   7  * Manages the server-side session
   8  */
   9 class SessionManager
  10 {
  11     /** @var int Session expiration timeout, in seconds */
  12     public static $SHORT_TIMEOUT = 3600;    // 1 hour
  13
  14     /** @var int Session expiration timeout, in seconds */
  15     public static $LONG_TIMEOUT = 31536000; // 1 year
  16
  17     /** @var array Local reference to the global $_SESSION array */
  18     protected $session = [];
  19
  20     /** @var ConfigManager Configuration Manager instance **/
  21     protected $conf = null;
  22
  23     /** @var bool Whether the user should stay signed in (LONG_TIMEOUT) */
  24     protected $staySignedIn = false;
  25
  26     /**
  27      * Constructor
  28      *
  29      * @param array         $session The $_SESSION array (reference)
  30      * @param ConfigManager $conf    ConfigManager instance
  31      */
  32     public function __construct(& $session, $conf)
  33     {
  34         $this->session = &$session;
  35         $this->conf = $conf;
  36     }
  37
  38     /**
  39      * Define whether the user should stay signed in across browser sessions
  40      *
  41      * @param bool $staySignedIn Keep the user signed in
  42      */
  43     public function setStaySignedIn($staySignedIn)
  44     {
  45         $this->staySignedIn = $staySignedIn;
  46     }
  47
  48     /**
  49      * Generates a session token
  50      *
  51      * @return string token
  52      */
  53     public function generateToken()
  54     {
  55         $token = sha1(uniqid('', true) .'_'. mt_rand() . $this->conf->get('credentials.salt'));
  56         $this->session['tokens'][$token] = 1;
  57         return $token;
  58     }
  59
  60     /**
  61      * Checks the validity of a session token, and destroys it afterwards
  62      *
  63      * @param string $token The token to check
  64      *
  65      * @return bool true if the token is valid, else false
  66      */
  67     public function checkToken($token)
  68     {
  69         if (! isset($this->session['tokens'][$token])) {
  70             // the token is wrong, or has already been used
  71             return false;
  72         }
  73
  74         // destroy the token to prevent future use
  75         unset($this->session['tokens'][$token]);
  76         return true;
  77     }
  78
  79     /**
  80      * Validate session ID to prevent Full Path Disclosure.
  81      *
  82      * See #298.
  83      * The session ID's format depends on the hash algorithm set in PHP settings
  84      *
  85      * @param string $sessionId Session ID
  86      *
  87      * @return true if valid, false otherwise.
  88      *
  89      * @see http://php.net/manual/en/function.hash-algos.php
  90      * @see http://php.net/manual/en/session.configuration.php
  91      */
  92     public static function checkId($sessionId)
  93     {
  94         if (empty($sessionId)) {
  95             return false;
  96         }
  97
  98         if (!$sessionId) {
  99             return false;
 100         }
 101
 102         if (!preg_match('/^[a-zA-Z0-9,-]{2,128}$/', $sessionId)) {
 103             return false;
 104         }
 105
 106         return true;
 107     }
 108
 109     /**
 110      * Store user login information after a successful login
 111      *
 112      * @param string $clientIpId Client IP address identifier
 113      */
 114     public function storeLoginInfo($clientIpId)
 115     {
 116         // Generate unique random number (different than phpsessionid)
 117         $this->session['uid'] = sha1(uniqid('', true) . '_' . mt_rand());
 118         $this->session['ip'] = $clientIpId;
 119         $this->session['username'] = $this->conf->get('credentials.login');
 120         $this->extendTimeValidityBy(self::$SHORT_TIMEOUT);
 121     }
 122
 123     /**
 124      * Extend session validity
 125      */
 126     public function extendSession()
 127     {
 128         if ($this->staySignedIn) {
 129             return $this->extendTimeValidityBy(self::$LONG_TIMEOUT);
 130         }
 131         return $this->extendTimeValidityBy(self::$SHORT_TIMEOUT);
 132     }
 133
 134     /**
 135      * Extend expiration time
 136      *
 137      * @param int $duration Expiration time extension (seconds)
 138      *
 139      * @return int New session expiration time
 140      */
 141     protected function extendTimeValidityBy($duration)
 142     {
 143         $expirationTime = time() + $duration;
 144         $this->session['expires_on'] = $expirationTime;
 145         return $expirationTime;
 146     }
 147
 148     /**
 149      * Logout a user by unsetting all login information
 150      *
 151      * See:
 152      * - https://secure.php.net/manual/en/function.setcookie.php
 153      */
 154     public function logout()
 155     {
 156         if (isset($this->session)) {
 157             unset($this->session['uid']);
 158             unset($this->session['ip']);
 159             unset($this->session['expires_on']);
 160             unset($this->session['username']);
 161             unset($this->session['visibility']);
 162             unset($this->session['untaggedonly']);
 163         }
 164     }
 165
 166     /**
 167      * Check whether the session has expired
 168      *
 169      * @param string $clientIpId Client IP address identifier
 170      *
 171      * @return bool true if the session has expired, false otherwise
 172      */
 173     public function hasSessionExpired()
 174     {
 175         if (empty($this->session['uid'])) {
 176             return true;
 177         }
 178         if (time() >= $this->session['expires_on']) {
 179             return true;
 180         }
 181         return false;
 182     }
 183
 184     /**
 185      * Check whether the client IP address has changed
 186      *
 187      * @param string $clientIpId Client IP address identifier
 188      *
 189      * @return bool true if the IP has changed, false if it has not, or
 190      *              if session protection has been disabled
 191      */
 192     public function hasClientIpChanged($clientIpId)
 193     {
 194         if ($this->conf->get('security.session_protection_disabled') === true) {
 195             return false;
 196         }
 197         if ($this->session['ip'] == $clientIpId) {
 198             return false;
 199         }
 200         return true;
 201     }
 202 }