1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
<?php
/*
Copyright (c) 2009-2014 F3::Factory/Bong Cosca, All rights reserved.
This file is part of the Fat-Free Framework (http://fatfree.sf.net).
THE SOFTWARE AND DOCUMENTATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR
PURPOSE.
Please see the license.txt file for more information.
*/
namespace DB\Mongo;
//! MongoDB-managed session handler
class Session extends Mapper {
protected
//! Session ID
$sid;
/**
* Open session
* @return TRUE
* @param $path string
* @param $name string
**/
function open($path,$name) {
return TRUE;
}
/**
* Close session
* @return TRUE
**/
function close() {
return TRUE;
}
/**
* Return session data in serialized format
* @return string|FALSE
* @param $id string
**/
function read($id) {
if ($id!=$this->sid)
$this->load(array('session_id'=>$this->sid=$id));
return $this->dry()?FALSE:$this->get('data');
}
/**
* Write session data
* @return TRUE
* @param $id string
* @param $data string
**/
function write($id,$data) {
$fw=\Base::instance();
$sent=headers_sent();
$headers=$fw->get('HEADERS');
if ($id!=$this->sid)
$this->load(array('session_id'=>$this->sid=$id));
$csrf=$fw->hash($fw->get('ROOT').$fw->get('BASE')).'.'.
$fw->hash(mt_rand());
$this->set('session_id',$id);
$this->set('data',$data);
$this->set('csrf',$sent?$this->csrf():$csrf);
$this->set('ip',$fw->get('IP'));
$this->set('agent',
isset($headers['User-Agent'])?$headers['User-Agent']:'');
$this->set('stamp',time());
$this->save();
if (!$sent) {
if (isset($_COOKIE['_']))
setcookie('_','',strtotime('-1 year'));
call_user_func_array('setcookie',
array('_',$csrf)+$fw->get('JAR'));
}
return TRUE;
}
/**
* Destroy session
* @return TRUE
* @param $id string
**/
function destroy($id) {
$this->erase(array('session_id'=>$id));
setcookie(session_name(),'',strtotime('-1 year'));
unset($_COOKIE[session_name()]);
header_remove('Set-Cookie');
return TRUE;
}
/**
* Garbage collector
* @return TRUE
* @param $max int
**/
function cleanup($max) {
$this->erase(array('$where'=>'this.stamp+'.$max.'<'.time()));
return TRUE;
}
/**
* Return anti-CSRF token
* @return string|FALSE
**/
function csrf() {
return $this->dry()?FALSE:$this->get('csrf');
}
/**
* Return IP address
* @return string|FALSE
**/
function ip() {
return $this->dry()?FALSE:$this->get('ip');
}
/**
* Return Unix timestamp
* @return string|FALSE
**/
function stamp() {
return $this->dry()?FALSE:$this->get('stamp');
}
/**
* Return HTTP user agent
* @return string|FALSE
**/
function agent() {
return $this->dry()?FALSE:$this->get('agent');
}
/**
* Instantiate class
* @param $db object
* @param $table string
**/
function __construct(\DB\Mongo $db,$table='sessions') {
parent::__construct($db,$table);
session_set_save_handler(
array($this,'open'),
array($this,'close'),
array($this,'read'),
array($this,'write'),
array($this,'destroy'),
array($this,'cleanup')
);
register_shutdown_function('session_commit');
@session_start();
$fw=\Base::instance();
$headers=$fw->get('HEADERS');
if (($ip=$this->ip()) && $ip!=$fw->get('IP') ||
($agent=$this->agent()) &&
(!isset($headers['User-Agent']) ||
$agent!=$headers['User-Agent'])) {
session_destroy();
$fw->error(403);
}
$csrf=$fw->hash($fw->get('ROOT').$fw->get('BASE')).'.'.
$fw->hash(mt_rand());
if ($this->load(array('session_id'=>$this->sid=session_id()))) {
$this->set('csrf',$csrf);
$this->save();
}
}
}
|
