SessionManager: Change behavior of getSessionById()
[mediawiki.git] / includes / session / PHPSessionHandler.php
blob44d14cd009ac037482985f83c3255142df516717
1 <?php
2 /**
3 * Session storage in object cache.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
20 * @file
21 * @ingroup Session
24 namespace MediaWiki\Session;
26 use Psr\Log\LoggerInterface;
27 use BagOStuff;
29 /**
30 * Adapter for PHP's session handling
31 * @todo Once we drop support for PHP < 5.4, use SessionHandlerInterface
32 * (should just be a matter of adding "implements SessionHandlerInterface" and
33 * changing the session_set_save_handler() call).
34 * @ingroup Session
35 * @since 1.27
37 class PHPSessionHandler {
38 /** @var PHPSessionHandler */
39 protected static $instance = null;
41 /** @var bool Whether PHP session handling is enabled */
42 protected $enable = false;
43 protected $warn = true;
45 /** @var SessionManager|null */
46 protected $manager;
48 /** @var BagOStuff|null */
49 protected $store;
51 /** @var LoggerInterface */
52 protected $logger;
54 /** @var array Track original session fields for later modification check */
55 protected $sessionFieldCache = array();
57 protected function __construct( SessionManager $manager ) {
58 $this->setEnableFlags(
59 \RequestContext::getMain()->getConfig()->get( 'PHPSessionHandling' )
61 $manager->setupPHPSessionHandler( $this );
64 /**
65 * Set $this->enable and $this->warn
67 * Separate just because there doesn't seem to be a good way to test it
68 * otherwise.
70 * @param string $PHPSessionHandling See $wgPHPSessionHandling
72 private function setEnableFlags( $PHPSessionHandling ) {
73 switch ( $PHPSessionHandling ) {
74 case 'enable':
75 $this->enable = true;
76 $this->warn = false;
77 break;
79 case 'warn':
80 $this->enable = true;
81 $this->warn = true;
82 break;
84 case 'disable':
85 $this->enable = false;
86 $this->warn = false;
87 break;
91 /**
92 * Test whether the handler is installed
93 * @return bool
95 public static function isInstalled() {
96 return (bool)self::$instance;
99 /**
100 * Test whether the handler is installed and enabled
101 * @return bool
103 public static function isEnabled() {
104 return self::$instance && self::$instance->enable;
108 * Install a session handler for the current web request
109 * @param SessionManager $manager
111 public static function install( SessionManager $manager ) {
112 if ( self::$instance ) {
113 $manager->setupPHPSessionHandler( self::$instance );
114 return;
117 self::$instance = new self( $manager );
119 // Close any auto-started session, before we replace it
120 session_write_close();
122 // Tell PHP not to mess with cookies itself
123 ini_set( 'session.use_cookies', 0 );
124 ini_set( 'session.use_trans_sid', 0 );
126 // Also set a sane serialization handler
127 \Wikimedia\PhpSessionSerializer::setSerializeHandler();
129 session_set_save_handler(
130 array( self::$instance, 'open' ),
131 array( self::$instance, 'close' ),
132 array( self::$instance, 'read' ),
133 array( self::$instance, 'write' ),
134 array( self::$instance, 'destroy' ),
135 array( self::$instance, 'gc' )
138 // It's necessary to register a shutdown function to call session_write_close(),
139 // because by the time the request shutdown function for the session module is
140 // called, other needed objects may have already been destroyed. Shutdown functions
141 // registered this way are called before object destruction.
142 register_shutdown_function( array( self::$instance, 'handleShutdown' ) );
146 * Set the manager, store, and logger
147 * @private Use self::install().
148 * @param SessionManager $manager
149 * @param BagOStuff $store
150 * @param LoggerInterface $store
152 public function setManager(
153 SessionManager $manager, BagOStuff $store, LoggerInterface $logger
155 if ( $this->manager !== $manager ) {
156 // Close any existing session before we change stores
157 if ( $this->manager ) {
158 session_write_close();
160 $this->manager = $manager;
161 $this->store = $store;
162 $this->logger = $logger;
163 \Wikimedia\PhpSessionSerializer::setLogger( $this->logger );
168 * Initialize the session (handler)
169 * @private For internal use only
170 * @param string $save_path Path used to store session files (ignored)
171 * @param string $session_name Session name (ignored)
172 * @return bool Success
174 public function open( $save_path, $session_name ) {
175 if ( self::$instance !== $this ) {
176 throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
178 if ( !$this->enable ) {
179 throw new \BadMethodCallException( 'Attempt to use PHP session management' );
181 return true;
185 * Close the session (handler)
186 * @private For internal use only
187 * @return bool Success
189 public function close() {
190 if ( self::$instance !== $this ) {
191 throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
193 $this->sessionFieldCache = array();
194 return true;
198 * Read session data
199 * @private For internal use only
200 * @param string $id Session id
201 * @return string Session data
203 public function read( $id ) {
204 if ( self::$instance !== $this ) {
205 throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
207 if ( !$this->enable ) {
208 throw new \BadMethodCallException( 'Attempt to use PHP session management' );
211 $session = $this->manager->getSessionById( $id, false );
212 if ( !$session ) {
213 return '';
215 $session->persist();
217 $data = iterator_to_array( $session );
218 $this->sessionFieldCache[$id] = $data;
219 return (string)\Wikimedia\PhpSessionSerializer::encode( $data );
223 * Write session data
224 * @private For internal use only
225 * @param string $id Session id
226 * @param string $dataStr Session data. Not that you should ever call this
227 * directly, but note that this has the same issues with code injection
228 * via user-controlled data as does PHP's unserialize function.
229 * @return bool Success
231 public function write( $id, $dataStr ) {
232 if ( self::$instance !== $this ) {
233 throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
235 if ( !$this->enable ) {
236 throw new \BadMethodCallException( 'Attempt to use PHP session management' );
239 $session = $this->manager->getSessionById( $id, true );
240 if ( !$session ) {
241 $this->logger->warning(
242 __METHOD__ . ": Session \"$id\" cannot be loaded, skipping write."
244 return false;
247 // First, decode the string PHP handed us
248 $data = \Wikimedia\PhpSessionSerializer::decode( $dataStr );
249 if ( $data === null ) {
250 // @codeCoverageIgnoreStart
251 return false;
252 // @codeCoverageIgnoreEnd
255 // Now merge the data into the Session object.
256 $changed = false;
257 $cache = isset( $this->sessionFieldCache[$id] ) ? $this->sessionFieldCache[$id] : array();
258 foreach ( $data as $key => $value ) {
259 if ( !isset( $cache[$key] ) ) {
260 if ( $session->exists( $key ) ) {
261 // New in both, so ignore and log
262 $this->logger->warning(
263 __METHOD__ . ": Key \"$key\" added in both Session and \$_SESSION!"
265 } else {
266 // New in $_SESSION, keep it
267 $session->set( $key, $value );
268 $changed = true;
270 } elseif ( $cache[$key] === $value ) {
271 // Unchanged in $_SESSION, so ignore it
272 } elseif ( !$session->exists( $key ) ) {
273 // Deleted in Session, keep but log
274 $this->logger->warning(
275 __METHOD__ . ": Key \"$key\" deleted in Session and changed in \$_SESSION!"
277 $session->set( $key, $value );
278 $changed = true;
279 } elseif ( $cache[$key] === $session->get( $key ) ) {
280 // Unchanged in Session, so keep it
281 $session->set( $key, $value );
282 $changed = true;
283 } else {
284 // Changed in both, so ignore and log
285 $this->logger->warning(
286 __METHOD__ . ": Key \"$key\" changed in both Session and \$_SESSION!"
290 // Anything deleted in $_SESSION and unchanged in Session should be deleted too
291 // (but not if $_SESSION can't represent it at all)
292 \Wikimedia\PhpSessionSerializer::setLogger( new \Psr\Log\NullLogger() );
293 foreach ( $cache as $key => $value ) {
294 if ( !isset( $data[$key] ) && $session->exists( $key ) &&
295 \Wikimedia\PhpSessionSerializer::encode( array( $key => true ) )
297 if ( $cache[$key] === $session->get( $key ) ) {
298 // Unchanged in Session, delete it
299 $session->remove( $key );
300 $changed = true;
301 } else {
302 // Changed in Session, ignore deletion and log
303 $this->logger->warning(
304 __METHOD__ . ": Key \"$key\" changed in Session and deleted in \$_SESSION!"
309 \Wikimedia\PhpSessionSerializer::setLogger( $this->logger );
311 // Save and update cache if anything changed
312 if ( $changed ) {
313 if ( $this->warn ) {
314 wfDeprecated( '$_SESSION', '1.27' );
315 $this->logger->warning( 'Something wrote to $_SESSION!' );
318 $session->save();
319 $this->sessionFieldCache[$id] = iterator_to_array( $session );
322 $session->persist();
324 return true;
328 * Destroy a session
329 * @private For internal use only
330 * @param string $id Session id
331 * @return bool Success
333 public function destroy( $id ) {
334 if ( self::$instance !== $this ) {
335 throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
337 if ( !$this->enable ) {
338 throw new \BadMethodCallException( 'Attempt to use PHP session management' );
340 $session = $this->manager->getSessionById( $id, false );
341 if ( $session ) {
342 $session->clear();
344 return true;
348 * Execute garbage collection.
349 * @private For internal use only
350 * @param int $maxlifetime Maximum session life time (ignored)
351 * @return bool Success
353 public function gc( $maxlifetime ) {
354 if ( self::$instance !== $this ) {
355 throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
357 $before = date( 'YmdHis', time() );
358 $this->store->deleteObjectsExpiringBefore( $before );
359 return true;
363 * Shutdown function.
365 * See the comment inside self::install for rationale.
366 * @codeCoverageIgnore
367 * @private For internal use only
369 public function handleShutdown() {
370 if ( $this->enable ) {
371 session_write_close();