Merge branch 'QA_3_4'
[phpmyadmin-regexreplace.git] / libraries / session.inc.php
blob465e3f0332083afacc7b547e74dd98d6b59dfd18
1 <?php
2 /* vim: set expandtab sw=4 ts=4 sts=4: */
3 /**
4 * session handling
6 * @todo add failover or warn if sessions are not configured properly
7 * @todo add an option to use mm-module for session handler
8 * @see http://www.php.net/session
9 * @uses session_name()
10 * @uses session_start()
11 * @uses ini_set()
12 * @package phpMyAdmin
14 if (! defined('PHPMYADMIN')) {
15 exit;
18 // verify if PHP supports session, die if it does not
20 if (!@function_exists('session_name')) {
21 PMA_warnMissingExtension('session', true);
22 } elseif (ini_get('session.auto_start') == true && session_name() != 'phpMyAdmin') {
23 // Do not delete the existing session, it might be used by other
24 // applications; instead just close it.
25 session_write_close();
28 // disable starting of sessions before all settings are done
29 // does not work, besides how it is written in php manual
30 //ini_set('session.auto_start', 0);
32 // session cookie settings
33 session_set_cookie_params(0, $GLOBALS['PMA_Config']->getCookiePath(),
34 '', $GLOBALS['PMA_Config']->isHttps(), true);
36 // cookies are safer (use @ini_set() in case this function is disabled)
37 @ini_set('session.use_cookies', true);
39 // optionally set session_save_path
40 $path = $GLOBALS['PMA_Config']->get('SessionSavePath');
41 if (!empty($path)) {
42 session_save_path($path);
45 // but not all user allow cookies
46 @ini_set('session.use_only_cookies', false);
47 @ini_set('session.use_trans_sid', true);
48 @ini_set('url_rewriter.tags',
49 'a=href,frame=src,input=src,form=fakeentry,fieldset=');
50 //ini_set('arg_separator.output', '&amp;');
52 // delete session/cookies when browser is closed
53 @ini_set('session.cookie_lifetime', 0);
55 // warn but dont work with bug
56 @ini_set('session.bug_compat_42', false);
57 @ini_set('session.bug_compat_warn', true);
59 // use more secure session ids
60 @ini_set('session.hash_function', 1);
62 // some pages (e.g. stylesheet) may be cached on clients, but not in shared
63 // proxy servers
64 session_cache_limiter('private');
66 // start the session
67 // on some servers (for example, sourceforge.net), we get a permission error
68 // on the session data directory, so I add some "@"
70 // See bug #1538132. This would block normal behavior on a cluster
71 //ini_set('session.save_handler', 'files');
73 $session_name = 'phpMyAdmin';
74 @session_name($session_name);
76 if (! isset($_COOKIE[$session_name])) {
77 // on first start of session we check for errors
78 // f.e. session dir cannot be accessed - session file not created
79 $orig_error_count = $GLOBALS['error_handler']->countErrors();
80 $r = session_start();
81 if ($r !== true || $orig_error_count != $GLOBALS['error_handler']->countErrors()) {
82 setcookie($session_name, '', 1);
84 * Session initialization is done before selecting language, so we
85 * can not use translations here.
87 PMA_fatalError('Cannot start session without errors, please check errors given in your PHP and/or webserver log file and configure your PHP installation properly.');
89 unset($orig_error_count);
90 } else {
91 session_start();
94 /**
95 * Token which is used for authenticating access queries.
96 * (we use "space PMA_token space" to prevent overwriting)
98 if (! isset($_SESSION[' PMA_token '])) {
99 $_SESSION[' PMA_token '] = md5(uniqid(rand(), true));
103 * tries to secure session from hijacking and fixation
104 * should be called before login and after successfull login
105 * (only required if sensitive information stored in session)
107 * @uses session_regenerate_id() to secure session from fixation
109 function PMA_secureSession()
111 // prevent session fixation and XSS
112 session_regenerate_id(true);
113 $_SESSION[' PMA_token '] = md5(uniqid(rand(), true));