ElggSession.php

Go to the documentation of this file.

<?php
 
use Elgg\Config;
use Elgg\Database;
use Elgg\Database\SessionHandler as ElggSessionHandler;
use Elgg\Exceptions\SecurityException;
use Elgg\Traits\Debug\Profilable;
use Symfony\Component\HttpFoundation\Session\Session;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
use Symfony\Component\HttpFoundation\Session\Storage\NativeSessionStorage;
 
class ElggSession {
    
    use Profilable;
 
    protected $storage;
 
    public function __construct(SessionInterface $storage) {
        $this->storage = $storage;
    }
    
    public function boot(): void {
        $this->beginTimer([__METHOD__]);
    
        $this->start();
    
        $migrate_session = false;
 
        // test whether we have a user session
        if ($this->has('guid')) {
            $user = _elgg_services()->entityTable->get($this->get('guid'), 'user');
            if (!$user instanceof \ElggUser) {
                // OMG user has been deleted.
                $this->invalidate();
                
                // redirect to homepage
                $this->endTimer([__METHOD__]);
                _elgg_services()->responseFactory->redirect('');
            }
        } else {
            $user = _elgg_services()->persistentLogin->bootSession();
            if ($user instanceof \ElggUser) {
                _elgg_services()->persistentLogin->updateTokenUsage($user);
                $migrate_session = true;
            }
        }
    
        if ($user instanceof \ElggUser) {
            _elgg_services()->session_manager->setLoggedInUser($user, $migrate_session);
            $user->setLastAction();
    
            // logout a user with open session who has been banned
            if ($user->isBanned()) {
                _elgg_services()->session_manager->logout();
            }
            
            // make sure the user hasn't changed in between requests
            // e.g. password reset
            try {
                _elgg_services()->session_manager->validateUserToken($user);
            } catch (SecurityException $e) {
                elgg_register_error_message($e->getMessage());
                _elgg_services()->session_manager->logout();
            }
        }
    
        $this->endTimer([__METHOD__]);
    }
 
    public function start() {
        
        if ($this->storage->getId()) {
            return true;
        }
 
        $result = $this->storage->start();
        $this->generateSessionToken();
        return $result;
    }
 
    public function migrate(bool $destroy = true) {
        return $this->storage->migrate($destroy);
    }
 
    public function invalidate() {
        $this->storage->clear();
        $result = $this->migrate(true);
        $this->generateSessionToken();
        _elgg_services()->accessCache->clear();
        return $result;
    }
 
    public function save() {
        $this->storage->save();
    }
 
    public function isStarted() {
        return $this->storage->isStarted();
    }
 
    public function getID() {
        return $this->storage->getId();
    }
 
    public function setId($id) {
        $this->storage->setId($id);
    }
 
    public function getName() {
        return $this->storage->getName();
    }
 
    public function setName($name) {
        $this->storage->setName($name);
    }
 
    public function get($name, $default = null) {
        return $this->storage->get($name, $default);
    }
 
    public function set($name, $value) {
        $this->storage->set($name, $value);
    }
 
    public function remove($name) {
        return $this->storage->remove($name);
    }
 
    public function has($name) {
        return $this->storage->has($name);
    }
 
    protected function generateSessionToken() {
        // Generate a simple token that we store server side
        if (!$this->has('__elgg_session')) {
            $this->set('__elgg_session', _elgg_services()->crypto->getRandomString(22));
        }
    }
 
    public static function getMock() {
        $storage = new MockArraySessionStorage();
        $session = new Session($storage);
        return new self($session);
    }
 
    public static function fromDatabase(Config $config, Database $db) {
        $params = $config->getCookieConfig()['session'];
        $options = [
            // session.cache_limiter is unfortunately set to "" by the NativeSessionStorage
            // constructor, so we must capture and inject it directly.
            'cache_limiter' => session_cache_limiter(),
 
            'name' => $params['name'],
            'cookie_path' => $params['path'],
            'cookie_domain' => $params['domain'],
            'cookie_secure' => $params['secure'],
            'cookie_httponly' => $params['httponly'],
            'cookie_lifetime' => $params['lifetime'],
            'cookie_samesite' => $params['samesite'],
        ];
 
        $handler = new ElggSessionHandler($db);
        $storage = new NativeSessionStorage($options, $handler);
        $session = new Session($storage);
        return new self($session);
    }
 
    public static function fromFiles(Config $config) {
        $params = $config->getCookieConfig()['session'];
        $options = [
            // session.cache_limiter is unfortunately set to "" by the NativeSessionStorage
            // constructor, so we must capture and inject it directly.
            'cache_limiter' => session_cache_limiter(),
 
            'name' => $params['name'],
            'cookie_path' => $params['path'],
            'cookie_domain' => $params['domain'],
            'cookie_secure' => $params['secure'],
            'cookie_httponly' => $params['httponly'],
            'cookie_lifetime' => $params['lifetime'],
        ];
 
        $storage = new NativeSessionStorage($options);
        $session = new Session($storage);
        return new self($session);
    }
}