SessionManagerService.php

Go to the documentation of this file.

<?php

namespace Elgg;

use Elgg\Cache\EntityCache;
use Elgg\Cache\SessionCache;
use Elgg\Exceptions\LoginException;
use Elgg\Exceptions\SecurityException;
use Elgg\I18n\Translator;

class SessionManagerService {

    protected $entity_cache;
    
    protected $events;
    
    protected $ignore_access = false;
    
    protected $logged_in_user;
    
    protected $persistent_login;
    
    protected $show_disabled_entities = false;
    
    protected $session;
    
    protected $session_cache;
    
    protected $translator;
    
    public function __construct(
        \ElggSession $session,
        EventsService $events,
        Translator $translator,
        PersistentLoginService $persistent_login,
        SessionCache $session_cache,
        EntityCache $entity_cache
        ) {
        $this->session = $session;
        $this->events = $events;
        $this->translator = $translator;
        $this->persistent_login = $persistent_login;
        $this->session_cache = $session_cache;
        $this->entity_cache = $entity_cache;
    }
    
    public function getIgnoreAccess(): bool {
        return $this->ignore_access;
    }
    
    public function setIgnoreAccess(bool $ignore = true): bool {
        $prev = $this->ignore_access;
        $this->ignore_access = $ignore;
        
        return $prev;
    }
    
    public function getDisabledEntityVisibility(): bool {
        return $this->show_disabled_entities;
    }
    
    public function setDisabledEntityVisibility(bool $show = true): bool {
        $prev = $this->show_disabled_entities;
        $this->show_disabled_entities = $show;
        
        return $prev;
    }
    
    public function setUserToken(\ElggUser $user = null): void {
        if (!$user instanceof \ElggUser) {
            $user = $this->getLoggedInUser();
        }
        
        if (!$user instanceof \ElggUser) {
            return;
        }
        
        $this->session->set('__user_token', $this->generateUserToken($user));
    }
    
    public function validateUserToken(\ElggUser $user): void {
        $session_token = $this->session->get('__user_token');
        $user_token = $this->generateUserToken($user);
        
        if ($session_token !== $user_token) {
            throw new SecurityException($this->translator->translate('session_expired'));
        }
    }
    
    protected function generateUserToken(\ElggUser $user): string {
        $hmac = _elgg_services()->hmac->getHmac([
            $user->time_created,
            $user->guid,
        ], 'sha256', $user->password_hash);

        return $hmac->getToken();
    }
    
    public function login(\ElggUser $user, bool $persistent = false): void {
        if ($user->isBanned()) {
            throw new LoginException($this->translator->translate('LoginException:BannedUser'));
        }

        // give plugins a chance to reject the login of this user (no user in session!)
        if (!$this->events->triggerBefore('login', 'user', $user)) {
            throw new LoginException($this->translator->translate('LoginException:Unknown'));
        }
        
        if (!$user->isEnabled()) {
            // fallback if no plugin provided a reason
            throw new LoginException($this->translator->translate('LoginException:DisabledUser'));
        }
        
        // #5933: set logged in user early so code in login event will be able to
        // use elgg_get_logged_in_user_entity().
        $this->setLoggedInUser($user);
        $this->setUserToken($user);
        
        // re-register at least the core language file for users with language other than site default
        $this->translator->registerTranslations(\Elgg\Project\Paths::elgg() . 'languages/');
        
        // if remember me checked, set cookie with token and store hash(token) for user
        if ($persistent) {
            $this->persistent_login->makeLoginPersistent($user);
        }
        
        // User's privilege has been elevated, so change the session id (prevents session fixation)
        $this->session->migrate();
        
        // check before updating last login to determine first login
        $first_login = empty($user->last_login);
        
        $user->setLastLogin();
        _elgg_services()->accounts->resetAuthenticationFailures($user); // can't inject DI service because of circular reference
        
        $this->events->triggerAfter('login', 'user', $user);
        
        if ($first_login) {
            $this->events->trigger('login:first', 'user', $user);
            $user->first_login = time();
        }
    }
    
    public function logout(): bool {
        $user = $this->getLoggedInUser();
        if (!$user instanceof \ElggUser) {
            return false;
        }

        if (!$this->events->triggerBefore('logout', 'user', $user)) {
            return false;
        }
        
        $this->persistent_login->removePersistentLogin();
        
        // pass along any messages into new session
        $old_msg = $this->session->get(SystemMessagesService::SESSION_KEY, []);
        $this->session->invalidate();
        
        $this->logged_in_user = null;
        
        $this->session->set(SystemMessagesService::SESSION_KEY, $old_msg);
        
        $this->events->triggerAfter('logout', 'user', $user);
        
        return true;
    }
    
    public function setLoggedInUser(\ElggUser $user): void {
        $current_user = $this->getLoggedInUser();
        if ($current_user != $user) {
            $this->session->set('guid', $user->guid);
            $this->logged_in_user = $user;
            $this->session_cache->clear();
            $this->entity_cache->save($user);
            $this->translator->setCurrentLanguage($user->language);
        }
    }
    
    public function getLoggedInUser(): ?\ElggUser {
        return $this->logged_in_user;
    }
    
    public function getLoggedInUserGuid(): int {
        $user = $this->getLoggedInUser();
        return $user ? $user->guid : 0;
    }
    
    public function isAdminLoggedIn(): bool {
        $user = $this->getLoggedInUser();
        
        return $user && $user->isAdmin();
    }
    
    public function isLoggedIn(): bool {
        return (bool) $this->getLoggedInUser();
    }
    
    public function removeLoggedInUser(): void {
        $this->logged_in_user = null;
        $this->session->remove('guid');
        $this->session_cache->clear();
    }
}