NativeSessionStorage.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\HttpFoundation\Session\Storage;
  11. use Symfony\Component\Debug\Exception\ContextErrorException;
  12. use Symfony\Component\HttpFoundation\Session\SessionBagInterface;
  13. use Symfony\Component\HttpFoundation\Session\Storage\Handler\NativeSessionHandler;
  14. use Symfony\Component\HttpFoundation\Session\Storage\Proxy\AbstractProxy;
  15. use Symfony\Component\HttpFoundation\Session\Storage\Proxy\SessionHandlerProxy;
  16. /**
  17. * This provides a base class for session attribute storage.
  18. *
  19. * @author Drak <drak@zikula.org>
  20. */
  21. class NativeSessionStorage implements SessionStorageInterface
  22. {
  23. /**
  24. * Array of SessionBagInterface.
  25. *
  26. * @var SessionBagInterface[]
  27. */
  28. protected $bags;
  29. /**
  30. * @var bool
  31. */
  32. protected $started = false;
  33. /**
  34. * @var bool
  35. */
  36. protected $closed = false;
  37. /**
  38. * @var AbstractProxy
  39. */
  40. protected $saveHandler;
  41. /**
  42. * @var MetadataBag
  43. */
  44. protected $metadataBag;
  45. /**
  46. * Constructor.
  47. *
  48. * Depending on how you want the storage driver to behave you probably
  49. * want to override this constructor entirely.
  50. *
  51. * List of options for $options array with their defaults.
  52. *
  53. * @see http://php.net/session.configuration for options
  54. * but we omit 'session.' from the beginning of the keys for convenience.
  55. *
  56. * ("auto_start", is not supported as it tells PHP to start a session before
  57. * PHP starts to execute user-land code. Setting during runtime has no effect).
  58. *
  59. * cache_limiter, "" (use "0" to prevent headers from being sent entirely).
  60. * cookie_domain, ""
  61. * cookie_httponly, ""
  62. * cookie_lifetime, "0"
  63. * cookie_path, "/"
  64. * cookie_secure, ""
  65. * entropy_file, ""
  66. * entropy_length, "0"
  67. * gc_divisor, "100"
  68. * gc_maxlifetime, "1440"
  69. * gc_probability, "1"
  70. * hash_bits_per_character, "4"
  71. * hash_function, "0"
  72. * name, "PHPSESSID"
  73. * referer_check, ""
  74. * serialize_handler, "php"
  75. * use_strict_mode, "0"
  76. * use_cookies, "1"
  77. * use_only_cookies, "1"
  78. * use_trans_sid, "0"
  79. * upload_progress.enabled, "1"
  80. * upload_progress.cleanup, "1"
  81. * upload_progress.prefix, "upload_progress_"
  82. * upload_progress.name, "PHP_SESSION_UPLOAD_PROGRESS"
  83. * upload_progress.freq, "1%"
  84. * upload_progress.min-freq, "1"
  85. * url_rewriter.tags, "a=href,area=href,frame=src,form=,fieldset="
  86. * sid_length, "32"
  87. * sid_bits_per_character, "5"
  88. * trans_sid_hosts, $_SERVER['HTTP_HOST']
  89. * trans_sid_tags, "a=href,area=href,frame=src,form="
  90. *
  91. * @param array $options Session configuration options
  92. * @param AbstractProxy|NativeSessionHandler|\SessionHandlerInterface|null $handler
  93. * @param MetadataBag $metaBag MetadataBag
  94. */
  95. public function __construct(array $options = array(), $handler = null, MetadataBag $metaBag = null)
  96. {
  97. session_cache_limiter(''); // disable by default because it's managed by HeaderBag (if used)
  98. ini_set('session.use_cookies', 1);
  99. session_register_shutdown();
  100. $this->setMetadataBag($metaBag);
  101. $this->setOptions($options);
  102. $this->setSaveHandler($handler);
  103. }
  104. /**
  105. * Gets the save handler instance.
  106. *
  107. * @return AbstractProxy
  108. */
  109. public function getSaveHandler()
  110. {
  111. return $this->saveHandler;
  112. }
  113. /**
  114. * {@inheritdoc}
  115. */
  116. public function start()
  117. {
  118. if ($this->started) {
  119. return true;
  120. }
  121. if (\PHP_SESSION_ACTIVE === session_status()) {
  122. throw new \RuntimeException('Failed to start the session: already started by PHP.');
  123. }
  124. if (ini_get('session.use_cookies') && headers_sent($file, $line)) {
  125. throw new \RuntimeException(sprintf('Failed to start the session because headers have already been sent by "%s" at line %d.', $file, $line));
  126. }
  127. // ok to try and start the session
  128. if (!session_start()) {
  129. throw new \RuntimeException('Failed to start the session');
  130. }
  131. $this->loadSession();
  132. return true;
  133. }
  134. /**
  135. * {@inheritdoc}
  136. */
  137. public function getId()
  138. {
  139. return $this->saveHandler->getId();
  140. }
  141. /**
  142. * {@inheritdoc}
  143. */
  144. public function setId($id)
  145. {
  146. $this->saveHandler->setId($id);
  147. }
  148. /**
  149. * {@inheritdoc}
  150. */
  151. public function getName()
  152. {
  153. return $this->saveHandler->getName();
  154. }
  155. /**
  156. * {@inheritdoc}
  157. */
  158. public function setName($name)
  159. {
  160. $this->saveHandler->setName($name);
  161. }
  162. /**
  163. * {@inheritdoc}
  164. */
  165. public function regenerate($destroy = false, $lifetime = null)
  166. {
  167. // Cannot regenerate the session ID for non-active sessions.
  168. if (\PHP_SESSION_ACTIVE !== session_status()) {
  169. return false;
  170. }
  171. if (null !== $lifetime) {
  172. ini_set('session.cookie_lifetime', $lifetime);
  173. }
  174. if ($destroy) {
  175. $this->metadataBag->stampNew();
  176. }
  177. $isRegenerated = session_regenerate_id($destroy);
  178. // The reference to $_SESSION in session bags is lost in PHP7 and we need to re-create it.
  179. // @see https://bugs.php.net/bug.php?id=70013
  180. $this->loadSession();
  181. return $isRegenerated;
  182. }
  183. /**
  184. * {@inheritdoc}
  185. */
  186. public function save()
  187. {
  188. // Register custom error handler to catch a possible failure warning during session write
  189. set_error_handler(function ($errno, $errstr, $errfile, $errline, $errcontext) {
  190. throw new ContextErrorException($errstr, $errno, E_WARNING, $errfile, $errline, $errcontext);
  191. }, E_WARNING);
  192. try {
  193. session_write_close();
  194. restore_error_handler();
  195. } catch (ContextErrorException $e) {
  196. // The default PHP error message is not very helpful, as it does not give any information on the current save handler.
  197. // Therefore, we catch this error and trigger a warning with a better error message
  198. $handler = $this->getSaveHandler();
  199. if ($handler instanceof SessionHandlerProxy) {
  200. $handler = $handler->getHandler();
  201. }
  202. restore_error_handler();
  203. trigger_error(sprintf('session_write_close(): Failed to write session data with %s handler', get_class($handler)), E_USER_WARNING);
  204. }
  205. $this->closed = true;
  206. $this->started = false;
  207. }
  208. /**
  209. * {@inheritdoc}
  210. */
  211. public function clear()
  212. {
  213. // clear out the bags
  214. foreach ($this->bags as $bag) {
  215. $bag->clear();
  216. }
  217. // clear out the session
  218. $_SESSION = array();
  219. // reconnect the bags to the session
  220. $this->loadSession();
  221. }
  222. /**
  223. * {@inheritdoc}
  224. */
  225. public function registerBag(SessionBagInterface $bag)
  226. {
  227. if ($this->started) {
  228. throw new \LogicException('Cannot register a bag when the session is already started.');
  229. }
  230. $this->bags[$bag->getName()] = $bag;
  231. }
  232. /**
  233. * {@inheritdoc}
  234. */
  235. public function getBag($name)
  236. {
  237. if (!isset($this->bags[$name])) {
  238. throw new \InvalidArgumentException(sprintf('The SessionBagInterface %s is not registered.', $name));
  239. }
  240. if ($this->saveHandler->isActive() && !$this->started) {
  241. $this->loadSession();
  242. } elseif (!$this->started) {
  243. $this->start();
  244. }
  245. return $this->bags[$name];
  246. }
  247. /**
  248. * Sets the MetadataBag.
  249. *
  250. * @param MetadataBag $metaBag
  251. */
  252. public function setMetadataBag(MetadataBag $metaBag = null)
  253. {
  254. if (null === $metaBag) {
  255. $metaBag = new MetadataBag();
  256. }
  257. $this->metadataBag = $metaBag;
  258. }
  259. /**
  260. * Gets the MetadataBag.
  261. *
  262. * @return MetadataBag
  263. */
  264. public function getMetadataBag()
  265. {
  266. return $this->metadataBag;
  267. }
  268. /**
  269. * {@inheritdoc}
  270. */
  271. public function isStarted()
  272. {
  273. return $this->started;
  274. }
  275. /**
  276. * Sets session.* ini variables.
  277. *
  278. * For convenience we omit 'session.' from the beginning of the keys.
  279. * Explicitly ignores other ini keys.
  280. *
  281. * @param array $options Session ini directives array(key => value)
  282. *
  283. * @see http://php.net/session.configuration
  284. */
  285. public function setOptions(array $options)
  286. {
  287. $validOptions = array_flip(array(
  288. 'cache_limiter', 'cookie_domain', 'cookie_httponly',
  289. 'cookie_lifetime', 'cookie_path', 'cookie_secure',
  290. 'entropy_file', 'entropy_length', 'gc_divisor',
  291. 'gc_maxlifetime', 'gc_probability', 'hash_bits_per_character',
  292. 'hash_function', 'name', 'referer_check',
  293. 'serialize_handler', 'use_strict_mode', 'use_cookies',
  294. 'use_only_cookies', 'use_trans_sid', 'upload_progress.enabled',
  295. 'upload_progress.cleanup', 'upload_progress.prefix', 'upload_progress.name',
  296. 'upload_progress.freq', 'upload_progress.min-freq', 'url_rewriter.tags',
  297. 'sid_length', 'sid_bits_per_character', 'trans_sid_hosts', 'trans_sid_tags',
  298. ));
  299. foreach ($options as $key => $value) {
  300. if (isset($validOptions[$key])) {
  301. ini_set('session.'.$key, $value);
  302. }
  303. }
  304. }
  305. /**
  306. * Registers session save handler as a PHP session handler.
  307. *
  308. * To use internal PHP session save handlers, override this method using ini_set with
  309. * session.save_handler and session.save_path e.g.
  310. *
  311. * ini_set('session.save_handler', 'files');
  312. * ini_set('session.save_path', '/tmp');
  313. *
  314. * or pass in a NativeSessionHandler instance which configures session.save_handler in the
  315. * constructor, for a template see NativeFileSessionHandler or use handlers in
  316. * composer package drak/native-session
  317. *
  318. * @see http://php.net/session-set-save-handler
  319. * @see http://php.net/sessionhandlerinterface
  320. * @see http://php.net/sessionhandler
  321. * @see http://github.com/drak/NativeSession
  322. *
  323. * @param AbstractProxy|NativeSessionHandler|\SessionHandlerInterface|null $saveHandler
  324. *
  325. * @throws \InvalidArgumentException
  326. */
  327. public function setSaveHandler($saveHandler = null)
  328. {
  329. if (!$saveHandler instanceof AbstractProxy &&
  330. !$saveHandler instanceof NativeSessionHandler &&
  331. !$saveHandler instanceof \SessionHandlerInterface &&
  332. null !== $saveHandler) {
  333. throw new \InvalidArgumentException('Must be instance of AbstractProxy or NativeSessionHandler; implement \SessionHandlerInterface; or be null.');
  334. }
  335. // Wrap $saveHandler in proxy and prevent double wrapping of proxy
  336. if (!$saveHandler instanceof AbstractProxy && $saveHandler instanceof \SessionHandlerInterface) {
  337. $saveHandler = new SessionHandlerProxy($saveHandler);
  338. } elseif (!$saveHandler instanceof AbstractProxy) {
  339. $saveHandler = new SessionHandlerProxy(new \SessionHandler());
  340. }
  341. $this->saveHandler = $saveHandler;
  342. if ($this->saveHandler instanceof \SessionHandlerInterface) {
  343. session_set_save_handler($this->saveHandler, false);
  344. }
  345. }
  346. /**
  347. * Load the session with attributes.
  348. *
  349. * After starting the session, PHP retrieves the session from whatever handlers
  350. * are set to (either PHP's internal, or a custom save handler set with session_set_save_handler()).
  351. * PHP takes the return value from the read() handler, unserializes it
  352. * and populates $_SESSION with the result automatically.
  353. *
  354. * @param array|null $session
  355. */
  356. protected function loadSession(array &$session = null)
  357. {
  358. if (null === $session) {
  359. $session = &$_SESSION;
  360. }
  361. $bags = array_merge($this->bags, array($this->metadataBag));
  362. foreach ($bags as $bag) {
  363. $key = $bag->getStorageKey();
  364. $session[$key] = isset($session[$key]) ? $session[$key] : array();
  365. $bag->initialize($session[$key]);
  366. }
  367. $this->started = true;
  368. $this->closed = false;
  369. }
  370. }