phpldapadmin/lib/session_functions.php

166 lines
5.2 KiB
PHP
Raw Normal View History

2009-06-30 09:22:30 +00:00
<?php
2009-06-30 11:51:50 +00:00
// $Header: /cvsroot/phpldapadmin/phpldapadmin/lib/session_functions.php,v 1.18.2.4 2008/01/13 06:35:51 wurley Exp $
2009-06-30 09:22:30 +00:00
/**
* A collection of functions to handle sessions throughout phpLDAPadmin.
* @author The phpLDAPadmin development team
* @package phpLDAPadmin
*/
/** The session ID that phpLDAPadmin will use for all sessions */
2009-06-30 09:40:37 +00:00
define('PLA_SESSION_ID','PLASESSID');
2009-06-30 09:22:30 +00:00
/** Enables session paranoia, which causes SIDs to change each page load (EXPERIMENTAL!) */
define('pla_session_id_paranoid', false);
/** Flag to indicate whether the session has already been initialized (this constant gets stored in $_SESSION) */
define('pla_session_id_init', 'pla_initialized');
/** The minimum first char value IP in hex for IP hashing. */
define('pla_session_id_ip_min', 8);
/** The maximum first char value of the IP in hex for IP hashing. */
define('pla_session_id_ses_max', 36);
/**
* Creates a new session id, which includes an IP hash.
*
* @return string the new session ID string
*/
2009-06-30 09:29:51 +00:00
function pla_session_get_id() {
2009-06-30 09:40:37 +00:00
if (DEBUG_ENABLED)
2009-06-30 11:46:44 +00:00
debug_log('Entered with ()',1,__FILE__,__LINE__,__METHOD__);
2009-06-30 09:29:51 +00:00
2009-06-30 09:22:30 +00:00
$id_md5 = md5(rand(1,1000000));
$ip_md5 = md5($_SERVER['REMOTE_ADDR']);
$id_hex = hexdec($id_md5[0]) + 1;
$ip_hex = hexdec($ip_md5[0]);
if ($ip_hex <= pla_session_id_ip_min)
$ip_len = pla_session_id_ip_min;
else
$ip_len = $ip_hex - 1;
2009-06-30 09:29:51 +00:00
$new_id = substr($id_md5, 0, $id_hex) .
2009-06-30 09:22:30 +00:00
substr($ip_md5, $ip_hex, $ip_len) .
substr($id_md5, $id_hex, pla_session_id_ses_max - ($id_hex + $ip_len));
2009-06-30 09:29:51 +00:00
2009-06-30 09:22:30 +00:00
return $new_id;
}
/**
* Checks if the session belongs to an IP
*
* @return bool True, if the session is valid
*/
2009-06-30 09:29:51 +00:00
function pla_session_verify_id() {
2009-06-30 09:40:37 +00:00
if (DEBUG_ENABLED)
2009-06-30 11:46:44 +00:00
debug_log('Entered with ()',1,__FILE__,__LINE__,__METHOD__);
2009-06-30 09:29:51 +00:00
2009-06-30 09:22:30 +00:00
$check_id = session_id();
$ip_md5 = md5($_SERVER['REMOTE_ADDR']);
$id_hex = hexdec($check_id[0]) + 1;
$ip_hex = hexdec($ip_md5[0]);
if ($ip_hex <= pla_session_id_ip_min)
$ip_len = pla_session_id_ip_min;
else
$ip_len = $ip_hex - 1;
2009-06-30 09:29:51 +00:00
2009-06-30 09:22:30 +00:00
$ip_ses = substr($check_id, $id_hex, $ip_len);
$ip_ver = substr($ip_md5, $ip_hex, $ip_len);
return ($ip_ses == $ip_ver);
}
2009-06-30 10:46:00 +00:00
function pla_session_param() {
/* If cookies were disabled, build the url parameter for the session id.
2009-06-30 11:51:50 +00:00
* It will be append to the url to be redirect */
2009-06-30 10:46:00 +00:00
return (SID != '') ? sprintf('&%s=%s',session_name(),session_id()) : '';
}
2009-06-30 09:22:30 +00:00
/**
* The only function which should be called by a user
*
* @see common.php
* @see PLA_SESSION_ID
* @return bool Returns true if the session was started the first time
*/
2009-06-30 09:29:51 +00:00
function pla_session_start() {
2009-06-30 11:46:44 +00:00
global $config;
2009-06-30 10:46:00 +00:00
/* If session.auto_start is on in the server's PHP configuration (php.ini), then
* we will have problems loading our schema cache since the session will have started
* prior to loading the SchemaItem (and descedants) class. Destroy the auto-started
* session to prevent this problem.
*/
if (ini_get('session.auto_start'))
@session_destroy();
# Do we already have a session?
if (@session_id())
die;
@session_name(PLA_SESSION_ID);
@session_start();
# Do we have a valid session?
$is_initialized = is_array($_SESSION) && array_key_exists(pla_session_id_init,$_SESSION);
if (! $is_initialized) {
if (pla_session_id_paranoid) {
ini_set('session.use_trans_sid',0);
2009-06-30 09:22:30 +00:00
@session_destroy();
2009-06-30 10:46:00 +00:00
@session_id(pla_session_get_id());
2009-06-30 09:22:30 +00:00
@session_start();
2009-06-30 10:46:00 +00:00
ini_set('session.use_trans_sid',1);
2009-06-30 09:22:30 +00:00
}
2009-06-30 10:46:00 +00:00
$_SESSION[pla_session_id_init]['version'] = pla_version();
$_SESSION[pla_session_id_init]['config'] = filemtime(CONFDIR.'config.php');
2009-06-30 09:22:30 +00:00
}
2009-06-30 10:46:00 +00:00
@header('Cache-control: private'); // IE 6 Fix
2009-06-30 09:22:30 +00:00
2009-06-30 10:46:00 +00:00
if (pla_session_id_paranoid && ! pla_session_verify_id())
pla_error('Session inconsistent or session timeout');
2009-06-30 09:22:30 +00:00
2009-06-30 11:46:44 +00:00
# Check we have the correct version of the SESSION cache
if (isset($_SESSION['cache']) || isset($_SESSION[pla_session_id_init])) {
2009-06-30 11:51:50 +00:00
if (! is_array($_SESSION[pla_session_id_init])) $_SESSION[pla_session_id_init] = array();
2009-06-30 11:46:44 +00:00
2009-06-30 11:51:50 +00:00
if (! isset($_SESSION[pla_session_id_init]['version']) || ! isset($_SESSION[pla_session_id_init]['config'])
2009-06-30 11:46:44 +00:00
|| $_SESSION[pla_session_id_init]['version'] !== pla_version()
|| $_SESSION[pla_session_id_init]['config'] != filemtime(CONFDIR.'config.php')) {
2009-06-30 11:51:50 +00:00
2009-06-30 11:46:44 +00:00
$_SESSION[pla_session_id_init]['version'] = pla_version();
$_SESSION[pla_session_id_init]['config'] = filemtime(CONFDIR.'config.php');
unset($_SESSION['cache']);
unset($_SESSION[APPCONFIG]);
# Our configuration information has changed, so we'll redirect to index.php to get it reloaded again.
system_message(array(
'title'=>_('Configuration cache stale.'),
'body'=>_('Your configuration has been automatically refreshed.'),
'type'=>'info'));
$config_file = CONFDIR.'config.php';
check_config($config_file);
} else {
# Sanity check, specially when upgrading from a previous release.
if (isset($_SESSION['cache']))
foreach (array_keys($_SESSION['cache']) as $id)
if (isset($_SESSION['cache'][$id]['tree']['null']) && ! is_object($_SESSION['cache'][$id]['tree']['null']))
unset($_SESSION['cache'][$id]);
}
}
# If we came via index.php, then set our $config.
if (! isset($_SESSION[APPCONFIG]) && isset($config))
$_SESSION[APPCONFIG] = $config;
2009-06-30 09:22:30 +00:00
}
/**
* Stops the current session.
*/
2009-06-30 09:29:51 +00:00
function pla_session_close() {
2009-06-30 11:51:50 +00:00
@session_write_close();
2009-06-30 09:22:30 +00:00
}
?>