silverstripe-framework/control/Session.php

<?php
/**
 * Handles all manipulation of the session.
 *
 * The static methods are used to manipulate the currently active controller's session.
 * The instance methods are used to manipulate a particular session.  There can be more than one of these created.
 *
 * In order to support things like testing, the session is associated with a particular Controller.  In normal usage,
 * this is loaded from and saved to the regular PHP session, but for things like static-page-generation and
 * unit-testing, you can create multiple Controllers, each with their own session.
 *
 * The instance object is basically just a way of manipulating a set of nested maps, and isn't specific to session
 * data.
 *
 * <b>Saving Data</b>
 *
 * You can write a value to a users session from your PHP code using the static function {@link Session::set()}. You
 * can add this line in any function or file you wish to save the value.
 *
 * <code>
 * 	Session::set('MyValue', 6);
 * </code>
 *
 * Saves the value of "6" to the MyValue session data. You can also save arrays or serialized objects in session (but
 * note there may be size restrictions as to how much you can save)
 *
 * <code>
 * 	// save a variable
 * 	$var = 1;
 * 	Session::set('MyVar', $var);
 *
 * 	// saves an array
 * 	Session::set('MyArrayOfValues', array('1','2','3'));
 *
 * 	// saves an object (you'll have to unserialize it back)
 * 	$object = new Object();
 *
 * 	Session::set('MyObject', serialize($object));
 * </code>
 *
 * <b>Accessing Data</b>
 *
 * Once you have saved a value to the Session you can access it by using the {@link Session::get()} function.
 * Like the {@link Session::set()} function you can use this anywhere in your PHP files.
 *
 * The values in the comments are the values stored from the previous example.
 *
 * <code>
 * public function bar() {
 * 	$value = Session::get('MyValue'); // $value = 6
 * 	$var   = Session::get('MyVar'); // $var = 1
 * 	$array = Session::get('MyArrayOfValues'); // $array = array(1,2,3)
 * 	$object = Session::get('MyObject', unserialize($object)); // $object = Object()
 * }
 * </code>
 *
 * You can also get all the values in the session at once. This is useful for debugging.
 *
 * <code>
 * Session::get_all(); // returns an array of all the session values.
 * </code>
 *
 * <b>Clearing Data</b>
 *
 * Once you have accessed a value from the Session it doesn't automatically wipe the value from the Session, you have
 * to specifically remove it. To clear a value you can either delete 1 session value by the name that you saved it
 *
 * <code>
 * Session::clear('MyValue'); // MyValue is no longer 6.
 * </code>
 *
 * Or you can clear every single value in the session at once. Note SilverStripe stores some of its own session data
 * including form and page comment information. None of this is vital but clear_all will clear everything.
 *
 * <code>
 * 	Session::clear_all();
 * </code>
 *
 * @see Cookie
 * @todo This class is currently really basic and could do with a more well-thought-out implementation.
 *
 * @package framework
 * @subpackage control
 */

class Session {

	/**
	 * @var $timeout Set session timeout in seconds.
	 * @config
	 */
	private static $timeout = 0;

	/**
	 * @config
	 * @var array
	 */
	private static $session_ips = array();

	/**
	 * @config
	 * @var string
	 */
	private static $cookie_domain;

	/**
	 * @config
	 * @var string
	 */
	private static $cookie_path;

	/**
	 * @config
	 * @var string
	 */
	private static $session_store_path;

	/**
	 * @config
	 * @var boolean
	 */
	private static $cookie_secure = false;

	/**
	 * Session data
	 */
	protected $data = array();

	protected $changedData = array();

	protected function userAgent() {
		if (isset($_SERVER['HTTP_USER_AGENT'])) {
			return $_SERVER['HTTP_USER_AGENT'];
		} else {
			return '';
		}
	}

	/**
	 * Start PHP session, then create a new Session object with the given start data.
	 *
	 * @param $data array|Session Can be an array of data (such as $_SESSION) or another Session object to clone.
	 */
	public function __construct($data) {
		if($data instanceof Session) $data = $data->inst_getAll();

		$this->data = $data;
		$this->expireIfInvalid();
	}

	/**
	 * Cookie domain, for example 'www.php.net'.
	 *
	 * To make cookies visible on all subdomains then the domain
	 * must be prefixed with a dot like '.php.net'.
	 *
	 * @deprecated 4.0 Use the "Session.cookie_domain" config setting instead
	 *
	 * @param string $domain The domain to set
	 */
	public static function set_cookie_domain($domain) {
		Deprecation::notice('4.0', 'Use the "Session.cookie_domain" config setting instead');
		Config::inst()->update('Session', 'cookie_domain', $domain);
	}

	/**
	 * Get the cookie domain.
	 *
	 * @deprecated 4.0 Use the "Session.cookie_domain" config setting instead
	 *
	 * @return string
	 */
	public static function get_cookie_domain() {
		Deprecation::notice('4.0', 'Use the "Session.cookie_domain" config setting instead');
		return Config::inst()->get('Session', 'cookie_domain');
	}

	/**
	 * Path to set on the domain where the session cookie will work.
	 * Use a single slash ('/') for all paths on the domain.
	 *
	 * @deprecated 4.0 Use the "Session.cookie_path" config setting instead
	 *
	 * @param string $path The path to set
	 */
	public static function set_cookie_path($path) {
		Deprecation::notice('4.0', 'Use the "Session.cookie_path" config setting instead');
		Config::inst()->update('Session', 'cookie_path', $path);
	}

	/**
	 * Get the path on the domain where the session cookie will work.
	 *
	 * @deprecated 4.0 Use the "Session.cookie_path" config setting instead
	 *
	 * @return string
	 */
	public static function get_cookie_path() {
		Deprecation::notice('4.0', 'Use the "Session.cookie_path" config setting instead');
		if(Config::inst()->get('Session', 'cookie_path')) {
			return Config::inst()->get('Session', 'cookie_path');
		} else {
			return Director::baseURL();
		}
	}

	/**
	 * Secure cookie, tells the browser to only send it over SSL.
	 *
	 * @deprecated 4.0 Use the "Session.cookie_secure" config setting instead
	 *
	 * @param boolean $secure
	 */
	public static function set_cookie_secure($secure) {
		Deprecation::notice('4.0', 'Use the "Session.cookie_secure" config setting instead');
		Config::inst()->update('Session', 'cookie_secure', (bool)$secure);
	}

	/**
	 * Get if the cookie is secure
	 *
	 * @deprecated 4.0 Use the "Session.cookie_secure" config setting instead
	 *
	 * @return boolean
	 */
	public static function get_cookie_secure() {
		Deprecation::notice('4.0', 'Use the "Session.cookie_secure" config setting instead');
		return Config::inst()->get('Session', 'cookie_secure');
	}

	/**
	 * Set the session store path
	 *
	 * @deprecated 4.0 Use the "Session.session_store_path" config setting instead
	 *
	 * @param string $path Filesystem path to the session store
	 */
	public static function set_session_store_path($path) {
		Deprecation::notice('4.0', 'Use the "Session.session_store_path" config setting instead');
		Config::inst()->update('Session', 'session_store_path', $path);
	}

	/**
	 * Get the session store path
	 * @return string
	 * @deprecated since version 4.0
	 */
	public static function get_session_store_path() {
		Deprecation::notice('4.0', 'Use the "Session.session_store_path" config setting instead');
		return Config::inst()->get('Session', 'session_store_path');
	}

	/**
	 * Provide an <code>array</code> of rules specifing timeouts for IPv4 address ranges or
	 * individual IPv4 addresses. The key is an IP address or range and the value is the time
	 * until the session expires in seconds. For example:
	 *
	 * Session::set_timeout_ips(array(
	 * 		'127.0.0.1' => 36000
	 * ));
	 *
	 * Any user connecting from 127.0.0.1 (localhost) will have their session expired after 10 hours.
	 *
	 * Session::set_timeout is used to set the timeout value for any users whose address is not in the given IP range.
	 *
	 * @deprecated 4.0 Use the "Session.timeout_ips" config setting instead
	 *
	 * @param array $session_ips Array of IPv4 rules.
	 */
	public static function set_timeout_ips($ips) {
		Deprecation::notice('4.0', 'Use the "Session.timeout_ips" config setting instead');
		Config::inst()->update('Session', 'timeout_ips', $ips);
	}

	/**
	 * Add a value to a specific key in the session array
	 */
	public static function add_to_array($name, $val) {
		return self::current_session()->inst_addToArray($name, $val);
	}

	/**
	 * Set a key/value pair in the session
	 *
	 * @param string $name Key
	 * @param string $val Value
	 */
	public static function set($name, $val) {
		return self::current_session()->inst_set($name, $val);
	}

	/**
	 * Return a specific value by session key
	 *
	 * @param string $name Key to lookup
	 */
	public static function get($name) {
		return self::current_session()->inst_get($name);
	}

	/**
	 * Return all the values in session
	 *
	 * @return Array
	 */
	public static function get_all() {
		return self::current_session()->inst_getAll();
	}

	/**
	 * Clear a given session key, value pair.
	 *
	 * @param string $name Key to lookup
	 */
	public static function clear($name) {
		return self::current_session()->inst_clear($name);
	}

	/**
	 * Clear all the values
	 *
	 * @return void
	 */
	public static function clear_all() {
		self::current_session()->inst_clearAll();
		self::$default_session = null;
	}

	/**
	 * Save all the values in our session to $_SESSION
	 */
	public static function save() {
		return self::current_session()->inst_save();
	}

	protected static $default_session = null;

	protected static function current_session() {
		if(Controller::has_curr()) {
			return Controller::curr()->getSession();
		} else {
			if(!self::$default_session) {
				self::$default_session = Injector::inst()->create('Session', isset($_SESSION) ? $_SESSION : array());
			}

			return self::$default_session;
		}
	}

	public function inst_start($sid = null) {
		$path = Config::inst()->get('Session', 'cookie_path');
		if(!$path) $path = Director::baseURL();
		$domain = Config::inst()->get('Session', 'cookie_domain');
		// Director::baseURL can return absolute domain names - this extracts the relevant parts
		// for the session otherwise we can get broken session cookies
		if (Director::is_absolute_url($path)) {
			$urlParts = parse_url($path);
			$path = $urlParts['path'];
			if (!$domain) {
				$domain = $urlParts['host'];
			}
		}
		$secure = Director::is_https() && Config::inst()->get('Session', 'cookie_secure');
		$session_path = Config::inst()->get('Session', 'session_store_path');
		$timeout = Config::inst()->get('Session', 'timeout');

		if(!session_id() && !headers_sent()) {
			if($domain) {
				session_set_cookie_params($timeout, $path, $domain, $secure, true);
			} else {
				session_set_cookie_params($timeout, $path, null, $secure, true);
			}

			// Allow storing the session in a non standard location
			if($session_path) session_save_path($session_path);

			// If we want a secure cookie for HTTPS, use a seperate session name. This lets us have a
			// seperate (less secure) session for non-HTTPS requests
			if($secure) session_name('SECSESSID');

			if($sid) session_id($sid);
			session_start();

			$this->data = isset($_SESSION) ? $_SESSION : array();
		}

		// Ensure session is validated on start
		$this->expireIfInvalid();

		// Modify the timeout behaviour so it's the *inactive* time before the session expires.
		// By default it's the total session lifetime
		if($timeout && !headers_sent()) {
			Cookie::set(session_name(), session_id(), $timeout/86400, $path, $domain ? $domain
				: null, $secure, true);
		}
	}

	public function inst_destroy($removeCookie = true) {
		if(session_id()) {
			if($removeCookie) {
				$path = Config::inst()->get('Session', 'cookie_path') ?: Director::baseURL();
				$domain = Config::inst()->get('Session', 'cookie_domain');
				$secure = Config::inst()->get('Session', 'cookie_secure');

				Cookie::force_expiry(session_name(), $path, $domain, $secure, true);
			}

			session_destroy();

			// Clean up the superglobal - session_destroy does not do it.
			// http://nz1.php.net/manual/en/function.session-destroy.php
			unset($_SESSION);
			$this->data = array();
		}
	}

	public function inst_set($name, $val) {
		// Quicker execution path for "."-free names
		if(strpos($name,'.') === false) {
			$this->data[$name] = $val;
			$this->changedData[$name] = $val;

		} else {
			$names = explode('.', $name);

			// We still want to do this even if we have strict path checking for legacy code
			$var = &$this->data;
			$diffVar = &$this->changedData;

			// Iterate twice over the names - once to see if the value needs to be changed,
			// and secondly to get the changed data value. This is done to solve a problem
			// where iterating over the diff var would create empty arrays, and the value
			// would then not be set, inadvertently clearing session values.
			foreach($names as $n) {
				$var = &$var[$n];
			}

			if($var !== $val) {
				foreach($names as $n) {
					$diffVar = &$diffVar[$n];
				}

				$var = $val;
				$diffVar = $val;
			}
		}
	}

	public function inst_addToArray($name, $val) {
		$names = explode('.', $name);

		// We still want to do this even if we have strict path checking for legacy code
		$var = &$this->data;
		$diffVar = &$this->changedData;

		foreach($names as $n) {
			$var = &$var[$n];
			$diffVar = &$diffVar[$n];
		}

		$var[] = $val;
		$diffVar[sizeof($var)-1] = $val;
	}

	public function inst_get($name) {
		// Quicker execution path for "."-free names
		if(strpos($name,'.') === false) {
			if(isset($this->data[$name])) return $this->data[$name];

		} else {
			$names = explode('.', $name);

			if(!isset($this->data)) {
				return null;
			}

			$var = $this->data;

			foreach($names as $n) {
				if(!isset($var[$n])) {
					return null;
				}
				$var = $var[$n];
			}

			return $var;
		}
	}

	public function inst_clear($name) {
		$names = explode('.', $name);

		// We still want to do this even if we have strict path checking for legacy code
		$var = &$this->data;
		$diffVar = &$this->changedData;

		foreach($names as $n) {
			// don't clear a record that doesn't exist
			if(!isset($var[$n])) return;
			$var = &$var[$n];
		}

		// only loop to find data within diffVar if var is proven to exist in the above loop
		foreach($names as $n) {
			$diffVar = &$diffVar[$n];
		}

		if($var !== null) {
			$var = null;
			$diffVar = null;
		}
	}

	public function inst_clearAll() {
		if($this->data && is_array($this->data)) {
			foreach(array_keys($this->data) as $key) {
				$this->inst_clear($key);
			}
		}
	}

	public function inst_getAll() {
		return $this->data;
	}

	public function inst_finalize() {
		$this->inst_set('HTTP_USER_AGENT', $this->userAgent());
	}

	/**
	 * Save data to session
	 * Only save the changes, so that anyone manipulating $_SESSION directly doesn't get burned.
	 */
	public function inst_save() {
		if($this->changedData) {
			$this->inst_finalize();

			if(!isset($_SESSION)) {
				$this->inst_start();
			}

			$this->recursivelyApply($this->changedData, $_SESSION);
		}
	}

	/**
	 * Recursively apply the changes represented in $data to $dest.
	 * Used to update $_SESSION
	 */
	protected function recursivelyApply($data, &$dest) {
		foreach($data as $k => $v) {
			if(is_array($v)) {
				if(!isset($dest[$k]) || !is_array($dest[$k])) $dest[$k] = array();
				$this->recursivelyApply($v, $dest[$k]);
			} else {
				$dest[$k] = $v;
			}
		}
	}

	/**
	 * Return the changed data, for debugging purposes.
	 * @return array
	 */
	public function inst_changedData() {
		return $this->changedData;
	}

	/**
	* Sets the appropriate form message in session, with type. This will be shown once,
	* for the form specified.
	*
	* @param string $formname the form name you wish to use ( usually $form->FormName() )
	* @param string $message the message you wish to add to it
	* @param string $type the type of message
	*/
	public static function setFormMessage($formname, $message, $type){
		Session::set("FormInfo.$formname.formError.message", $message);
		Session::set("FormInfo.$formname.formError.type", $type);
	}

	/**
	 * Is there a session ID in the request?
	 * @return bool
	 */
	public static function request_contains_session_id() {
		$secure = Director::is_https() && Config::inst()->get('Session', 'cookie_secure');
		$name = $secure ? 'SECSESSID' : session_name();
		return isset($_COOKIE[$name]) || isset($_REQUEST[$name]);
	}

	/**
	 * Initialize session.
	 *
	 * @param string $sid Start the session with a specific ID
	 */
	public static function start($sid = null) {
		self::current_session()->inst_start($sid);
	}

	/**
	 * Destroy the active session.
	 *
	 * @param bool $removeCookie If set to TRUE, removes the user's cookie, FALSE does not remove
	 */
	public static function destroy($removeCookie = true) {
		self::current_session()->inst_destroy($removeCookie);
	}

	/**
	 * Set the timeout of a Session value
	 *
	 * @deprecated 4.0 Use the "Session.timeout" config setting instead
	 *
	 * @param int $timeout Time until a session expires in seconds. Defaults to expire when browser is closed.
	 */
	public static function set_timeout($timeout) {
		Deprecation::notice('4.0', 'Use the "Session.timeout" config setting instead');
		Config::inst()->update('Session', 'timeout', (int) $timeout);
	}

	/**
	 * @deprecated 4.0 Use the "Session.timeout" config setting instead
	 */
	public static function get_timeout() {
		Deprecation::notice('4.0', 'Use the "Session.timeout" config setting instead');
		return Config::inst()->get('Session', 'timeout');
	}

	/**
	 * Validate the user agent against the current data, resetting the
	 * current session if a mismatch is detected.
	 *
	 * @deprecated 3.0..4.0 Removed in 4.0
	 * @return bool If user agent has been set against this session, returns
	 * the valid state of this session as either true or false. If the agent
	 * isn't set it is assumed valid and returns true.
	 */
	private function expireIfInvalid() {
		// If not set, indeterminable; Assume true as safe default
		if (!isset($this->data['HTTP_USER_AGENT'])) {
			return true;
		}

		// Agents match, deterministically true
		if ($this->data['HTTP_USER_AGENT'] === $this->userAgent()) {
			return true;
		}

		// Funny business detected!
		$this->inst_clearAll();
		$this->inst_destroy();
		$this->inst_start();
		return false;
	}
}