Commit Graph

26 Commits

Author SHA1 Message Date
Sean Harvey
0ee3a683a5 Better support for overloading start and destroy methods in Session
Move functionality from static start and destroy functions into instance
methods, allowing these to be overloaded. This works the same way as
calling Session::set() which then in turn calls inst_set()

Additionally use Injector to create the default Session instance to
allow the class to be swapped out.
2014-06-20 10:35:53 +12:00
Marcus Dalgren
9934230ad8 Fix Session::set_cookie_domain 2014-01-17 15:27:51 +01:00
Devlin
112e08e5f2 FIX Session::get_timeout 2013-10-22 14:20:18 +02:00
Hamish Friedlander
d629d9422f FIX Session::$cookie_secure so Sessions still work via HTTP
Session::$cookie_secure adds the secure property to the session Set-Cookie
command, so that the browser wouldnt send it to the server over an unencrypted
link. However the server would still send the cookie to the browser
unencrypted. Also Sessions would stop working properly in HTTP,
but SilverStripe needs them for several things, such as form validation

This patch effectively causes HTTP and HTTPS requests to each have
their own session when cookie_secure is true. The two sessions are
independant from each other, so information set in the session via
HTTPS is safe from attacks on the session via HTTP, but parts
of the site that use HTTP and the session will still work
2013-07-07 09:12:10 +12:00
Hamish Friedlander
2886f6ee14 FIX Session was started every time, even if no data set
Session tracks the user agent in the session, to add some detection of
stolen session IDs. However this was causing a session to always be
created, even if this request didnt store any data in the session.
2013-07-07 09:12:10 +12:00
Mateusz Uzdowski
53a2dbd207 Add a note on the unit of the Session.timeout. 2013-06-21 10:56:00 +12:00
Kirk Mayo
dff5447cbc BUG: Fix for Cookie expiry timeout being passed as a large number on 64 bit machines 2013-06-20 12:30:48 +12:00
Ingo Schommer
4ef83a2895 Using Cookie class in Session::destroy()
It allows us to suppress "headers sent" errors, which is particularly
important in phpunit test runs.
2013-06-18 23:06:22 +02:00
Sam Minnee
f2c918dc45 FIX: Make session timeout inactive-time only.
By default, the Session.timeout configuration option specifies the total
session time, regardless of the amount of activity.  This change means
that the timeout specifies how long without any further dynamic requests
before the session cookie expires.

The way it does this is to re-set the session cookie expiry with a
subsequent Set-Cookie command each time a request that necessitates
a session is called.

Strictly speaking, it's a change in session timeout semantics, but I think
it's a good one, because total-session-time-regardless-of-activity is a
stupid timeout to include, and has more to do with the mechanics of the
internet than with application security requirements.
2013-05-31 16:26:04 +12:00
Stephen Shkardoon
d6c2c2e07f Fixes #1892 - Stop session hijacking with UA check 2013-05-25 19:29:08 +12:00
Mateusz Uzdowski
2f7fd967b2 BUG Clean up the logOut and session destructon routines. 2013-05-23 13:27:41 +12:00
Ingo Schommer
07d99a5136 FIX Fallback for Session.cookie_path
Regression introduced by Config API static changes.
Effectively meant that you can no longer log in to the CMS
since the cookie path is set for each URL individually...
2013-03-25 23:03:34 +01:00
Ingo Schommer
3334eafcb1 API Marked statics private, use Config API instead (#8317)
See "Static configuration properties are now immutable, you must use Config API." in the 3.1 change log for details.
2013-03-24 17:20:53 +01:00
Mateusz Uzdowski
d52d5f71c5 BUG Adjust Session::setFormMessage to fit with underlying API. 2013-02-12 11:00:36 +13:00
Sam Minnee
f8206d15c8 BUGFIX: Prevent notice-level error in Session code when non-array is turned into an array. 2013-01-29 18:03:48 +01:00
Sam Minnee
1f7fc1f76a FIX Remove instances of lines longer than 120c
The entire framework repo (with the exception of system-generated files) has been amended to respect the 120c line-length limit.  This is in preparation for the enforcement of this rule with PHP_CodeSniffer.
2012-09-30 17:18:13 +13:00
Ingo Schommer
e2f073f38a Method visibility according to coding conventions 2012-09-20 10:46:59 +02:00
Ingo Schommer
417c03716c BUGFIX Avoid Session::set() clearing on existing val (fixes #7487) 2012-06-17 23:46:52 +02:00
Sean Harvey
f63d137d49 ENHANCEMENT Session::start() now only called when there is changed
session data to be saved, and started on Director::direct() when there
is a cookie (or request var) containing the current PHP session name.
2012-04-27 16:28:46 +12:00
Will Rossiter
8e8c1302a2 Merge pull request #360 from joaosantos81/master
MINOR: clear_all returns void (and not the result of inst_clearAll() invocation)
2012-04-22 01:49:53 -07:00
joaosantos81
611cd53be8 inst_clearAll() does not return anything so clear_all() method should not expect any return value from inst_clearAll invocation 2012-04-20 18:36:11 +02:00
Simon Welsh
f07258f3cf MINOR Update @package values to match renaming sapphire 2012-04-15 10:50:19 +12:00
Ingo Schommer
27fd3e5633 API CHANGE Removed Session::load_config() (no longer supported) 2012-03-09 21:17:18 +01:00
joaosantos81
77f5ea733b Fix for bug when destroying a session with a domain cookie. See http://www.silverstripe.org/general-questions/show/18539 for more details 2011-11-14 09:44:46 +00:00
Ingo Schommer
44354d472f API CHANGE Removed Session::clearAll(), use clear_all() instead
API CHANGE Removed Session::getAll(), use get_all() instead
2011-05-01 20:23:07 +12:00
Ingo Schommer
9b29616710 API CHANGE Rearranged files in sapphire to reflect core dependencies more accurately, and have the tests/ folder mirror its folder structure 2011-03-31 09:56:21 +13:00