Saving Data * * You can write a value to a users session from your PHP code using the static function {@link Session::set()}. You * can add this line in any function or file you wish to save the value. * * * Session::set('MyValue', 6); * * * Saves the value of "6" to the MyValue session data. You can also save arrays or serialized objects in session (but * note there may be size restrictions as to how much you can save) * * * // save a variable * $var = 1; * Session::set('MyVar', $var); * * // saves an array * Session::set('MyArrayOfValues', array('1', '2', '3')); * * // saves an object (you'll have to unserialize it back) * $object = new Object(); * * Session::set('MyObject', serialize($object)); * * * Accessing Data * * Once you have saved a value to the Session you can access it by using the {@link Session::get()} function. * Like the {@link Session::set()} function you can use this anywhere in your PHP files. * * The values in the comments are the values stored from the previous example. * * * public function bar() { * $value = Session::get('MyValue'); // $value = 6 * $var = Session::get('MyVar'); // $var = 1 * $array = Session::get('MyArrayOfValues'); // $array = array(1,2,3) * $object = Session::get('MyObject', unserialize($object)); // $object = Object() * } * * * You can also get all the values in the session at once. This is useful for debugging. * * * Session::get_all(); // returns an array of all the session values. * * * Clearing Data * * Once you have accessed a value from the Session it doesn't automatically wipe the value from the Session, you have * to specifically remove it. To clear a value you can either delete 1 session value by the name that you saved it * * * Session::clear('MyValue'); // MyValue is no longer 6. * * * Or you can clear every single value in the session at once. Note SilverStripe stores some of its own session data * including form and page comment information. None of this is vital but clear_all will clear everything. * * * Session::clear_all(); * * * @see Cookie * @todo This class is currently really basic and could do with a more well-thought-out implementation. */ class Session { use Configurable; /** * Set session timeout in seconds. * * @var int * @config */ private static $timeout = 0; /** * @config * @var array */ private static $session_ips = array(); /** * @config * @var string */ private static $cookie_domain; /** * @config * @var string */ private static $cookie_path; /** * @config * @var string */ private static $session_store_path; /** * @config * @var boolean */ private static $cookie_secure = false; /** * Session data. * Will be null if session has not been started * * @var array|null */ protected $data = null; /** * @var array */ protected $changedData = array(); /** * Get user agent for this request * * @return string */ protected function userAgent($request) { return $request->getHeader('User-Agent'); } /** * Start PHP session, then create a new Session object with the given start data. * * @param array|null|Session $data Can be an array of data (such as $_SESSION) or another Session object to clone. * If null, this session is treated as unstarted. */ public function __construct($data) { if ($data instanceof Session) { $data = $data->getAll(); } $this->data = $data; } /** * Init this session instance before usage */ public function init(HTTPRequest $request) { if (!$this->isStarted()) { $this->start($request); } // Funny business detected! if (isset($this->data['HTTP_USER_AGENT'])) { if ($this->data['HTTP_USER_AGENT'] !== $this->userAgent($request)) { $this->clearAll(); $this->destroy(); $this->start($request); } } } /** * Destroy existing session and restart */ public function restart(HTTPRequest $request) { $this->destroy(); $this->init($request); } /** * Determine if this session has started * * @return bool */ public function isStarted() { return isset($this->data); } /** * Begin session * * @param $request The request for which to start a session */ public function start(HTTPRequest $request) { if ($this->isStarted()) { throw new BadMethodCallException("Session has already started"); } $path = $this->config()->get('cookie_path'); if (!$path) { $path = Director::baseURL(); } $domain = $this->config()->get('cookie_domain'); $secure = Director::is_https($request) && $this->config()->get('cookie_secure'); $session_path = $this->config()->get('session_store_path'); $timeout = $this->config()->get('timeout'); // Director::baseURL can return absolute domain names - this extracts the relevant parts // for the session otherwise we can get broken session cookies if (Director::is_absolute_url($path)) { $urlParts = parse_url($path); $path = $urlParts['path']; if (!$domain) { $domain = $urlParts['host']; } } if (!session_id() && !headers_sent()) { if ($domain) { session_set_cookie_params($timeout, $path, $domain, $secure, true); } else { session_set_cookie_params($timeout, $path, null, $secure, true); } // Allow storing the session in a non standard location if ($session_path) { session_save_path($session_path); } // If we want a secure cookie for HTTPS, use a seperate session name. This lets us have a // seperate (less secure) session for non-HTTPS requests if ($secure) { session_name('SECSESSID'); } session_start(); $this->data = isset($_SESSION) ? $_SESSION : array(); } else { $this->data = []; } // Modify the timeout behaviour so it's the *inactive* time before the session expires. // By default it's the total session lifetime if ($timeout && !headers_sent()) { Cookie::set(session_name(), session_id(), $timeout/86400, $path, $domain ? $domain : null, $secure, true); } } /** * Destroy this session * * @param bool $removeCookie */ public function destroy($removeCookie = true) { if (session_id()) { if ($removeCookie) { $path = $this->config()->get('cookie_path') ?: Director::baseURL(); $domain = $this->config()->get('cookie_domain'); $secure = $this->config()->get('cookie_secure'); Cookie::force_expiry(session_name(), $path, $domain, $secure, true); } session_destroy(); } // Clean up the superglobal - session_destroy does not do it. // http://nz1.php.net/manual/en/function.session-destroy.php unset($_SESSION); $this->data = null; } /** * Set session value * * @param string $name * @param mixed $val * @return $this */ public function set($name, $val) { if (!$this->isStarted()) { throw new BadMethodCallException("Session cannot be modified until it's started"); } // Quicker execution path for "."-free names if (strpos($name, '.') === false) { $this->data[$name] = $val; $this->changedData[$name] = $val; } else { $names = explode('.', $name); // We still want to do this even if we have strict path checking for legacy code $var = &$this->data; $diffVar = &$this->changedData; // Iterate twice over the names - once to see if the value needs to be changed, // and secondly to get the changed data value. This is done to solve a problem // where iterating over the diff var would create empty arrays, and the value // would then not be set, inadvertently clearing session values. foreach ($names as $n) { $var = &$var[$n]; } if ($var !== $val) { foreach ($names as $n) { $diffVar = &$diffVar[$n]; } $var = $val; $diffVar = $val; } } return $this; } /** * Merge value with array * * @param string $name * @param mixed $val */ public function addToArray($name, $val) { if (!$this->isStarted()) { throw new BadMethodCallException("Session cannot be modified until it's started"); } $names = explode('.', $name); // We still want to do this even if we have strict path checking for legacy code $var = &$this->data; $diffVar = &$this->changedData; foreach ($names as $n) { $var = &$var[$n]; $diffVar = &$diffVar[$n]; } $var[] = $val; $diffVar[sizeof($var)-1] = $val; } /** * Get session value * * @param string $name * @return mixed */ public function get($name) { if (!$this->isStarted()) { throw new BadMethodCallException("Session cannot be accessed until it's started"); } // Quicker execution path for "."-free names if (strpos($name, '.') === false) { if (isset($this->data[$name])) { return $this->data[$name]; } return null; } else { $names = explode('.', $name); if (!isset($this->data)) { return null; } $var = $this->data; foreach ($names as $n) { if (!isset($var[$n])) { return null; } $var = $var[$n]; } return $var; } } /** * Clear session value * * @param string $name * @return $this */ public function clear($name) { if (!$this->isStarted()) { throw new BadMethodCallException("Session cannot be modified until it's started"); } $names = explode('.', $name); // We still want to do this even if we have strict path checking for legacy code $var = &$this->data; $diffVar = &$this->changedData; foreach ($names as $n) { // don't clear a record that doesn't exist if (!isset($var[$n])) { return $this; } $var = &$var[$n]; } // only loop to find data within diffVar if var is proven to exist in the above loop foreach ($names as $n) { $diffVar = &$diffVar[$n]; } if ($var !== null) { $var = null; $diffVar = null; } return $this; } /** * Clear all values */ public function clearAll() { if (!$this->isStarted()) { throw new BadMethodCallException("Session cannot be modified until it's started"); } if ($this->data && is_array($this->data)) { foreach (array_keys($this->data) as $key) { $this->clear($key); } } } /** * Get all values * * @return array|null */ public function getAll() { return $this->data; } /** * Set user agent key */ public function finalize(HTTPRequest $request) { $this->set('HTTP_USER_AGENT', $this->userAgent($request)); } /** * Save data to session * Only save the changes, so that anyone manipulating $_SESSION directly doesn't get burned. */ public function save(HTTPRequest $request) { if ($this->changedData) { $this->finalize($request); if (!$this->isStarted()) { $this->start($request); } $this->recursivelyApply($this->changedData, $_SESSION); } } /** * Recursively apply the changes represented in $data to $dest. * Used to update $_SESSION * * @param array $data * @param array $dest */ protected function recursivelyApply($data, &$dest) { foreach ($data as $k => $v) { if (is_array($v)) { if (!isset($dest[$k]) || !is_array($dest[$k])) { $dest[$k] = array(); } $this->recursivelyApply($v, $dest[$k]); } else { $dest[$k] = $v; } } } /** * Return the changed data, for debugging purposes. * * @return array */ public function changedData() { return $this->changedData; } }