sessions.php 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165
  1. <?php
  2. // Original from http://www.daniweb.com/code/snippet43.html
  3. require_once "config.php";
  4. require_once "classes/db.php";
  5. require_once "autoload.php";
  6. require_once "errorhandler.php";
  7. require_once "lib/accept-to-gettext.php";
  8. require_once "lib/gettext/gettext.inc";
  9. require_once "version.php";
  10. $session_expire = min(2147483647 - time() - 1, max(SESSION_COOKIE_LIFETIME, 86400));
  11. $session_name = (!defined('TTRSS_SESSION_NAME')) ? "ttrss_sid" : TTRSS_SESSION_NAME;
  12. if (is_server_https()) {
  13. ini_set("session.cookie_secure", true);
  14. }
  15. ini_set("session.gc_probability", 75);
  16. ini_set("session.name", $session_name);
  17. ini_set("session.use_only_cookies", true);
  18. ini_set("session.gc_maxlifetime", $session_expire);
  19. ini_set("session.cookie_lifetime", min(0, SESSION_COOKIE_LIFETIME));
  20. function session_get_schema_version() {
  21. global $schema_version;
  22. if (!$schema_version) {
  23. $row = Db::pdo()->query("SELECT schema_version FROM ttrss_version")->fetch();
  24. $version = $row["schema_version"];
  25. $schema_version = $version;
  26. return $version;
  27. } else {
  28. return $schema_version;
  29. }
  30. }
  31. function validate_session() {
  32. if (SINGLE_USER_MODE) return true;
  33. if (isset($_SESSION["ref_schema_version"]) && $_SESSION["ref_schema_version"] != session_get_schema_version()) {
  34. $_SESSION["login_error_msg"] =
  35. __("Session failed to validate (schema version changed)");
  36. return false;
  37. }
  38. $pdo = Db::pdo();
  39. if ($_SESSION["uid"]) {
  40. if ($_SESSION["user_agent"] != sha1($_SERVER['HTTP_USER_AGENT'])) {
  41. $_SESSION["login_error_msg"] = __("Session failed to validate (UA changed).");
  42. return false;
  43. }
  44. $sth = $pdo->prepare("SELECT pwd_hash FROM ttrss_users WHERE id = ?");
  45. $sth->execute([$_SESSION['uid']]);
  46. // user not found
  47. if ($row = $sth->fetch()) {
  48. $pwd_hash = $row["pwd_hash"];
  49. if ($pwd_hash != $_SESSION["pwd_hash"]) {
  50. $_SESSION["login_error_msg"] =
  51. __("Session failed to validate (password changed)");
  52. return false;
  53. }
  54. } else {
  55. $_SESSION["login_error_msg"] =
  56. __("Session failed to validate (user not found)");
  57. return false;
  58. }
  59. }
  60. return true;
  61. }
  62. /**
  63. * @SuppressWarnings(PHPMD.UnusedFormalParameter)
  64. */
  65. function ttrss_open ($s, $n) {
  66. return true;
  67. }
  68. function ttrss_read ($id){
  69. global $session_expire;
  70. $sth = Db::pdo()->prepare("SELECT data FROM ttrss_sessions WHERE id=?");
  71. $sth->execute([$id]);
  72. if ($row = $sth->fetch()) {
  73. return base64_decode($row["data"]);
  74. } else {
  75. $expire = time() + $session_expire;
  76. $sth = Db::pdo()->prepare("INSERT INTO ttrss_sessions (id, data, expire)
  77. VALUES (?, '', ?)");
  78. $sth->execute([$id, $expire]);
  79. return "";
  80. }
  81. }
  82. function ttrss_write ($id, $data) {
  83. global $session_expire;
  84. $data = base64_encode($data);
  85. $expire = time() + $session_expire;
  86. $sth = Db::pdo()->prepare("SELECT id FROM ttrss_sessions WHERE id=?");
  87. $sth->execute([$id]);
  88. if ($row = $sth->fetch()) {
  89. $sth = Db::pdo()->prepare("UPDATE ttrss_sessions SET data=?, expire=? WHERE id=?");
  90. $sth->execute([$data, $expire, $id]);
  91. } else {
  92. $sth = Db::pdo()->prepare("INSERT INTO ttrss_sessions (id, data, expire)
  93. VALUES (?, ?, ?)");
  94. $sth->execute([$id, $data, $expire]);
  95. }
  96. return true;
  97. }
  98. function ttrss_close () {
  99. return true;
  100. }
  101. function ttrss_destroy($id) {
  102. $sth = Db::pdo()->prepare("DELETE FROM ttrss_sessions WHERE id = ?");
  103. $sth->execute([$id]);
  104. return true;
  105. }
  106. /**
  107. * @SuppressWarnings(PHPMD.UnusedFormalParameter)
  108. */
  109. function ttrss_gc ($expire) {
  110. Db::pdo()->query("DELETE FROM ttrss_sessions WHERE expire < " . time());
  111. return true;
  112. }
  113. if (!SINGLE_USER_MODE /* && DB_TYPE == "pgsql" */) {
  114. session_set_save_handler("ttrss_open",
  115. "ttrss_close", "ttrss_read", "ttrss_write",
  116. "ttrss_destroy", "ttrss_gc");
  117. register_shutdown_function('session_write_close');
  118. }
  119. if (!defined('NO_SESSION_AUTOSTART')) {
  120. if (isset($_COOKIE[session_name()])) {
  121. @session_start();
  122. }
  123. }