sessions.php 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164
  1. <?php
  2. // Original from http://www.daniweb.com/code/snippet43.html
  3. require_once "config.php";
  4. require_once "classes/db.php";
  5. require_once "autoload.php";
  6. require_once "errorhandler.php";
  7. require_once "lib/accept-to-gettext.php";
  8. require_once "lib/gettext/gettext.inc";
  9. $session_expire = min(2147483647 - time() - 1, max(SESSION_COOKIE_LIFETIME, 86400));
  10. $session_name = (!defined('TTRSS_SESSION_NAME')) ? "ttrss_sid" : TTRSS_SESSION_NAME;
  11. if (is_server_https()) {
  12. ini_set("session.cookie_secure", true);
  13. }
  14. ini_set("session.gc_probability", 75);
  15. ini_set("session.name", $session_name);
  16. ini_set("session.use_only_cookies", true);
  17. ini_set("session.gc_maxlifetime", $session_expire);
  18. ini_set("session.cookie_lifetime", min(0, SESSION_COOKIE_LIFETIME));
  19. function session_get_schema_version() {
  20. global $schema_version;
  21. if (!$schema_version) {
  22. $row = Db::pdo()->query("SELECT schema_version FROM ttrss_version")->fetch();
  23. $version = $row["schema_version"];
  24. $schema_version = $version;
  25. return $version;
  26. } else {
  27. return $schema_version;
  28. }
  29. }
  30. function validate_session() {
  31. if (SINGLE_USER_MODE) return true;
  32. if (isset($_SESSION["ref_schema_version"]) && $_SESSION["ref_schema_version"] != session_get_schema_version()) {
  33. $_SESSION["login_error_msg"] =
  34. __("Session failed to validate (schema version changed)");
  35. return false;
  36. }
  37. $pdo = Db::pdo();
  38. if ($_SESSION["uid"]) {
  39. if (!defined('_SESSION_SKIP_UA_CHECKS') && $_SESSION["user_agent"] != sha1($_SERVER['HTTP_USER_AGENT'])) {
  40. $_SESSION["login_error_msg"] = __("Session failed to validate (UA changed).");
  41. return false;
  42. }
  43. $sth = $pdo->prepare("SELECT pwd_hash FROM ttrss_users WHERE id = ?");
  44. $sth->execute([$_SESSION['uid']]);
  45. // user not found
  46. if ($row = $sth->fetch()) {
  47. $pwd_hash = $row["pwd_hash"];
  48. if ($pwd_hash != $_SESSION["pwd_hash"]) {
  49. $_SESSION["login_error_msg"] =
  50. __("Session failed to validate (password changed)");
  51. return false;
  52. }
  53. } else {
  54. $_SESSION["login_error_msg"] =
  55. __("Session failed to validate (user not found)");
  56. return false;
  57. }
  58. }
  59. return true;
  60. }
  61. /**
  62. * @SuppressWarnings(PHPMD.UnusedFormalParameter)
  63. */
  64. function ttrss_open ($s, $n) {
  65. return true;
  66. }
  67. function ttrss_read ($id){
  68. global $session_expire;
  69. $sth = Db::pdo()->prepare("SELECT data FROM ttrss_sessions WHERE id=?");
  70. $sth->execute([$id]);
  71. if ($row = $sth->fetch()) {
  72. return base64_decode($row["data"]);
  73. } else {
  74. $expire = time() + $session_expire;
  75. $sth = Db::pdo()->prepare("INSERT INTO ttrss_sessions (id, data, expire)
  76. VALUES (?, '', ?)");
  77. $sth->execute([$id, $expire]);
  78. return "";
  79. }
  80. }
  81. function ttrss_write ($id, $data) {
  82. global $session_expire;
  83. $data = base64_encode($data);
  84. $expire = time() + $session_expire;
  85. $sth = Db::pdo()->prepare("SELECT id FROM ttrss_sessions WHERE id=?");
  86. $sth->execute([$id]);
  87. if ($row = $sth->fetch()) {
  88. $sth = Db::pdo()->prepare("UPDATE ttrss_sessions SET data=?, expire=? WHERE id=?");
  89. $sth->execute([$data, $expire, $id]);
  90. } else {
  91. $sth = Db::pdo()->prepare("INSERT INTO ttrss_sessions (id, data, expire)
  92. VALUES (?, ?, ?)");
  93. $sth->execute([$id, $data, $expire]);
  94. }
  95. return true;
  96. }
  97. function ttrss_close () {
  98. return true;
  99. }
  100. function ttrss_destroy($id) {
  101. $sth = Db::pdo()->prepare("DELETE FROM ttrss_sessions WHERE id = ?");
  102. $sth->execute([$id]);
  103. return true;
  104. }
  105. /**
  106. * @SuppressWarnings(PHPMD.UnusedFormalParameter)
  107. */
  108. function ttrss_gc ($expire) {
  109. Db::pdo()->query("DELETE FROM ttrss_sessions WHERE expire < " . time());
  110. return true;
  111. }
  112. if (!SINGLE_USER_MODE /* && DB_TYPE == "pgsql" */) {
  113. session_set_save_handler("ttrss_open",
  114. "ttrss_close", "ttrss_read", "ttrss_write",
  115. "ttrss_destroy", "ttrss_gc");
  116. register_shutdown_function('session_write_close');
  117. }
  118. if (!defined('NO_SESSION_AUTOSTART')) {
  119. if (isset($_COOKIE[session_name()])) {
  120. @session_start();
  121. }
  122. }