sessions.php 3.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142
  1. <?php
  2. // Original from http://www.daniweb.com/code/snippet43.html
  3. require_once "config.php";
  4. require_once "classes/db.php";
  5. require_once "autoload.php";
  6. require_once "errorhandler.php";
  7. require_once "lib/accept-to-gettext.php";
  8. require_once "lib/gettext/gettext.inc";
  9. require_once "version.php";
  10. $session_expire = min(2147483647 - time() - 1, max(SESSION_COOKIE_LIFETIME, 86400));
  11. $session_name = (!defined('TTRSS_SESSION_NAME')) ? "ttrss_sid" : TTRSS_SESSION_NAME;
  12. if ((!empty($_SERVER['HTTPS']) && ($_SERVER['HTTPS'] != 'off')) || @$_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
  13. $session_name .= "_ssl";
  14. ini_set("session.cookie_secure", true);
  15. }
  16. ini_set("session.gc_probability", 75);
  17. ini_set("session.name", $session_name);
  18. ini_set("session.use_only_cookies", true);
  19. ini_set("session.gc_maxlifetime", $session_expire);
  20. ini_set("session.cookie_lifetime", min(0, SESSION_COOKIE_LIFETIME));
  21. function session_get_schema_version() {
  22. global $schema_version;
  23. if (!$schema_version) {
  24. $result = Db::get()->query("SELECT schema_version FROM ttrss_version");
  25. $version = Db::get()->fetch_result($result, 0, "schema_version");
  26. $schema_version = $version;
  27. return $version;
  28. } else {
  29. return $schema_version;
  30. }
  31. }
  32. function validate_session() {
  33. if (SINGLE_USER_MODE) return true;
  34. if (isset($_SESSION["ref_schema_version"]) && $_SESSION["ref_schema_version"] != session_get_schema_version()) {
  35. $_SESSION["login_error_msg"] =
  36. __("Session failed to validate (schema version changed)");
  37. return false;
  38. }
  39. if ($_SESSION["uid"]) {
  40. $result = Db::get()->query(
  41. "SELECT pwd_hash FROM ttrss_users WHERE id = '".$_SESSION["uid"]."'");
  42. // user not found
  43. if (Db::get()->num_rows($result) == 0) {
  44. $_SESSION["login_error_msg"] =
  45. __("Session failed to validate (user not found)");
  46. return false;
  47. } else {
  48. $pwd_hash = Db::get()->fetch_result($result, 0, "pwd_hash");
  49. if ($pwd_hash != $_SESSION["pwd_hash"]) {
  50. $_SESSION["login_error_msg"] =
  51. __("Session failed to validate (password changed)");
  52. return false;
  53. }
  54. }
  55. }
  56. return true;
  57. }
  58. /**
  59. * @SuppressWarnings(PHPMD.UnusedFormalParameter)
  60. */
  61. function ttrss_open ($s, $n) {
  62. return true;
  63. }
  64. function ttrss_read ($id){
  65. global $session_expire;
  66. $res = Db::get()->query("SELECT data FROM ttrss_sessions WHERE id='$id'");
  67. if (Db::get()->num_rows($res) != 1) {
  68. $expire = time() + $session_expire;
  69. Db::get()->query("INSERT INTO ttrss_sessions (id, data, expire)
  70. VALUES ('$id', '', '$expire')");
  71. return "";
  72. } else {
  73. return base64_decode(Db::get()->fetch_result($res, 0, "data"));
  74. }
  75. }
  76. function ttrss_write ($id, $data) {
  77. global $session_expire;
  78. $data = base64_encode($data);
  79. $expire = time() + $session_expire;
  80. Db::get()->query("UPDATE ttrss_sessions SET data='$data', expire='$expire' WHERE id='$id'");
  81. return true;
  82. }
  83. function ttrss_close () {
  84. return true;
  85. }
  86. function ttrss_destroy($id) {
  87. Db::get()->query("DELETE FROM ttrss_sessions WHERE id = '$id'");
  88. return true;
  89. }
  90. /**
  91. * @SuppressWarnings(PHPMD.UnusedFormalParameter)
  92. */
  93. function ttrss_gc ($expire) {
  94. Db::get()->query("DELETE FROM ttrss_sessions WHERE expire < " . time());
  95. return true;
  96. }
  97. if (!SINGLE_USER_MODE /* && DB_TYPE == "pgsql" */) {
  98. session_set_save_handler("ttrss_open",
  99. "ttrss_close", "ttrss_read", "ttrss_write",
  100. "ttrss_destroy", "ttrss_gc");
  101. register_shutdown_function('session_write_close');
  102. }
  103. if (!defined('NO_SESSION_AUTOSTART')) {
  104. if (isset($_COOKIE[session_name()])) {
  105. @session_start();
  106. }
  107. }