diff --git a/src/Exception/ExceptionInterface.php b/src/Exception/ExceptionInterface.php index 9e769d6..1329a73 100644 --- a/src/Exception/ExceptionInterface.php +++ b/src/Exception/ExceptionInterface.php @@ -23,7 +23,7 @@ * SOFTWARE. */ -namespace Omatamix\SessionLock\Exception; +namespace Cytrenna\Session\Exception; use Throwable; diff --git a/src/Exception/InvalidFingerprintException.php b/src/Exception/InvalidFingerprintException.php index 0bcd18a..5f119de 100644 --- a/src/Exception/InvalidFingerprintException.php +++ b/src/Exception/InvalidFingerprintException.php @@ -23,7 +23,7 @@ * SOFTWARE. */ -namespace Omatamix\SessionLock\Exception; +namespace Cytrenna\Session\Exception; use Exception; diff --git a/src/Exception/SessionClosedException.php b/src/Exception/SessionClosedException.php new file mode 100644 index 0000000..71a35d1 --- /dev/null +++ b/src/Exception/SessionClosedException.php @@ -0,0 +1,35 @@ +isRunning()) { + // Clear all session variables + $this->clear(); + // Void the session cookie + $this->voidSessionCookie(); + // Free the session ID. + $this->freeSessionID(); + // Regenerate session ID. + if ($logout) + $this->regenerateSessionID(); + // Destroy the session. + return $this->destroySession(); } - return session_destroy(); + return true; } /** * {@inheritdoc} */ - public function exists(): bool + public function isRunning(): bool { - if (php_sapi_name() !== 'cli') { - return session_status() === PHP_SESSION_ACTIVE ? true : false; - } - return false; + // Return false on the command line cli. + if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') + return false; + // Return the current session status. + return session_status() === PHP_SESSION_ACTIVE; } /** * {@inheritdoc} */ - public function regenerate(bool $deleteOldSession = true): bool + public function regenerateSessionID(bool $deleteOldSession = true): bool { + // Regenerate the session ID. return session_regenerate_id($deleteOldSession); } + /** + * {@inheritdoc} + */ + public function clear(): bool + { + // Clear all session variable. + $_SESSION = array(); + } + + /** + * {@inheritdoc} + */ + public function voidSessionCookie(): bool + { + // Void the session cookie. + if (ini_get("session.use_cookies") && isset($_COOKIE[session_name()])) { + // Get the cookie params. + $params = session_get_cookie_params(); + // Delete the cookie. + setcookie(session_name(), '', time() - 42000, + $params["path"] ?? '/', + $params["domain"] ?? '', + $params["secure"] ?? false, + $params["httponly"] ?? false + ); + } + } + + /** + * {@inheritdoc} + */ + public function freeSessionID(): bool + { + // Free the session ID. + session_unset(); + } + /** * {@inheritdoc} */ public function has(string $key): bool { - return isset($_SESSION[$key]); + if ($this->isRunning()) { + // Check to see if the session variable is set. + return isset($_SESSION[$key]); + } + return false; } /** @@ -139,7 +188,10 @@ public function has(string $key): bool */ public function get(string $key, $defaultValue = null) { - return $this->has($key) ? $_SESSION[$key] : $defaultValue; + // Check to see if the session is running. + if ($this->isRunning()) { + return $this->has($key) ? $_SESSION[$key] : $defaultValue; + } } /** @@ -147,9 +199,16 @@ public function get(string $key, $defaultValue = null) */ public function flash(string $key, $defaultValue = null) { - $value = $this->get($key, $defaultValue); - $this->delete($key); - return $value; + // Check to see if the session is running. + if ($this->isRunning()) { + // Retrieve the session variable. + $value = $this->get($key, $defaultValue); + // Unset the session variable. + $this->delete($key); + // Return the value. + return $value; + } + return $defaultValue; } /** @@ -157,7 +216,11 @@ public function flash(string $key, $defaultValue = null) */ public function put(string $key, $value): void { - $_SESSION[$key] = $value; + // Check to see if the session is running. + if ($this->isRunning()) { + // Set a seasion variable. + $_SESSION[$key] = $value; + } } /** @@ -165,7 +228,11 @@ public function put(string $key, $value): void */ public function delete(string $key): void { - unset($_SESSION[$key]); + // Check to see if the session is running. + if ($this->isRunning()) { + // Unset the session variable. + unset($_SESSION[$key]); + } } /** diff --git a/src/SessionMiddleware.php b/src/SessionMiddleware.php index 8b13789..3bd9044 100644 --- a/src/SessionMiddleware.php +++ b/src/SessionMiddleware.php @@ -1 +1,78 @@ +session = $session; + } + + public function handle(callable $next) + { + // Start the session if not already started. + if ($this->session->isRunning()) { + // Validate the session fingerprint. + if ($this->session->fingerprintEnabled()) { + $fingerprint = $this->session->generateUniqueFingerprint(); + if ($this->session->has('cytrenna.fingerprint')) { + if (!hash_equals($this->session->has('cytrenna.fingerprint'), $fingerprint)) { + $this->session->stopSession(); + throw new InvalidFingerprintException('The fingerprint supplied is invalid.'); + } + } else { + $this->session->put('cytrenna.fingerprint', $fingerprint); + } + } + // Prevent AJAX requests. + if ($this->session->disallowAjaxRequests()) { + if ($this->session->isAjaxRequest()) { + throw new AjaxRestrictedException('This application does not allow ajax requests.'); + } + } + // Start the session. + $this->session->start(); + } + // Call the next middleware or controller. + $response = $next(); + // Returned the response. + return $response; + } +}