CI框架SESSION重寫
阿新 • • 發佈:2017-06-17
new input count link manual eal automatic null ren
<?php
if
( ! defined(
‘BASEPATH‘
))
exit
(
‘No direct script access allowed‘
);
/**
* CodeIgniter
*
* An open source application development framework for PHP 5.1.6 or newer
*
* @package CodeIgniter
* @author EllisLab Dev Team
* @copyright Copyright (c) 2008 - 2014, EllisLab, Inc.
* @copyright Copyright (c) 2014 - 2015, British Columbia Institute of Technology (http://bcit.ca/)
* @license http://codeigniter.com/user_guide/license.html
* @link http://codeigniter.com
* @since Version 1.0
* @filesource
*/
// ------------------------------------------------------------------------
/**
* Session Class
*
* @package CodeIgniter
* @subpackage Libraries
* @category Sessions
* @author EllisLab Dev Team
* @link http://codeigniter.com/user_guide/libraries/sessions.html
*/
class
CI_Session {
var
$sess_encrypt_cookie
= FALSE;
var
$sess_use_database
= FALSE;
var
$sess_table_name
=
‘‘
;
var
$sess_expiration
= 7200;
var
$sess_expire_on_close
= FALSE;
var
$sess_match_ip
= FALSE;
var
$sess_match_useragent
= TRUE;
var
$sess_cookie_name
=
‘ci_session‘
;
var
$cookie_prefix
=
‘‘
;
var
$cookie_path
=
‘‘
;
var
$cookie_domain
=
‘‘
;
var
$cookie_secure
= FALSE;
var
$sess_time_to_update
= 300;
var
$encryption_key
=
‘‘
;
var
$flashdata_key
=
‘flash‘
;
var
$time_reference
=
‘time‘
;
var
$gc_probability
= 5;
var
$userdata
=
array
();
var
$CI
;
var
$now
;
/**
* Session Constructor
*
* The constructor runs the session routines automatically
* whenever the class is instantiated.
*/
public
function
__construct(
$params
=
array
())
{
log_message(
‘debug‘
,
"Session Class Initialized"
);
// Set the super object to a local variable for use throughout the class
$this
->CI =& get_instance();
// Set all the session preferences, which can either be set
// manually via the $params array above or via the config file
foreach
(
array
(
‘sess_encrypt_cookie‘
,
‘sess_use_database‘
,
‘sess_table_name‘
,
‘sess_expiration‘
,
‘sess_expire_on_close‘
,
‘sess_match_ip‘
,
‘sess_match_useragent‘
,
‘sess_cookie_name‘
,
‘cookie_path‘
,
‘cookie_domain‘
,
‘cookie_secure‘
,
‘sess_time_to_update‘
,
‘time_reference‘
,
‘cookie_prefix‘
,
‘encryption_key‘
)
as
$key
)
{
$this
->
$key
= (isset(
$params
[
$key
])) ?
$params
[
$key
] :
$this
->CI->config->item(
$key
);
}
if
(
$this
->encryption_key ==
‘‘
)
{
show_error(
‘In order to use the Session class you are required to set an encryption key in your config file.‘
);
}
// Load the string helper so we can use the strip_slashes() function
$this
->CI->load->helper(
‘string‘
);
// Do we need encryption? If so, load the encryption class
if
(
$this
->sess_encrypt_cookie == TRUE)
{
$this
->CI->load->library(
‘encrypt‘
);
}
// Are we using a database? If so, load it
if
(
$this
->sess_use_database === TRUE AND
$this
->sess_table_name !=
‘‘
)
{
$this
->CI->load->database();
}
// Set the "now" time. Can either be GMT or server time, based on the
// config prefs. We use this to set the "last activity" time
$this
->now =
$this
->_get_time();
// Set the session length. If the session expiration is
// set to zero we‘ll set the expiration two years from now.
if
(
$this
->sess_expiration == 0)
{
$this
->sess_expiration = (60*60*24*365*2);
}
// Set the cookie name
$this
->sess_cookie_name =
$this
->cookie_prefix.
$this
->sess_cookie_name;
// Run the Session routine. If a session doesn‘t exist we‘ll
// create a new one. If it does, we‘ll update it.
if
( !
$this
->sess_read())
{
$this
->sess_create();
}
else
{
$this
->sess_update();
}
// Delete ‘old‘ flashdata (from last request)
$this
->_flashdata_sweep();
// Mark all new flashdata as old (data will be deleted before next request)
$this
->_flashdata_mark();
// Delete expired sessions if necessary
$this
->_sess_gc();
log_message(
‘debug‘
,
"Session routines successfully run"
);
}
// --------------------------------------------------------------------
/**
* Fetch the current session data if it exists
*
* @access public
* @return bool
*/
function
sess_read()
{
// Fetch the cookie
$session
=
$this
->CI->input->cookie(
$this
->sess_cookie_name);
// No cookie? Goodbye cruel world!...
if
(
$session
=== FALSE)
{
log_message(
‘debug‘
,
‘A session cookie was not found.‘
);
return
FALSE;
}
// HMAC authentication
$len
=
strlen
(
$session
) - 40;
if
(
$len
<= 0)
{
log_message(
‘error‘
,
‘Session: The session cookie was not signed.‘
);
return
FALSE;
}
// Check cookie authentication
$hmac
=
substr
(
$session
,
$len
);
$session
=
substr
(
$session
, 0,
$len
);
// Time-attack-safe comparison
$hmac_check
= hash_hmac(
‘sha1‘
,
$session
,
$this
->encryption_key);
$diff
= 0;
for
(
$i
= 0;
$i
< 40;
$i
++)
{
$xor
= ord(
$hmac
[
$i
]) ^ ord(
$hmac_check
[
$i
]);
$diff
|=
$xor
;
}
if
(
$diff
!== 0)
{
log_message(
‘error‘
,
‘Session: HMAC mismatch. The session cookie data did not match what was expected.‘
);
$this
->sess_destroy();
return
FALSE;
}
// Decrypt the cookie data
if
(
$this
->sess_encrypt_cookie == TRUE)
{
$session
=
$this
->CI->encrypt->decode(
$session
);
}
// Unserialize the session array
$session
=
$this
->_unserialize(
$session
);
// Is the session data we unserialized an array with the correct format?
if
( !
is_array
(
$session
) OR ! isset(
$session
[
‘session_id‘
]) OR ! isset(
$session
[
‘ip_address‘
]) OR ! isset(
$session
[
‘user_agent‘
]) OR ! isset(
$session
[
‘last_activity‘
]))
{
$this
->sess_destroy();
return
FALSE;
}
// Is the session current?
if
((
$session
[
‘last_activity‘
] +
$this
->sess_expiration) <
$this
->now)
{
$this
->sess_destroy();
return
FALSE;
}
// Does the IP Match?
if
(
$this
->sess_match_ip == TRUE AND
$session
[
‘ip_address‘
] !=
$this
->CI->input->ip_address())
{
$this
->sess_destroy();
return
FALSE;
}
// Does the User Agent Match?
if
(
$this
->sess_match_useragent == TRUE AND trim(
$session
[
‘user_agent‘
]) != trim(
substr
(
$this
->CI->input->user_agent(), 0, 120)))
{
$this
->sess_destroy();
return
FALSE;
}
// Is there a corresponding session in the DB?
if
(
$this
->sess_use_database === TRUE)
{
$this
->CI->db->where(
‘session_id‘
,
$session
[
‘session_id‘
]);
if
(
$this
->sess_match_ip == TRUE)
{
$this
->CI->db->where(
‘ip_address‘
,
$session
[
‘ip_address‘
]);
}
if
(
$this
->sess_match_useragent == TRUE)
{
$this
->CI->db->where(
‘user_agent‘
,
$session
[
‘user_agent‘
]);
}
$query
=
$this
->CI->db->get(
$this
->sess_table_name);
// No result? Kill it!
if
(
$query
->num_rows() == 0)
{
$this
->sess_destroy();
return
FALSE;
}
// Is there custom data? If so, add it to the main session array
$row
=
$query
->row();
if
(isset(
$row
->user_data) AND
$row
->user_data !=
‘‘
)
{
$custom_data
=
$this
->_unserialize(
$row
->user_data);
if
(
is_array
(
$custom_data
))
{
foreach
(
$custom_data
as
$key
=>
$val
)
{
$session
[
$key
] =
$val
;
}
}
}
}
// Session is valid!
$this
->userdata =
$session
;
unset(
$session
);
return
TRUE;
}
// --------------------------------------------------------------------
/**
* Write the session data
*
* @access public
* @return void
*/
function
sess_write()
{
// Are we saving custom data to the DB? If not, all we do is update the cookie
if
(
$this
->sess_use_database === FALSE)
{
$this
->_set_cookie();
return
;
}
// set the custom userdata, the session data we will set in a second
$custom_userdata
=
$this
->userdata;
$cookie_userdata
=
array
();
// Before continuing, we need to determine if there is any custom data to deal with.
// Let‘s determine this by removing the default indexes to see if there‘s anything left in the array
// and set the session data while we‘re at it
foreach
(
array
(
‘session_id‘
,
‘ip_address‘
,
‘user_agent‘
,
‘last_activity‘
)
as
$val
)
{
unset(
$custom_userdata
[
$val
]);
$cookie_userdata
[
$val
] =
$this
->userdata[
$val
];
}
// Did we find any custom data? If not, we turn the empty array into a string
// since there‘s no reason to serialize and store an empty array in the DB
if
(
count
(
$custom_userdata
) === 0)
{
$custom_userdata
=
‘‘
;
}
else
{
// Serialize the custom data array so we can store it
$custom_userdata
=
$this
->_serialize(
$custom_userdata
);
}
// Run the update query
$this
->CI->db->where(
‘session_id‘
,
$this
->userdata[
‘session_id‘
]);
$this
->CI->db->update(
$this
->sess_table_name,
array
(
‘last_activity‘
=>
$this
->userdata[
‘last_activity‘
],
‘user_data‘
=>
$custom_userdata
));
// Write the cookie. Notice that we manually pass the cookie data array to the
// _set_cookie() function. Normally that function will store $this->userdata, but
// in this case that array contains custom data, which we do not want in the cookie.
$this
->_set_cookie(
$cookie_userdata
);
}
// --------------------------------------------------------------------
/**
* Create a new session
*
* @access public
* @return void
*/
function
sess_create()
{
$sessid
=
‘‘
;
while
(
strlen
(
$sessid
) < 32)
{
$sessid
.= mt_rand(0, mt_getrandmax());
}
// To make the session ID even more secure we‘ll combine it with the user‘s IP
$sessid
.=
$this
->CI->input->ip_address();
$this
->userdata =
array
(
‘session_id‘
=> md5(uniqid(
$sessid
, TRUE)),
‘ip_address‘
=>
$this
->CI->input->ip_address(),
‘user_agent‘
=>
substr
(
$this
->CI->input->user_agent(), 0, 120),
‘last_activity‘
=>
$this
->now,
‘user_data‘
=>
‘‘
);
// Save the data to the DB if needed
if
(
$this
->sess_use_database === TRUE)
{
$this
->CI->db->query(
$this
->CI->db->insert_string(
$this
->sess_table_name,
$this
->userdata));
}
// Write the cookie
$this
->_set_cookie();
}
// --------------------------------------------------------------------
/**
* Update an existing session
*
* @access public
* @return void
*/
function
sess_update()
{
// We only update the session every five minutes by default
if
(
$this
->CI->input->is_ajax_request() OR (
$this
->userdata[
‘last_activity‘
] +
$this
->sess_time_to_update) >=
$this
->now)
{
return
;
}
// Save the old session id so we know which record to
// update in the database if we need it
$old_sessid
=
$this
->userdata[
‘session_id‘
];
$new_sessid
=
‘‘
;
while
(
strlen
(
$new_sessid
) < 32)
{
$new_sessid
.= mt_rand(0, mt_getrandmax());
}
// To make the session ID even more secure we‘ll combine it with the user‘s IP
$new_sessid
.=
$this
->CI->input->ip_address();
// Turn it into a hash
$new_sessid
= md5(uniqid(
$new_sessid
, TRUE));
// Update the session data in the session data array
$this
->userdata[
‘session_id‘
] =
$new_sessid
;
$this
->userdata[
‘last_activity‘
] =
$this
->now;
// _set_cookie() will handle this for us if we aren‘t using database sessions
// by pushing all userdata to the cookie.
$cookie_data
= NULL;
// Update the session ID and last_activity field in the DB if needed
if
(
$this
->sess_use_database === TRUE)
{
// set cookie explicitly to only have our session data
$cookie_data
=
array
();
foreach
(
array
(
‘session_id‘
,
‘ip_address‘
,
‘user_agent‘
,
‘last_activity‘
)
as
$val
)
{
$cookie_data
[
$val
] =
$this
->userdata[
$val
];
}
$this
->CI->db->query(
$this
->CI->db->update_string(
$this
->sess_table_name,
array
(
‘last_activity‘
=>
$this
->now,
‘session_id‘
=>
$new_sessid
),
array
(
‘session_id‘
=>
$old_sessid
)));
}
// Write the cookie
$this
->_set_cookie(
$cookie_data
);
}
// --------------------------------------------------------------------
/**
* Destroy the current session
*
* @access public
* @return void
*/
function
sess_destroy()
{
// Kill the session DB row
if
(
$this
->sess_use_database === TRUE && isset(
$this
->userdata[
‘session_id‘
]))
{
$this
->CI->db->where(
‘session_id‘
,
$this
->userdata[
‘session_id‘
]);
$this
->CI->db->
delete
(
$this
->sess_table_name);
}
// Kill the cookie
setcookie(
$this
->sess_cookie_name,
addslashes
(serialize(
array
())),
(
$this
->now - 31500000),
$this
->cookie_path,
$this
->cookie_domain,
0
);
// Kill session data
$this
->userdata =
array
();
}
// --------------------------------------------------------------------
/**
* Fetch a specific item from the session array
*
* @access public
* @param string
* @return string
*/
function
userdata(
$item
)
{
return
( ! isset(
$this
->userdata[
$item
])) ? FALSE :
$this
->userdata[
$item
];
}
// --------------------------------------------------------------------
/**
* Fetch all session data
*
* @access public
* @return array
*/
function
all_userdata()
{
return
$this
->userdata;
}
// --------------------------------------------------------------------
/**
* Add or change data in the "userdata" array
*
* @access public
* @param mixed
* @param string
* @return void
*/
function
set_userdata(
$newdata
=
array
(),
$newval
=
‘‘
)
{
if
(
is_string
(
$newdata
))
{
$newdata
=
array
(
$newdata
=>
$newval
);
}
if
(
count
(
$newdata
) > 0)
{
foreach
(
$newdata
as
$key
=>
$val
)
{
$this
->userdata[
$key
] =
$val
;
}
}
$this
->sess_write();
}
// --------------------------------------------------------------------
/**
* Delete a session variable from the "userdata" array
*
* @access array
* @return void
*/
function
unset_userdata(
$newdata
=
array
())
{
if
(
is_string
(
$newdata
))
{
$newdata
=
array
(
$newdata
=>
‘‘
);
}
if
(
count
(
$newdata
) > 0)
{
foreach
(
$newdata
as
$key
=>
$val
)
{
unset(
$this
->userdata[
$key
]);
}
}
$this
->sess_write();
}
// ------------------------------------------------------------------------
/**
* Add or change flashdata, only available
* until the next request
*
* @access public
* @param mixed
* @param string
* @return void
*/
function
set_flashdata(
$newdata
=
array
(),
$newval
=
‘‘
)
{
if
(
is_string
(
$newdata
))
{
$newdata
=
array
(
$newdata
=>
$newval
);
}
if
(
count
(
$newdata
) > 0)
{
foreach
(
$newdata
as
$key
=>
$val
)
{
$flashdata_key
=
$this
->flashdata_key.
‘:new:‘
.
$key
;
$this
->set_userdata(
$flashdata_key
,
$val
);
}
}
}
// ------------------------------------------------------------------------
/**
* Keeps existing flashdata available to next request.
*
* @access public
* @param string
* @return void
*/
function
keep_flashdata(
$key
)
{
// ‘old‘ flashdata gets removed. Here we mark all
// flashdata as ‘new‘ to preserve it from _flashdata_sweep()
// Note the function will return FALSE if the $key
// provided cannot be found
$old_flashdata_key
=
$this
->flashdata_key.
‘:old:‘
.
$key
;
$value
=
$this
->userdata(
$old_flashdata_key
);
$new_flashdata_key
=
$this
->flashdata_key.
‘:new:‘
.
$key
;
$this
->set_userdata(
$new_flashdata_key
,
$value
);
}
// ------------------------------------------------------------------------
/**
* Fetch a specific flashdata item from the session array
*
* @access public
* @param string
* @return string
*/
function
flashdata(
$key
)
{
$flashdata_key
=
$this
->flashdata_key.
‘:old:‘
.
$key
;
return
$this
->userdata(
$flashdata_key
);
}
// ------------------------------------------------------------------------
/**
* Identifies flashdata as ‘old‘ for removal
* when _flashdata_sweep() runs.
*
* @access private
* @return void
*/
function
_flashdata_mark()
{
$userdata
=
$this
->all_userdata();
foreach
(
$userdata
as
$name
=>
$value
)
{
$parts
=
explode
(
‘:new:‘
,
$name
);
if
(
is_array
(
$parts
) &&
count
(
$parts
) === 2)
{
$new_name
=
$this
->flashdata_key.
‘:old:‘
.
$parts
[1];
$this
->set_userdata(
$new_name
,
$value
);
$this
->unset_userdata(
$name
);
}
}
}
// ------------------------------------------------------------------------
/**
* Removes all flashdata marked as ‘old‘
*
* @access private
* @return void
*/
function
_flashdata_sweep()
{
$userdata
=
$this
->all_userdata();
foreach
(
$userdata
as
$key
=>
$value
)
{
if
(
strpos
(
$key
,
‘:old:‘
))
{
$this
->unset_userdata(
$key
);
}
}
}
// --------------------------------------------------------------------
/**
* Get the "now" time
*
* @access private
* @return string
*/
function
_get_time()
{
if
(
strtolower
(
$this
->time_reference) ==
‘gmt‘
)
{
$now
= time();
$time
=
mktime
(
gmdate
(
"H"
,
$now
),
gmdate
(
"i"
,
$now
),
gmdate
(
"s"
,
$now
),
gmdate
(
"m"
,
$now
),
gmdate
(
"d"
,
$now
),
gmdate
(
"Y"
,
$now
));
}
else
{
$time
= time();
}
return
$time
;
}
// --------------------------------------------------------------------
/**
* Write the session cookie
*
* @access public
* @return void
*/
function
_set_cookie(
$cookie_data
= NULL)
{
if
(
is_null
(
$cookie_data
))
{
$cookie_data
=
$this
->userdata;
}
// Serialize the userdata for the cookie
$cookie_data
=
$this
->_serialize(
$cookie_data
);
if
(
$this
->sess_encrypt_cookie == TRUE)
{
$cookie_data
=
$this
->CI->encrypt->encode(
$cookie_data
);
}
$cookie_data
.= hash_hmac(
‘sha1‘
,
$cookie_data
,
$this
->encryption_key);
$expire
= (
$this
->sess_expire_on_close === TRUE) ? 0 :
$this
->sess_expiration + time();
// Set the cookie
setcookie(
$this
->sess_cookie_name,
$cookie_data
,
$expire
,
$this
->cookie_path,
$this
->cookie_domain,
$this
->cookie_secure
);
}
// --------------------------------------------------------------------
/**
* Serialize an array
*
* This function first converts any slashes found in the array to a temporary
* marker, so when it gets unserialized the slashes will be preserved
*
* @access private
* @param array
* @return string
*/
function
_serialize(
$data
)
{
if
(
is_array
(
$data
))
{
foreach
(
$data
as
$key
=>
$val
)
{
if
(
is_string
(
$val
))
{
$data
[
$key
] =
str_replace
(
‘\\‘
,
‘{{slash}}‘
,
$val
);
}
}
}
else
{
if
(
is_string
(
$data
))
{
$data
=
str_replace
(
‘\\‘
,
‘{{slash}}‘
,
$data
);
}
}
return
serialize(
$data
);
}
// --------------------------------------------------------------------
/**
* Unserialize
*
* This function unserializes a data string, then converts any
* temporary slash markers back to actual slashes
*
* @access private
* @param array
* @return string
*/
function
_unserialize(
$data
)
{
$data
= @unserialize(strip_slashes(
$data
));
if
(
is_array
(
$data
))
{
foreach
(
$data
as
$key
=>
$val
)
{
if
(
is_string
(
$val
))
{
$data
[
$key
] =
str_replace
(
‘{{slash}}‘
,
‘\\‘
,
$val
);
}
}
return
$data
;
}
return
(
is_string
(
$data
)) ?
str_replace
(
‘{{slash}}‘
,
‘\\‘
,
$data
) :
$data
;
}
// --------------------------------------------------------------------
/**
* Garbage collection
*
* This deletes expired session rows from database
* if the probability percentage is met
*
* @access public
* @return void
*/
function
_sess_gc()
{
if
(
$this
->sess_use_database != TRUE)
{
return
;
}
srand(time());
if
((rand() % 100) <
$this
->gc_probability)
{
$expire
=
$this
->now -
$this
->sess_expiration;
$this
->CI->db->where(
"last_activity < {$expire}"
);
$this
->CI->db->
delete
(
$this
->sess_table_name);
log_message(
‘debug‘
,
‘Session garbage collection performed.‘
);
}
}
}
// END Session Class
/* End of file Session.php */
/* Location: ./system/libraries/Session.php */
CI框架SESSION重寫