chamilo_session.class.php 6.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213
  1. <?php
  2. /**
  3. * Chamilo session (i.e. the session that maintains the connection open after usr login)
  4. *
  5. * Usage:
  6. *
  7. *
  8. * use ChamiloSession as Session;
  9. *
  10. * Session::read('name');
  11. *
  12. * Or
  13. *
  14. * Chamilo::session()->...
  15. * session()->...
  16. *
  17. * @license see /license.txt
  18. * @author Laurent Opprecht <laurent@opprecht.info> for the Univesity of Geneva
  19. */
  20. /**
  21. * ChamiloSession class definition
  22. */
  23. class ChamiloSession extends System\Session
  24. {
  25. const NAME = 'ch_sid';
  26. /**
  27. * Generate new session instance
  28. * @return ChamiloSession
  29. */
  30. static function instance()
  31. {
  32. static $result = null;
  33. if (empty($result)) {
  34. $result = new ChamiloSession();
  35. }
  36. return $result;
  37. }
  38. /**
  39. * Returns the session lifetime
  40. * @return int The session lifetime as defined in the config file, in seconds
  41. */
  42. static function session_lifetime()
  43. {
  44. global $_configuration;
  45. return $_configuration['session_lifetime'];
  46. }
  47. /**
  48. * Returns whether the sessions are stored in the database (or not)
  49. * @return bool True if session data are stored in the database, false if they're stored on disk
  50. * @assert (null) === false
  51. */
  52. static function session_stored_in_db()
  53. {
  54. return self::read('session_stored_in_db', false);
  55. }
  56. /**
  57. * Starts the Chamilo session.
  58. *
  59. * The default lifetime for session is set here. It is not possible to have it
  60. * as a database setting as it is used before the database connection has been made.
  61. * It is taken from the configuration file, and if it doesn't exist there, it is set
  62. * to 360000 seconds
  63. *
  64. * @author Olivier Brouckaert
  65. * @param string variable - the variable name to save into the session
  66. * @return void
  67. */
  68. static function start($already_installed = true)
  69. {
  70. global $_configuration;
  71. /* Causes too many problems and is not configurable dynamically.
  72. if ($already_installed) {
  73. $session_lifetime = 360000;
  74. if (isset($_configuration['session_lifetime'])) {
  75. $session_lifetime = $_configuration['session_lifetime'];
  76. }
  77. //session_set_cookie_params($session_lifetime,api_get_path(REL_PATH));
  78. }
  79. */
  80. if (self::session_stored_in_db() && function_exists('session_set_save_handler')) {
  81. $handler = new SessionHandler();
  82. @session_set_save_handler(
  83. array(& $handler, 'open'),
  84. array(& $handler, 'close'),
  85. array(& $handler, 'read'),
  86. array(& $handler, 'write'),
  87. array(& $handler, 'destroy'),
  88. array(& $handler, 'garbage')
  89. );
  90. }
  91. /*
  92. * Prevent Session fixation bug fixes
  93. * See http://support.chamilo.org/issues/3600
  94. * http://php.net/manual/en/session.configuration.php
  95. * @todo use session_set_cookie_params with some custom admin parameters
  96. */
  97. //session.cookie_lifetime
  98. //the session ID is only accepted from a cookie
  99. ini_set('session.use_only_cookies', 1);
  100. //HTTPS only if possible
  101. //ini_set('session.cookie_secure', 1);
  102. //session ID in the cookie is only readable by the server
  103. ini_set('session.cookie_httponly', 1);
  104. //Use entropy file
  105. //session.entropy_file
  106. //ini_set('session.entropy_length', 128);
  107. //Do not include the identifier in the URL, and not to read the URL for
  108. // identifiers.
  109. ini_set('session.use_trans_sid', 0);
  110. session_name(self::NAME);
  111. session_start();
  112. $session = self::instance();
  113. if ($already_installed) {
  114. if (!isset($session['checkChamiloURL'])) {
  115. $session['checkChamiloURL'] = api_get_path(WEB_PATH);
  116. } elseif ($session['checkChamiloURL'] != api_get_path(WEB_PATH)) {
  117. self::clear();
  118. }
  119. }
  120. /*if (!$session->has('starttime') && !$session->is_expired()) {
  121. $session->write('starttime', time());
  122. }*/
  123. // If the session time has expired, refresh the starttime value,
  124. // so we're starting to count down from a later time
  125. if ( $session->has('starttime') && $session->is_expired()) {
  126. error_log(microtime().' -- '.__LINE__);
  127. $session->destroy();
  128. } else {
  129. //error_log('Time not expired, extend session for a bit more');
  130. $session->write('starttime', time());
  131. }
  132. }
  133. /**
  134. * Session start time: that is the last time the user loaded a page (before this time)
  135. * @return int timestamp
  136. */
  137. function start_time()
  138. {
  139. return self::read('starttime');
  140. }
  141. /**
  142. * Session end time: when the session expires. This is made of the last page
  143. * load time + a number of seconds
  144. * @return int UNIX timestamp (server's timezone)
  145. */
  146. function end_time()
  147. {
  148. $start_time = $this->start_time();
  149. $lifetime = self::session_lifetime();
  150. return $start_time + $lifetime;
  151. }
  152. /**
  153. * Returns whether the session is expired
  154. * @return bool True if the session is expired, false if it is still valid
  155. */
  156. public function is_expired()
  157. {
  158. return $this->end_time() < time();
  159. }
  160. /**
  161. * The current (logged in) user.
  162. * @return CurrentUser The current user instance
  163. */
  164. public function user()
  165. {
  166. static $result = null;
  167. if (empty($result)) {
  168. $result = CurrentUser::instance();
  169. }
  170. return $result;
  171. }
  172. /**
  173. * Returns the current (active) course
  174. * @return CurrentCourse The current course instance
  175. */
  176. public function course()
  177. {
  178. static $result = null;
  179. if (empty($result)) {
  180. $result = CurrentCourse::instance();
  181. }
  182. return $result;
  183. }
  184. /**
  185. * The current group for the current (logged in) user.
  186. * @return int the current group id
  187. */
  188. public function group_id()
  189. {
  190. return Session::read('_gid');
  191. }
  192. }