chamilo_session.class.php 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201
  1. <?php
  2. /**
  3. * Chamilo session.
  4. *
  5. * Usage:
  6. *
  7. *
  8. * use ChamiloSession as Session;
  9. *
  10. * Session::read('name');
  11. *
  12. * Or
  13. *
  14. * Chamilo::session()->...
  15. * session()->...
  16. *
  17. * @license see /license.txt
  18. * @author Laurent Opprecht <laurent@opprecht.info> for the Univesity of Geneva
  19. */
  20. class ChamiloSession extends System\Session
  21. {
  22. const NAME = 'ch_sid';
  23. /**
  24. *
  25. * @return ChamiloSession
  26. */
  27. static function instance()
  28. {
  29. static $result = null;
  30. if (empty($result)) {
  31. $result = new ChamiloSession();
  32. }
  33. return $result;
  34. }
  35. static function session_lifetime()
  36. {
  37. global $_configuration;
  38. return $_configuration['session_lifetime'];
  39. }
  40. static function session_stored_in_db()
  41. {
  42. return self::read('session_stored_in_db', false);
  43. }
  44. /**
  45. * Starts the Chamilo session.
  46. *
  47. * The default lifetime for session is set here. It is not possible to have it
  48. * as a database setting as it is used before the database connection has been made.
  49. * It is taken from the configuration file, and if it doesn't exist there, it is set
  50. * to 360000 seconds
  51. *
  52. * @author Olivier Brouckaert
  53. * @param string variable - the variable name to save into the session
  54. */
  55. static function start($already_installed = true)
  56. {
  57. global $_configuration;
  58. /* Causes too many problems and is not configurable dynamically.
  59. if ($already_installed) {
  60. $session_lifetime = 360000;
  61. if (isset($_configuration['session_lifetime'])) {
  62. $session_lifetime = $_configuration['session_lifetime'];
  63. }
  64. //session_set_cookie_params($session_lifetime,api_get_path(REL_PATH));
  65. }
  66. */
  67. if (self::session_stored_in_db() && function_exists('session_set_save_handler')) {
  68. $handler = new SessionHandler();
  69. @session_set_save_handler(array(& $handler, 'open'), array(& $handler, 'close'), array(& $handler, 'read'), array(& $handler, 'write'), array(& $handler, 'destroy'), array(& $handler, 'garbage'));
  70. }
  71. /*
  72. * Prevent Session fixation bug fixes
  73. * See http://support.chamilo.org/issues/3600
  74. * http://php.net/manual/en/session.configuration.php
  75. * @todo use session_set_cookie_params with some custom admin parameters
  76. */
  77. //session.cookie_lifetime
  78. //the session ID is only accepted from a cookie
  79. ini_set('session.use_only_cookies', 1);
  80. //HTTPS only if possible
  81. //ini_set('session.cookie_secure', 1);
  82. //session ID in the cookie is only readable by the server
  83. ini_set('session.cookie_httponly', 1);
  84. //Use entropy file
  85. //session.entropy_file
  86. //ini_set('session.entropy_length', 128);
  87. //Do not include the identifier in the URL, and not to read the URL for identifiers.
  88. ini_set('session.use_trans_sid', 0);
  89. session_name(self::NAME);
  90. session_start();
  91. $session = self::instance();
  92. if ($already_installed) {
  93. if (!isset($session['checkChamiloURL'])) {
  94. $session['checkChamiloURL'] = api_get_path(WEB_PATH);
  95. } else if ($session['checkChamiloURL'] != api_get_path(WEB_PATH)) {
  96. self::clear();
  97. }
  98. }
  99. if (!$session->has('starttime') || $session->is_valid()) {
  100. $session->write('starttime', time());
  101. }
  102. }
  103. /**
  104. * Session start time: that is the last time the user accesseed the application.
  105. *
  106. * @return int timestamp
  107. */
  108. function start_time()
  109. {
  110. return self::read('starttime');
  111. }
  112. /**
  113. * Session end time: when the session expires.
  114. *
  115. * @return int timestamp
  116. */
  117. function end_time()
  118. {
  119. $start_time = $this->start_time();
  120. $lifetime = self::session_lifetime();
  121. return $start_time + $lifetime;
  122. }
  123. /**
  124. * Returns true if the session is stalled. I.e. if session end time is
  125. * greater than now. Returns false otherwise.
  126. *
  127. * @return bool
  128. */
  129. function is_stalled()
  130. {
  131. return $this->end_time() >= time();
  132. }
  133. /**
  134. * Returns true if the session is valid - if it is not stalled - false otherwise.
  135. * @return bool
  136. */
  137. public function is_valid()
  138. {
  139. return !$this->is_stalled();
  140. }
  141. /**
  142. * The current (logged in) user.
  143. *
  144. * @return CurrentUser
  145. */
  146. public function user()
  147. {
  148. static $result = null;
  149. if (empty($result)) {
  150. $result = CurrentUser::instance();
  151. }
  152. return $result;
  153. }
  154. /**
  155. *
  156. * @return CurrentCourse
  157. */
  158. public function course()
  159. {
  160. static $result = null;
  161. if (empty($result)) {
  162. $result = CurrentCourse::instance();
  163. }
  164. return $result;
  165. }
  166. /**
  167. * The current group for the current (logged in) user.
  168. *
  169. * @return int
  170. */
  171. public function group_id()
  172. {
  173. return Session::read('_gid');
  174. }
  175. }