chamilo_session.class.php 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152
  1. <?php
  2. use Symfony\Component\HttpFoundation\Session\Session;
  3. use Symfony\Component\HttpFoundation\Session\Storage\PhpBridgeSessionStorage;
  4. /**
  5. * Chamilo session (i.e. the session that maintains the connection open after usr login)
  6. *
  7. * Usage:
  8. *
  9. *
  10. * use ChamiloSession as Session;
  11. *
  12. * Session::read('name');
  13. *
  14. * Or
  15. *
  16. * Chamilo::session()->...
  17. * session()->...
  18. *
  19. * @license see /license.txt
  20. * @author Laurent Opprecht <laurent@opprecht.info> for the Univesity of Geneva
  21. */
  22. /**
  23. * @todo use session symfony component
  24. * @todo replace all $_SESSION calls with this class.
  25. * @todo remove System\Session class
  26. * ChamiloSession class definition
  27. */
  28. class ChamiloSession extends System\Session
  29. {
  30. const NAME = 'ch_sid';
  31. /**
  32. * Generate new session instance
  33. * @return ChamiloSession
  34. */
  35. static function instance()
  36. {
  37. static $result = null;
  38. if (empty($result)) {
  39. $result = new ChamiloSession();
  40. }
  41. return $result;
  42. }
  43. /**
  44. * Returns the session lifetime
  45. * @return int The session lifetime as defined in the config file, in seconds
  46. */
  47. static function session_lifetime()
  48. {
  49. global $_configuration;
  50. return $_configuration['session_lifetime'];
  51. }
  52. /**
  53. * Starts the Chamilo session.
  54. *
  55. * The default lifetime for session is set here. It is not possible to have it
  56. * as a database setting as it is used before the database connection has been made.
  57. * It is taken from the configuration file, and if it doesn't exist there, it is set
  58. * to 360000 seconds
  59. *
  60. * @author Olivier Brouckaert
  61. * @param string variable - the variable name to save into the session
  62. * @return void
  63. */
  64. static function start($already_installed = true)
  65. {
  66. global $_configuration;
  67. /*
  68. * Prevent Session fixation bug fixes
  69. * See http://support.chamilo.org/issues/3600
  70. * http://php.net/manual/en/session.configuration.php
  71. * @todo use session_set_cookie_params with some custom admin parameters
  72. */
  73. //session.cookie_lifetime
  74. //the session ID is only accepted from a cookie
  75. ini_set('session.use_only_cookies', 1);
  76. //HTTPS only if possible
  77. //ini_set('session.cookie_secure', 1);
  78. //session ID in the cookie is only readable by the server
  79. ini_set('session.cookie_httponly', 1);
  80. //Use entropy file
  81. //session.entropy_file
  82. //ini_set('session.entropy_length', 128);
  83. //Do not include the identifier in the URL, and not to read the URL for
  84. // identifiers.
  85. ini_set('session.use_trans_sid', 0);
  86. session_name(self::NAME);
  87. session_start();
  88. $session = self::instance();
  89. if ($already_installed) {
  90. if (!isset($session['checkChamiloURL'])) {
  91. $session['checkChamiloURL'] = api_get_path(WEB_PATH);
  92. } elseif ($session['checkChamiloURL'] != api_get_path(WEB_PATH)) {
  93. self::clear();
  94. }
  95. }
  96. /*if (!$session->has('starttime') && !$session->is_expired()) {
  97. $session->write('starttime', time());
  98. }*/
  99. // If the session time has expired, refresh the starttime value,
  100. // so we're starting to count down from a later time
  101. if ( $session->has('starttime') && $session->is_expired()) {
  102. $session->destroy();
  103. } else {
  104. //error_log('Time not expired, extend session for a bit more');
  105. $session->write('starttime', time());
  106. }
  107. }
  108. /**
  109. * Session start time: that is the last time the user loaded a page (before this time)
  110. * @return int timestamp
  111. */
  112. function start_time()
  113. {
  114. return self::read('starttime');
  115. }
  116. /**
  117. * Session end time: when the session expires. This is made of the last page
  118. * load time + a number of seconds
  119. * @return int UNIX timestamp (server's timezone)
  120. */
  121. function end_time()
  122. {
  123. $start_time = $this->start_time();
  124. $lifetime = self::session_lifetime();
  125. return $start_time + $lifetime;
  126. }
  127. /**
  128. * Returns whether the session is expired
  129. * @return bool True if the session is expired, false if it is still valid
  130. */
  131. public function is_expired()
  132. {
  133. return $this->end_time() < time();
  134. }
  135. }