Subversion-Projekte lars-tiefland.ci

Revision

Revision 68 | Revision 2049 | Zur aktuellen Revision | Ganze Datei anzeigen | Leerzeichen ignorieren | Details | Blame | Letzte Änderung | Log anzeigen | RSS feed

Revision 68 Revision 1257
Zeile 55... Zeile 55...
55 
	 */
 55 
	 */
56 
	public $userdata;
 56 
	public $userdata;
Zeile 57... Zeile 57...
57 
 
 57 
 
58 
	protected $_driver = 'files';
 58 
	protected $_driver = 'files';
- 
 
 59 
	protected $_config;
Zeile 59... Zeile 60...
59 
	protected $_config;
 60 
	protected $_sid_regexp;
Zeile 60... Zeile 61...
60 
 
 61 
 
61 
	// ------------------------------------------------------------------------
 62 
	// ------------------------------------------------------------------------
Zeile 97... Zeile 98...
97 
 
 98 
 
Zeile 98... Zeile 99...
98 
		$class = $this->_ci_load_classes($this->_driver);
 99 
		$class = $this->_ci_load_classes($this->_driver);
99 
 
 100 
 
- 
 
 101 
		// Configuration ...
Zeile 100... Zeile 102...
100 
		// Configuration ...
 102 
		$this->_configure($params);
101 
		$this->_configure($params);
 103 
		$this->_config['_sid_regexp'] = $this->_sid_regexp;
102 
 
 104 
 
103 
		$class = new $class($this->_config);
 105 
		$class = new $class($this->_config);
Zeile 129... Zeile 131...
129 
 
 131 
 
130 
		// Sanitize the cookie, because apparently PHP doesn't do that for userspace handlers
 132 
		// Sanitize the cookie, because apparently PHP doesn't do that for userspace handlers
131 
		if (isset($_COOKIE[$this->_config['cookie_name']])
 133 
		if (isset($_COOKIE[$this->_config['cookie_name']])
132 
			&& (
 134 
			&& (
133 
				! is_string($_COOKIE[$this->_config['cookie_name']])
 135 
				! is_string($_COOKIE[$this->_config['cookie_name']])
134 
				OR ! preg_match('/^[0-9a-f]{40}$/', $_COOKIE[$this->_config['cookie_name']])
 136 
				OR ! preg_match('#\A'.$this->_sid_regexp.'\z#', $_COOKIE[$this->_config['cookie_name']])
135 
			)
 137 
			)
136 
		)
 138 
		)
137 
		{
 139 
		{
138 
			unset($_COOKIE[$this->_config['cookie_name']]);
 140 
			unset($_COOKIE[$this->_config['cookie_name']]);
Zeile 313... Zeile 315...
313 
		// Security is king
 315 
		// Security is king
314 
		ini_set('session.use_trans_sid', 0);
 316 
		ini_set('session.use_trans_sid', 0);
315 
		ini_set('session.use_strict_mode', 1);
 317 
		ini_set('session.use_strict_mode', 1);
316 
		ini_set('session.use_cookies', 1);
 318 
		ini_set('session.use_cookies', 1);
317 
		ini_set('session.use_only_cookies', 1);
 319 
		ini_set('session.use_only_cookies', 1);
- 
 
 320 
 
- 
 
 321 
		$this->_configure_sid_length();
- 
 
 322 
	}
- 
 
 323 
 
- 
 
 324 
	// ------------------------------------------------------------------------
- 
 
 325 
 
- 
 
 326 
	/**
- 
 
 327 
	 * Configure session ID length
- 
 
 328 
	 *
- 
 
 329 
	 * To make life easier, we used to force SHA-1 and 4 bits per
- 
 
 330 
	 * character on everyone. And of course, someone was unhappy.
- 
 
 331 
	 *
- 
 
 332 
	 * Then PHP 7.1 broke backwards-compatibility because ext/session
- 
 
 333 
	 * is such a mess that nobody wants to touch it with a pole stick,
- 
 
 334 
	 * and the one guy who does, nobody has the energy to argue with.
- 
 
 335 
	 *
- 
 
 336 
	 * So we were forced to make changes, and OF COURSE something was
- 
 
 337 
	 * going to break and now we have this pile of shit. -- Narf
- 
 
 338 
	 *
- 
 
 339 
	 * @return	void
- 
 
 340 
	 */
- 
 
 341 
	protected function _configure_sid_length()
- 
 
 342 
	{
- 
 
 343 
		if (PHP_VERSION_ID < 70100)
- 
 
 344 
		{
- 
 
 345 
			$hash_function = ini_get('session.hash_function');
- 
 
 346 
			if (ctype_digit($hash_function))
- 
 
 347 
			{
- 
 
 348 
				if ($hash_function !== '1')
- 
 
 349 
				{
- 
 
 350 
					ini_set('session.hash_function', 1);
- 
 
 351 
				}
- 
 
 352 
 
- 
 
 353 
				$bits = 160;
- 
 
 354 
			}
- 
 
 355 
			elseif ( ! in_array($hash_function, hash_algos(), TRUE))
- 
 
 356 
			{
318 
		ini_set('session.hash_function', 1);
 357 
				ini_set('session.hash_function', 1);
- 
 
 358 
				$bits = 160;
- 
 
 359 
			}
- 
 
 360 
			elseif (($bits = strlen(hash($hash_function, 'dummy', false)) * 4) < 160)
- 
 
 361 
			{
319 
		ini_set('session.hash_bits_per_character', 4);
 362 
				ini_set('session.hash_function', 1);
- 
 
 363 
				$bits = 160;
- 
 
 364 
			}
- 
 
 365 
 
- 
 
 366 
			$bits_per_character = (int) ini_get('session.hash_bits_per_character');
- 
 
 367 
			$sid_length         = (int) ceil($bits / $bits_per_character);
- 
 
 368 
		}
- 
 
 369 
		else
- 
 
 370 
		{
- 
 
 371 
			$bits_per_character = (int) ini_get('session.sid_bits_per_character');
- 
 
 372 
			$sid_length         = (int) ini_get('session.sid_length');
- 
 
 373 
			if (($bits = $sid_length * $bits_per_character) < 160)
- 
 
 374 
			{
- 
 
 375 
				// Add as many more characters as necessary to reach at least 160 bits
- 
 
 376 
				$sid_length += (int) ceil((160 % $bits) / $bits_per_character);
- 
 
 377 
				ini_set('session.sid_length', $sid_length);
- 
 
 378 
			}
- 
 
 379 
		}
- 
 
 380 
 
- 
 
 381 
		// Yes, 4,5,6 are the only known possible values as of 2016-10-27
- 
 
 382 
		switch ($bits_per_character)
- 
 
 383 
		{
- 
 
 384 
			case 4:
- 
 
 385 
				$this->_sid_regexp = '[0-9a-f]';
- 
 
 386 
				break;
- 
 
 387 
			case 5:
- 
 
 388 
				$this->_sid_regexp = '[0-9a-v]';
- 
 
 389 
				break;
- 
 
 390 
			case 6:
- 
 
 391 
				$this->_sid_regexp = '[0-9a-zA-Z,-]';
- 
 
 392 
				break;
- 
 
 393 
		}
- 
 
 394 
 
- 
 
 395 
		$this->_sid_regexp .= '{'.$sid_length.'}';
320 
	}
 396 
	}
Zeile 321... Zeile 397...
321 
 
 397 
 
Zeile 322... Zeile 398...
322 
	// ------------------------------------------------------------------------
 398 
	// ------------------------------------------------------------------------