WebSVN – lars-tiefland.ci – Diff – /system/libraries/Session/drivers/Session_database_driver.php

+ *
  * An open source application development framework for PHP
+ *
  * This content is released under the MIT License (MIT)
+ *
- * Copyright (c) 2014 - 2018, British Columbia Institute of Technology
+ * Copyright (c) 2014 - 2019, British Columbia Institute of Technology
+ *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
  * in the Software without restriction, including without limitation the rights
  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  * THE SOFTWARE.
+ *
  * @package	CodeIgniter
  * @author	EllisLab Dev Team
  * @copyright	Copyright (c) 2008 - 2014, EllisLab, Inc. (https://ellislab.com/)
- * @copyright	Copyright (c) 2014 - 2018, British Columbia Institute of Technology (http://bcit.ca/)
+ * @copyright	Copyright (c) 2014 - 2019, British Columbia Institute of Technology (https://bcit.ca/)
- * @license	http://opensource.org/licenses/MIT	MIT License
+ * @license	https://opensource.org/licenses/MIT	MIT License
  * @link	https://codeigniter.com
  * @since	Version 3.0.0
  * @filesource
  */
 defined('BASEPATH') OR exit('No direct script access allowed');
 	 */
 	public function open($save_path, $name)
+	{
 		if (empty($this->_db->conn_id) && ! $this->_db->db_connect())
+		{
-			return $this->_fail();
+			return $this->_failure;
+		}
+		$this->php5_validate_id();
 		return $this->_success;
+	}
 	 * @param	string	$session_id	Session ID
 	 * @return	string	Serialized session data
 	 */
 	public function read($session_id)
+	{
-		if ($this->_get_lock($session_id) !== FALSE)
+		if ($this->_get_lock($session_id) === FALSE)
+		{
-			// Prevent previous QB calls from messing with our queries
-			$this->_db->reset_query();
+			return $this->_failure;
+		}
-			// Needed by write() to detect session_regenerate_id() calls
+		// Prevent previous QB calls from messing with our queries
-			$this->_session_id = $session_id;
-			$this->_db
+		$this->_db->reset_query();
-				->select('data')
+		// Needed by write() to detect session_regenerate_id() calls
+		$this->_session_id = $session_id;
-				->from($this->_config['save_path'])
-				->where('id', $session_id);
+		$this->_db
-			if ($this->_config['match_ip'])
-			{
+			->select('data')
-				$this->_db->where('ip_address', $_SERVER['REMOTE_ADDR']);
+			->from($this->_config['save_path'])
-			}
-			if ( ! ($result = $this->_db->get()) OR ($result = $result->row()) === NULL)
-			{
-				// PHP7 will reuse the same SessionHandler object after
+			->where('id', $session_id);
-				// ID regeneration, so we need to explicitly set this to
-				// FALSE instead of relying on the default ...
-				$this->_row_exists = FALSE;
+		if ($this->_config['match_ip'])
+		{
-				$this->_fingerprint = md5('');
+			$this->_db->where('ip_address', $_SERVER['REMOTE_ADDR']);
-				return '';
-			}
+		}
-			// PostgreSQL's variant of a BLOB datatype is Bytea, which is a
+		if ( ! ($result = $this->_db->get()) OR ($result = $result->row()) === NULL)
-			// PITA to work with, so we use base64-encoded data in a TEXT
-			// field instead.
+		{
-			$result = ($this->_platform === 'postgre')
-				? base64_decode(rtrim($result->data))
+			// PHP7 will reuse the same SessionHandler object after
-				: $result->data;
+			// ID regeneration, so we need to explicitly set this to
+			// FALSE instead of relying on the default ...
+			$this->_row_exists = FALSE;
+			$this->_fingerprint = md5('');
+			return '';
+		}
+		// PostgreSQL's variant of a BLOB datatype is Bytea, which is a
+		// PITA to work with, so we use base64-encoded data in a TEXT
+		// field instead.
-			$this->_fingerprint = md5($result);
+		$result = ($this->_platform === 'postgre')
-			$this->_row_exists = TRUE;
+			? base64_decode(rtrim($result->data))
-			return $result;
+			: $result->data;
 		// Was the ID regenerated?
 		if (isset($this->_session_id) && $session_id !== $this->_session_id)
+		{
 			if ( ! $this->_release_lock() OR ! $this->_get_lock($session_id))
+			{
-				return $this->_fail();
+				return $this->_failure;
+			}
 			$this->_row_exists = FALSE;
 			$this->_session_id = $session_id;
+		}
 		elseif ($this->_lock === FALSE)
 		{
-			return $this->_fail();
+			return $this->_failure;
+		}
 		if ($this->_row_exists === FALSE)
 				$this->_fingerprint = md5($session_data);
 				$this->_row_exists = TRUE;
 				return $this->_success;
+			}
-			return $this->_fail();
+			return $this->_failure;
+		}
 		$this->_db->where('id', $session_id);
+		{
 			$this->_fingerprint = md5($session_data);
 			return $this->_success;
+		}
-		return $this->_fail();
+		return $this->_failure;
+	}
 	 * @return	bool
 	 */
 	public function close()
+	{
 		return ($this->_lock && ! $this->_release_lock())
-			? $this->_fail()
+			? $this->_failure
 			: $this->_success;
+	}
 				$this->_db->where('ip_address', $_SERVER['REMOTE_ADDR']);
+			}
 			if ( ! $this->_db->delete($this->_config['save_path']))
 			{
-				return $this->_fail();
+				return $this->_failure;
+			}
+		}
 		if ($this->close() === $this->_success)
+		{
 			$this->_cookie_destroy();
 			return $this->_success;
+		}
-		return $this->_fail();
+		return $this->_failure;
 		// Prevent previous QB calls from messing with our queries
 		$this->_db->reset_query();
 		return ($this->_db->delete($this->_config['save_path'], 'timestamp < '.(time() - $maxlifetime)))
 			? $this->_success
+			: $this->_failure;
+	}
+	// --------------------------------------------------------------------
+	/**
+	 * Validate ID
+	 *
+	 * Checks whether a session ID record exists server-side,
+	 * to enforce session.use_strict_mode.
+	 *
+	 * @param	string	$id
+	 * @return	bool
+	 */
+	public function validateSessionId($id)
+	{
+		// Prevent previous QB calls from messing with our queries
+		$this->_db->reset_query();
+		$this->_db->select('1')->from($this->_config['save_path'])->where('id', $id);
+		empty($this->_config['match_ip']) OR $this->_db->where('ip_address', $_SERVER['REMOTE_ADDR']);
+		$result = $this->_db->get();
+		empty($result) OR $result = $result->row();
-			: $this->_fail();
+		return ! empty($result);
+	}

Subversion-Projekte lars-tiefland.ci

(root)/system/libraries/Session/drivers/Session_database_driver.php – Revision 2257 → 2414