Mercurial > hg > fapweb
view msession.inc.php @ 1054:c050354b0270
Merged.
author | Matti Hamalainen <ccr@tnsp.org> |
---|---|
date | Sat, 21 Nov 2015 17:16:52 +0200 |
parents | ffacd904fd1f |
children | 7da8bde9b7be |
line wrap: on
line source
<? // // FAPWeb - Simple Web-based Demoparty Management System // Session management and authentication // (C) Copyright 2012-2015 Tecnic Software productions (TNSP) // define("SESS_USER", "user"); define("SESS_ADMIN", "admin"); if (function_exists("ini_set")) { // Use cookies to store the session ID on the client side @ini_set("session.use_only_cookies", 1); // Disable transparent Session ID support @ini_set("session.use_trans_sid", 0); } function stGetSpecSessionItem($stype, $name, $default = "") { if (isset($stype)) return (isset($_SESSION[$stype]) && isset($_SESSION[$stype][$name])) ? $_SESSION[$stype][$name] : $default; else return $default; } function stGetSessionItem($name, $default = "") { global $sessionType; return stGetSpecSessionItem($sessionType, $name, $default); } function stSetSessionItem($name, $value) { global $sessionType; if (!isset($sessionType)) die("Session type not set."); $_SESSION[$sessionType][$name] = $value; } function stSessionExpire($stype, $silent = FALSE) { // Check for session expiration if (!isset($_SESSION[$stype]) || !isset($_SESSION[$stype]["expires"])) { stDebug("Session ".$stype." expires due to expire time not set."); stSessionEnd($stype); return FALSE; } if ($_SESSION[$stype]["expires"] < time()) { stDebug("Session ".$stype." / ".session_id()." expires due to timeout ".$_SESSION[$stype]["expires"]." < ".time()); stSessionEnd($stype); return FALSE; } // Add more time to expiration $timeout = stGetSetting($_SESSION[$stype]["timeout"], 0); if (!$silent) stDebug("Adding more time to ".$stype." session ".session_id()." :: ".$timeout); $_SESSION[$stype]["expires"] = time() + $timeout * 60; return TRUE; } function stSessionEnd($stype) { $result = FALSE; stDebug("Request END session ".$stype); if (@session_start() === TRUE && isset($_SESSION)) { // End current session type if (isset($_SESSION[$stype])) { stDebug("END session ".$stype." / ".$_SESSION[$stype]["expires"]); $_SESSION[$stype] = array(); unset($_SESSION[$stype]); $result = TRUE; } // If all session types are ended, clear the cookies etc if (!isset($_SESSION[SESS_USER]) && !isset($_SESSION[SESS_ADMIN])) { stDebug("Clearing all session data."); $_SESSION = array(); if (ini_get("session.use_cookies")) { $params = session_get_cookie_params(); setcookie(session_name(), "", time() - 242000, $params["path"], $params["domain"], $params["secure"], $params["httponly"] ); } @session_destroy(); } } return $result; } function stSessionStart($stype, $key, $timeout) { if (@session_start() === TRUE) { stDebug("START ".$stype." session OK."); $_SESSION[$stype] = array( "key" => $key, "timeout" => $timeout, "expires" => time() + stGetSetting($timeout) * 60, "message" => "", "status" => 0, "csrfID" => hash("sha512", mt_rand(0, mt_getrandmax())), ); return TRUE; } else { stDebug("START ".$stype." session --FAILED--"); return FALSE; } } function stCSRFCheck() { if (stGetSetting("debug")) return TRUE; $csrfID = stGetRequestItem("csrfID", FALSE); return ($csrfID !== FALSE && stGetSessionItem("csrfID", FALSE) == $csrfID); } function stAdmSessionAuth($silent = FALSE) { if (@session_start() === TRUE && stGetSpecSessionItem(SESS_ADMIN, "key", FALSE) == stGetSetting("admPassword")) { if (!$silent) stDebug("AUTH admin session OK."); return stSessionExpire(SESS_ADMIN, $silent); } else { if (!$silent) stDebug("AUTH admin session FAIL."); return FALSE; } } function stUserSessionAuth($silent = FALSE) { if (@session_start() === TRUE && stGetSpecSessionItem(SESS_USER, "key", FALSE) !== FALSE) { if (!$silent) stDebug("AUTH user session OK."); return stSessionExpire(SESS_USER, $silent); } else { if (!$silent) stDebug("AUTH user session FAIL."); return FALSE; } } ?>