FileSessionHandler.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */
 
namespace ‪TYPO3\CMS\Install\Service\Session;
 
use ‪TYPO3\CMS\Core\Security\BlockSerializationTrait;
use ‪TYPO3\CMS\Core\Utility\GeneralUtility;
use ‪TYPO3\CMS\Install\Service\Exception;
 
class ‪FileSessionHandler implements \SessionHandlerInterface
{
    use ‪BlockSerializationTrait;
 
    private ‪$sessionPath = 'session/';
 
    private ‪$expirationTimeInMinutes = 60;
 
    public function ‪__construct(string ‪$sessionPath, int ‪$expirationTimeInMinutes)
    {
        $this->sessionPath = rtrim(‪$sessionPath, '/') . '/';
        $this->expirationTimeInMinutes = ‪$expirationTimeInMinutes;
        // Start our PHP session early so that hasSession() works
        session_save_path($this->‪getSessionSavePath());
    }
 
    private function ‪getSessionSavePath()
    {
        if (empty(‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'])) {
            throw new \TYPO3\CMS\Install\Exception(
                'No encryption key set to secure session',
                1371243449
            );
        }
        $sessionSavePath = $this->sessionPath . GeneralUtility::hmac('session:' . ‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey']);
        $this->‪ensureSessionSavePathExists($sessionSavePath);
        return $sessionSavePath;
    }
 
    private function ‪getSessionFile($id)
    {
        $sessionSavePath = $this->‪getSessionSavePath();
        return $sessionSavePath . '/hash_' . $this->‪getSessionHash($id);
    }
 
    public function ‪open($savePath, $sessionName)
    {
        return true;
    }
 
    public function ‪close()
    {
        return true;
    }
 
    public function ‪read($id)
    {
        $sessionFile = $this->‪getSessionFile($id);
        $content = '';
        if (file_exists($sessionFile)) {
            if ($fd = fopen($sessionFile, 'rb')) {
                $lockres = flock($fd, LOCK_SH);
                if ($lockres) {
                    $length = (int)filesize($sessionFile);
                    if ($length > 0) {
                        $content = (string)fread($fd, $length);
                    }
                    flock($fd, LOCK_UN);
                }
                fclose($fd);
            }
        }
        // Do a "test write" of the session file after opening it. The real session data is written in
        // __destruct() and we can not create a sane error message there anymore, so this test should fail
        // before if final session file can not be written due to permission problems.
        $this->‪write($id, $content);
        return $content;
    }
 
    public function ‪write($id, $sessionData)
    {
        $sessionFile = $this->‪getSessionFile($id);
        $result = false;
        $changePermissions = !@is_file($sessionFile);
        if ($fd = fopen($sessionFile, 'cb')) {
            if (flock($fd, LOCK_EX)) {
                ftruncate($fd, 0);
                $res = fwrite($fd, $sessionData);
                if ($res !== false) {
                    fflush($fd);
                    $result = true;
                }
                flock($fd, LOCK_UN);
            }
            fclose($fd);
            // Change the permissions only if the file has just been created
            if ($changePermissions) {
                ‪GeneralUtility::fixPermissions($sessionFile);
            }
        }
        if (!$result) {
            throw new Exception(
                'Session file not writable. Please check permission on ' .
                $this->sessionPath . ' and its subdirectories.',
                1424355157
            );
        }
        return $result;
    }
 
    public function ‪destroy($id): bool
    {
        $sessionFile = $this->‪getSessionFile($id);
        return @unlink($sessionFile);
    }
 
    public function ‪gc($maxLifeTime)
    {
        $sessionSavePath = $this->‪getSessionSavePath();
        $files = glob($sessionSavePath . '/hash_*');
        if (!is_array($files)) {
            return true;
        }
        foreach ($files as $filename) {
            if (filemtime($filename) + $this->expirationTimeInMinutes * 60 < time()) {
                @unlink($filename);
            }
        }
        return true;
    }
 
    public function ‪__destruct()
    {
        session_write_close();
    }
 
    public function ‪getSessionId()
    {
        return session_id();
    }
 
    private function ‪getSessionHash($sessionId = '')
    {
        if (empty(‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'])) {
            throw new \TYPO3\CMS\Install\Exception(
                'No encryption key set to secure session',
                1371243450
            );
        }
        if (!$sessionId) {
            $sessionId = $this->‪getSessionId();
        }
        return md5(‪$GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'] . '|' . $sessionId);
    }
 
    private function ‪ensureSessionSavePathExists($sessionSavePath)
    {
        if (!is_dir($sessionSavePath)) {
            try {
                ‪GeneralUtility::mkdir_deep($sessionSavePath);
            } catch (\RuntimeException $exception) {
                throw new \TYPO3\CMS\Install\Exception(
                    'Could not create session folder in ' . $this->sessionPath . '. Make sure it is writeable!',
                    1294587484
                );
            }
            $htaccessContent = '
# Apache < 2.3
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
    Satisfy All
</IfModule>
 
# Apache ≥ 2.3
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
            ';
            ‪GeneralUtility::writeFile($sessionSavePath . '/.htaccess', $htaccessContent);
            $indexContent = '<!DOCTYPE html>';
            $indexContent .= '<html><head><title></title><meta http-equiv=Refresh Content="0; Url=../../"/>';
            $indexContent .= '</head></html>';
            ‪GeneralUtility::writeFile($sessionSavePath . '/index.html', $indexContent);
        }
    }
}