wcfsetup/install/files/lib/action/DeleteSessionAction.class.php

   1 <?php
   2
   3 namespace wcf\action;
   4
   5 use wcf\system\exception\IllegalLinkException;
   6 use wcf\system\session\SessionHandler;
   7 use wcf\system\WCF;
   8 use wcf\util\JSON;
   9 use wcf\util\StringUtil;
  10
  11 /**
  12  * Deletes a specific user session.
  13  *
  14  * @author  Joshua Ruesweg
  15  * @copyright   2001-2020 WoltLab GmbH
  16  * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
  17  * @package WoltLabSuite\Core\Action
  18  */
  19 class DeleteSessionAction extends AbstractAction
  20 {
  21     /**
  22      * @inheritDoc
  23      */
  24     public $loginRequired = true;
  25
  26     /**
  27      * @var string
  28      */
  29     private $sessionID;
  30
  31     /**
  32      * @inheritDoc
  33      */
  34     public function readParameters()
  35     {
  36         parent::readParameters();
  37
  38         if (isset($_POST['sessionID'])) {
  39             $this->sessionID = StringUtil::trim($_POST['sessionID']);
  40         }
  41
  42         if (empty($this->sessionID)) {
  43             throw new IllegalLinkException();
  44         }
  45
  46         $found = false;
  47         foreach (SessionHandler::getInstance()->getUserSessions(WCF::getUser()) as $session) {
  48             if ($session->getSessionID() === $this->sessionID) {
  49                 $found = true;
  50                 break;
  51             }
  52         }
  53
  54         if (!$found) {
  55             throw new IllegalLinkException();
  56         }
  57     }
  58
  59     /**
  60      * @inheritDoc
  61      */
  62     public function execute()
  63     {
  64         parent::execute();
  65
  66         SessionHandler::getInstance()->deleteUserSession($this->sessionID);
  67
  68         $this->executed();
  69
  70         // send JSON-encoded response
  71         \header('Content-type: application/json');
  72         echo JSON::encode([
  73             'sessionID' => $this->sessionID,
  74         ]);
  75
  76         exit;
  77     }
  78 }