From 827e7aead086cced3ee7a3e7ade82dcbe17ef7a8 Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Sat, 19 Apr 2014 19:12:58 +0200
Subject: [PATCH] Updated virtual session implementation and added option to
 disable it

---
 com.woltlab.wcf/option.xml                    |  5 ++
 .../files/lib/data/session/Session.class.php  |  2 +-
 .../virtual/SessionVirtualAction.class.php    |  8 ++-
 .../system/session/SessionHandler.class.php   | 52 +++++++++++--------
 .../install/files/lib/util/UserUtil.class.php |  3 ++
 wcfsetup/install/lang/de.xml                  |  2 +
 wcfsetup/install/lang/en.xml                  |  2 +
 7 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index 8768b66803..08f5a91c78 100644
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -468,6 +468,11 @@ imagick:wcf.acp.option.image_adapter_type.imagick]]>
 				<optiontype>boolean</optiontype>
 				<defaultvalue>1</defaultvalue>
 			</option>
+			<option name="session_enable_virtualization">
+				<categoryname>security.general.session</categoryname>
+				<optiontype>boolean</optiontype>
+				<defaultvalue>1</defaultvalue>
+			</option>
 			<!-- /general.session -->
 			
 			<!-- security.blacklist -->
diff --git a/wcfsetup/install/files/lib/data/session/Session.class.php b/wcfsetup/install/files/lib/data/session/Session.class.php
index ca548e49e2..f8e67f7aeb 100644
--- a/wcfsetup/install/files/lib/data/session/Session.class.php
+++ b/wcfsetup/install/files/lib/data/session/Session.class.php
@@ -35,7 +35,7 @@ class Session extends ACPSession {
 	 * @see	\wcf\data\acp\session\ACPSession::supportsVirtualSessions()
 	 */
 	public static function supportsVirtualSessions() {
-		return false;
+		return (SESSION_ENABLE_VIRTUALIZATION) ? true : false;
 	}
 	
 	/**
diff --git a/wcfsetup/install/files/lib/data/session/virtual/SessionVirtualAction.class.php b/wcfsetup/install/files/lib/data/session/virtual/SessionVirtualAction.class.php
index 577236a5d8..1ea3b5c4b4 100644
--- a/wcfsetup/install/files/lib/data/session/virtual/SessionVirtualAction.class.php
+++ b/wcfsetup/install/files/lib/data/session/virtual/SessionVirtualAction.class.php
@@ -1,6 +1,7 @@
 <?php
 namespace wcf\data\session\virtual;
 use wcf\data\AbstractDatabaseObjectAction;
+use wcf\util\UserUtil;
 
 /**
  * Executes virtual session-related actions.
@@ -26,12 +27,15 @@ class SessionVirtualAction extends AbstractDatabaseObjectAction {
 	 */
 	public function create() {
 		// try to find an existing virtual session
-		$virtualSession = call_user_func(array($this->className, 'getExistingSession'), $this->parameters['sessionID']);
+		$baseClass = call_user_func(array($this->className, 'getBaseClass'));
+		$virtualSession = call_user_func(array($baseClass, 'getExistingSession'), $this->parameters['data']['sessionID']);
 		if ($virtualSession !== null) {
 			return $virtualSession;
 		}
 		
-		if (!isset($this->parameters['lastActivityTime'])) $this->parameters['lastActivityTime'] = TIME_NOW;
+		if (!isset($this->parameters['data']['lastActivityTime'])) $this->parameters['data']['lastActivityTime'] = TIME_NOW;
+		if (!isset($this->parameters['data']['ipAddress'])) $this->parameters['data']['ipAddress'] = UserUtil::getIpAddress();
+		if (!isset($this->parameters['data']['userAgent'])) $this->parameters['data']['userAgent'] = UserUtil::getUserAgent();
 		
 		return parent::create();
 	}
diff --git a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
index d15375e3ee..63285c3648 100644
--- a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
@@ -119,13 +119,6 @@ class SessionHandler extends SingletonFactory {
 	 */
 	protected $virtualSession = false;
 	
-	/**
-	 * @see	\wcf\system\SingletonFactory::init()
-	 */
-	protected function init() {
-		$this->supportsVirtualSessions = call_user_func(array($this->sessionClassName, 'supportsVirtualSessions'));
-	}
-	
 	/**
 	 * Provides access to session data.
 	 * 
@@ -149,6 +142,7 @@ class SessionHandler extends SingletonFactory {
 	public function load($sessionEditorClassName, $sessionID) {
 		$this->sessionEditorClassName = $sessionEditorClassName;
 		$this->sessionClassName = call_user_func(array($sessionEditorClassName, 'getBaseClass'));
+		$this->supportsVirtualSessions = call_user_func(array($this->sessionClassName, 'supportsVirtualSessions'));
 		
 		// try to get existing session
 		if (!empty($sessionID)) {
@@ -347,7 +341,7 @@ class SessionHandler extends SingletonFactory {
 		if ($this->virtualSession === false || $forceReload) {
 			$this->virtualSession = null;
 			if ($this->user->userID && $this->supportsVirtualSessions) {
-				$virtualSessionAction = new SessionVirtualAction(array(), 'create', array('sessionID' => $this->session->sessionID));
+				$virtualSessionAction = new SessionVirtualAction(array(), 'create', array('data' => array('sessionID' => $this->session->sessionID)));
 				$this->virtualSession = $virtualSessionAction->executeAction();
 			}
 		}
@@ -419,20 +413,36 @@ class SessionHandler extends SingletonFactory {
 			call_user_func(array($this->sessionEditorClassName, 'deleteUserSessions'), array($this->user->userID));
 		}
 		
-		// save session
-		$sessionData = array(
-			'sessionID' => $sessionID,
-			'userID' => $this->user->userID,
-			'ipAddress' => UserUtil::getIpAddress(),
-			'userAgent' => UserUtil::getUserAgent(),
-			'lastActivityTime' => TIME_NOW,
-			'requestURI' => UserUtil::getRequestURI(),
-			'requestMethod' => (!empty($_SERVER['REQUEST_METHOD']) ? substr($_SERVER['REQUEST_METHOD'], 0, 7) : '')
-		);
+		$createNewSession = true;
+		if ($this->supportsVirtualSessions) {
+			// find existing session
+			$session = call_user_func(array($this->sessionClassName, 'getSessionByUserID'), $this->user->userID);
+			
+			if ($session !== null) {
+				// inherit existing session
+				$this->session = $session;
+				$this->loadVirtualSession(true);
+					
+				$createNewSession = false;
+			}
+		}
 		
-		if ($spiderID !== null) $sessionData['spiderID'] = $spiderID;
-		$this->session = call_user_func(array($this->sessionEditorClassName, 'create'), $sessionData);
-		$this->loadVirtualSession();
+		if ($createNewSession) {
+			// save session
+			$sessionData = array(
+				'sessionID' => $sessionID,
+				'userID' => $this->user->userID,
+				'ipAddress' => UserUtil::getIpAddress(),
+				'userAgent' => UserUtil::getUserAgent(),
+				'lastActivityTime' => TIME_NOW,
+				'requestURI' => UserUtil::getRequestURI(),
+				'requestMethod' => (!empty($_SERVER['REQUEST_METHOD']) ? substr($_SERVER['REQUEST_METHOD'], 0, 7) : '')
+			);
+			
+			if ($spiderID !== null) $sessionData['spiderID'] = $spiderID;
+			$this->session = call_user_func(array($this->sessionEditorClassName, 'create'), $sessionData);
+			$this->loadVirtualSession(true);
+		}
 	}
 	
 	/**
diff --git a/wcfsetup/install/files/lib/util/UserUtil.class.php b/wcfsetup/install/files/lib/util/UserUtil.class.php
index 3fbbc9c915..2b6c795091 100644
--- a/wcfsetup/install/files/lib/util/UserUtil.class.php
+++ b/wcfsetup/install/files/lib/util/UserUtil.class.php
@@ -137,6 +137,9 @@ final class UserUtil {
 	 * @return	string
 	 */
 	public static function convertIPv4To6($ip) {
+		// drop Window's scope id (confused PHP)
+		$ip = preg_replace('~%[^%]+$~', '', $ip);
+		
 		if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false) {
 			// given ip is already ipv6
 			return $ip;
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 0ccd6c3853..712f48435e 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -678,6 +678,8 @@
 		<item name="wcf.acp.option.session_validate_ip_address"><![CDATA[IP-Adresse der Sitzung überprüfen]]></item>
 		<item name="wcf.acp.option.session_validate_ip_address.description"><![CDATA[Eine Aktivierung dieser Einstellung kann Benutzer ausschließen, die mit wechselnden IP-Adressen im Internet unterwegs sind.]]></item>
 		<item name="wcf.acp.option.session_validate_user_agent"><![CDATA[Browser-Kennung der Sitzung überprüfen]]></item>
+		<item name="wcf.acp.option.session_enable_virtualization"><![CDATA[Virtuelle Sessions erlauben]]></item>
+		<item name="wcf.acp.option.session_enable_virtualization.description"><![CDATA[Benutzer können sich mit mehreren Endgeräten (PC, Tablet, Smartphone, etc.) gleichzeitig anmelden, alle Geräte nutzen dann die selbe Sitzung. Die Abschaltung dieser Option hat zur Folge, dass ein Benutzer nur von einem einzigen Gerät gleichzeitig angemeldet sein darf und sich unter Umständen die Geräte auf diese Weise gegenseitig ausloggen. Die Deaktivierung dieser Option wird nicht empfohlen und sollte nur vorgenommen werden, wenn Sie sich der Konsequenzen bewusst sind.]]></item>
 		<item name="wcf.acp.option.show_clock"><![CDATA[Aktuelle Uhrzeit im Fußbereich der Seite anzeigen]]></item>
 		<item name="wcf.acp.option.timezone"><![CDATA[Zeitzone]]></item>
 		<item name="wcf.acp.option.timezone.description"><![CDATA[Standard-Zeitzone Ihrer Seite]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index a7ab28a711..a145f4efdf 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -677,6 +677,8 @@ Examples for medium ID detection:
 		<item name="wcf.acp.option.session_validate_ip_address"><![CDATA[Validate IP address]]></item>
 		<item name="wcf.acp.option.session_validate_ip_address.description"><![CDATA[Enabling this validation might cause troubles for users with rotating IP addresses.]]></item>
 		<item name="wcf.acp.option.session_validate_user_agent"><![CDATA[Validate user-agent]]></item>
+		<item name="wcf.acp.option.session_enable_virtualization"><![CDATA[Allow session sharing]]></item>
+		<item name="wcf.acp.option.session_enable_virtualization.description"><![CDATA[Users can log-in from multiple devices (PC, tablet, smartphone, etc) concurrently, all devices will share the same session. Disabling this option will restrict users to be logged-in with only one device at once, causing every login to terminate sessions used by the user’s other devices. It is not recommended to disable this option and you should be well aware of the consequences if you decide to disable it.]]></item>
 		<item name="wcf.acp.option.show_clock"><![CDATA[Show current time in page footer]]></item>
 		<item name="wcf.acp.option.timezone"><![CDATA[Timezone]]></item>
 		<item name="wcf.acp.option.timezone.description"><![CDATA[Default timezone of your page]]></item>
-- 
2.20.1