3 namespace wcf\system\session
;
5 use ParagonIE\ConstantTime\Hex
;
6 use wcf\data\session\Session
as LegacySession
;
7 use wcf\data\session\SessionEditor
;
8 use wcf\data\user\User
;
9 use wcf\data\user\UserEditor
;
10 use wcf\system\application\ApplicationHandler
;
11 use wcf\system\cache\builder\SpiderCacheBuilder
;
12 use wcf\system\cache\builder\UserGroupOptionCacheBuilder
;
13 use wcf\system\cache\builder\UserGroupPermissionCacheBuilder
;
14 use wcf\system\database\DatabaseException
;
15 use wcf\system\database\util\PreparedStatementConditionBuilder
;
16 use wcf\system\event\EventHandler
;
17 use wcf\system\exception\PermissionDeniedException
;
18 use wcf\system\page\PageLocationManager
;
19 use wcf\system\request\RouteHandler
;
20 use wcf\system\SingletonFactory
;
21 use wcf\system\user\storage\UserStorageHandler
;
23 use wcf\system\WCFACP
;
24 use wcf\util\CryptoUtil
;
25 use wcf\util\HeaderUtil
;
26 use wcf\util\UserUtil
;
31 * @author Tim Duesterhus, Alexander Ebert
32 * @copyright 2001-2020 WoltLab GmbH
33 * @license GNU Lesser General Public License <http://opensource.org/licenses/lgpl-license.php>
34 * @package WoltLabSuite\Core\System\Session
36 * @property-read string $sessionID unique textual identifier of the session
37 * @property-read int|null $userID id of the user the session belongs to or `null` if the session belongs to a guest
38 * @property-read int|null $pageID id of the latest page visited
39 * @property-read int|null $pageObjectID id of the object the latest page visited belongs to
40 * @property-read int|null $parentPageID id of the parent page of latest page visited
41 * @property-read int|null $parentPageObjectID id of the object the parent page of latest page visited belongs to
42 * @property-read int $spiderID id of the spider the session belongs to
44 final class SessionHandler
extends SingletonFactory
47 * prevents update on shutdown
50 protected $doNotUpdate = false;
53 * disables page tracking
56 protected $disableTracking = false;
59 * group data and permissions
65 * true if within ACP or WCFSetup
68 protected $isACP = false;
71 * language id for active user
74 protected $languageID = 0;
77 * language ids for active user
80 protected $languageIDs;
90 protected $legacySession;
108 protected $variables = [];
111 * indicates if session variables changed and must be saved upon shutdown
114 protected $variablesChanged = false;
117 * true if this is a new session
120 protected $firstVisit = false;
123 * list of names of permissions only available for users
126 protected $usersOnlyPermissions = [];
133 private const GUEST_SESSION_LIFETIME
= 2 * 3600;
135 private const USER_SESSION_LIFETIME
= 60 * 86400;
137 private const CHANGE_USER_AFTER_MULTIFACTOR_KEY
= self
::class . "\0__changeUserAfterMultifactor__";
139 private const PENDING_USER_LIFETIME
= 15 * 60;
141 private const REAUTHENTICATION_KEY
= self
::class . "\0__reauthentication__";
143 private const REAUTHENTICATION_HARD_LIMIT
= 12 * 3600;
145 private const REAUTHENTICATION_SOFT_LIMIT
= 2 * 3600;
147 private const REAUTHENTICATION_SOFT_LIMIT_ACP
= 2 * 3600;
149 private const REAUTHENTICATION_GRACE_PERIOD
= 15 * 60;
152 * Provides access to session data.
157 public function __get($key)
161 return $this->sessionID
;
163 return $this->user
->userID
;
165 return $this->getSpiderID(UserUtil
::getUserAgent());
169 case 'parentPageObjectID':
170 return $this->legacySession
->{$key};
172 /** @deprecated 5.4 - The below values are deprecated. */
174 return UserUtil
::getIpAddress();
176 return UserUtil
::getUserAgent();
178 return UserUtil
::getRequestURI();
179 case 'requestMethod':
180 return !empty($_SERVER['REQUEST_METHOD']) ? \
substr($_SERVER['REQUEST_METHOD'], 0, 7) : '';
181 case 'lastActivityTime':
192 protected function init()
194 $this->isACP
= (\
class_exists(WCFACP
::class, false) ||
!PACKAGE_ID
);
195 $this->usersOnlyPermissions
= UserGroupOptionCacheBuilder
::getInstance()->getData([], 'usersOnlyOptions');
199 * @deprecated 5.4 - This method is a noop. The cookie suffix is determined automatically.
201 public function setCookieSuffix()
206 * @deprecated 5.4 - This method is a noop. Cookie handling works automatically.
208 public function setHasValidCookie($hasValidCookie)
213 * Parses the session cookie value, returning an array with the stored fields.
215 * The return array is guaranteed to have a `sessionId` key.
217 private function parseCookie(string $value): array
219 $length = \
mb_strlen($value, '8bit');
221 throw new \
InvalidArgumentException(\
sprintf(
222 'Expected at least 1 Byte, %d given.',
227 $version = \
unpack('Cversion', $value)['version'];
228 if (!\
in_array($version, [1], true)) {
229 throw new \
InvalidArgumentException(\
sprintf(
230 'Unknown version %d',
235 if ($version === 1) {
236 if ($length !== 22) {
237 throw new \
InvalidArgumentException(\
sprintf(
238 'Expected exactly 22 Bytes, %d given.',
242 $data = \
unpack('Cversion/A20sessionId/Ctimestep', $value);
243 $data['sessionId'] = Hex
::encode($data['sessionId']);
248 throw new \
LogicException('Unreachable');
252 * Extracts the data from the session cookie.
254 * @see SessionHandler::parseCookie()
257 private function getParsedCookieData(): ?
array
259 $cookieName = COOKIE_PREFIX
. "user_session";
261 if (!empty($_COOKIE[$cookieName])) {
264 'sessionId' => $_COOKIE[$cookieName],
268 $cookieData = CryptoUtil
::getValueFromSignedString($_COOKIE[$cookieName]);
270 // Check whether the sessionId was correctly signed.
276 return $this->parseCookie($cookieData);
277 } catch (\InvalidArgumentException
$e) {
286 * Returns the session ID stored in the session cookie or `null`.
288 private function getSessionIdFromCookie(): ?
string
290 $cookieData = $this->getParsedCookieData();
293 return $cookieData['sessionId'];
300 * Returns the current time step. The time step changes
303 private function getCookieTimestep(): int
305 $window = (24 * 3600);
307 \assert
((self
::USER_SESSION_LIFETIME
/ $window) < 0xFF);
309 return \floor
(TIME_NOW
/ $window) & 0xFF;
313 * Returns the signed session data for use in a cookie.
315 private function getCookieValue(): string
318 return $this->sessionID
;
321 return CryptoUtil
::createSignedString(\
pack(
324 Hex
::decode($this->sessionID
),
325 $this->getCookieTimestep()
330 * Returns true if client provided a valid session cookie.
335 public function hasValidCookie(): bool
337 return $this->getSessionIdFromCookie() === $this->sessionID
;
341 * @deprecated 5.4 - Sessions are managed automatically. Use loadFromCookie().
343 public function load($sessionEditorClassName, $sessionID)
346 if (!empty($sessionID)) {
347 $hasSession = $this->getExistingSession($sessionID);
356 * Loads the session matching the session cookie.
358 public function loadFromCookie()
360 $sessionID = $this->getSessionIdFromCookie();
364 $hasSession = $this->getExistingSession($sessionID);
368 $this->maybeRefreshCookie();
375 * Refreshes the session cookie, extending the expiry.
377 private function maybeRefreshCookie(): void
379 // Guests use short-lived sessions with an actual session cookie.
380 if (!$this->user
->userID
) {
384 $cookieData = $this->getParsedCookieData();
386 // No refresh is needed if the timestep matches up.
387 if (isset($cookieData['timestep']) && $cookieData['timestep'] === $this->getCookieTimestep()) {
391 // Refresh the cookie.
392 HeaderUtil
::setCookie(
394 $this->getCookieValue(),
395 TIME_NOW +
(self
::USER_SESSION_LIFETIME
* 2)
400 * Initializes session system.
402 public function initSession()
404 $this->defineConstants();
406 // assign language and style id
407 $this->languageID
= $this->getVar('languageID') ?
: $this->user
->languageID
;
408 $this->styleID
= $this->getVar('styleID') ?
: $this->user
->styleID
;
410 // https://github.com/WoltLab/WCF/issues/2568
411 if ($this->getVar('__wcfIsFirstVisit') === true) {
412 $this->firstVisit
= true;
413 $this->unregister('__wcfIsFirstVisit');
418 * Disables update on shutdown.
420 public function disableUpdate()
422 $this->doNotUpdate
= true;
426 * Disables page tracking.
428 public function disableTracking()
430 $this->disableTracking
= true;
434 * Defines global wcf constants related to session.
436 protected function defineConstants()
439 if (!\
defined('SECURITY_TOKEN')) {
440 \
define('SECURITY_TOKEN', $this->getSecurityToken());
442 if (!\
defined('SECURITY_TOKEN_INPUT_TAG')) {
444 'SECURITY_TOKEN_INPUT_TAG',
445 '<input type="hidden" name="t" value="' . $this->getSecurityToken() . '">'
451 * Initializes security token.
453 protected function initSecurityToken()
456 if (!empty($_COOKIE['XSRF-TOKEN'])) {
457 // We intentionally do not extract the signed value and instead just verify the correctness.
459 // The reason is that common JavaScript frameworks can use the contents of the `XSRF-TOKEN` cookie as-is,
460 // without performing any processing on it, improving interoperability. Leveraging this JavaScript framework
461 // feature requires the author of the controller to check the value within the `X-XSRF-TOKEN` request header
462 // instead of the WoltLab Suite specific `t` parameter, though.
464 // The only reason we sign the cookie is that an XSS vulnerability or a rogue application on a subdomain
465 // is not able to create a valid `XSRF-TOKEN`, e.g. by setting the `XSRF-TOKEN` cookie to the static
466 // value `1234`, possibly allowing later exploitation.
467 if (!PACKAGE_ID || CryptoUtil
::validateSignedString($_COOKIE['XSRF-TOKEN'])) {
468 $xsrfToken = $_COOKIE['XSRF-TOKEN'];
474 $xsrfToken = CryptoUtil
::createSignedString(\random_bytes
(16));
476 $xsrfToken = Hex
::encode(\random_bytes
(16));
479 // We construct the cookie manually instead of using HeaderUtil::setCookie(), because:
480 // 1) We don't want the prefix. The `XSRF-TOKEN` cookie name is a standard name across applications
481 // and it is supported by default in common JavaScript frameworks.
482 // 2) We want to set the SameSite=strict parameter.
483 // 3) We don't want the HttpOnly parameter.
484 $sameSite = $cookieDomain = '';
486 if (ApplicationHandler
::getInstance()->isMultiDomainSetup()) {
487 // We need to specify the cookieDomain in a multi domain set-up, because
488 // otherwise no cookies are sent to subdomains.
489 $cookieDomain = HeaderUtil
::getCookieDomain();
490 $cookieDomain = ($cookieDomain !== null ?
'; domain=' . $cookieDomain : '');
492 // SameSite=strict is not supported in a multi domain set-up, because
493 // it breaks cross-application requests.
494 $sameSite = '; SameSite=strict';
498 'set-cookie: XSRF-TOKEN=' . \rawurlencode
($xsrfToken) . '; path=/' . $cookieDomain . (RouteHandler
::secureConnection() ?
'; secure' : '') . $sameSite,
503 $this->xsrfToken
= $xsrfToken;
507 * Returns security token.
511 public function getSecurityToken()
513 if ($this->xsrfToken
=== null) {
514 $this->initSecurityToken();
517 return $this->xsrfToken
;
521 * Validates the given security token, returns false if
522 * given token is invalid.
524 * @param string $token
527 public function checkSecurityToken($token)
529 // The output of CryptoUtil::createSignedString() is not url-safe. For compatibility
530 // reasons the SECURITY_TOKEN in URLs might not be encoded, turning the '+' into a space.
531 // Convert it back before comparing.
532 $token = \
str_replace(' ', '+', $token);
534 return \
hash_equals($this->getSecurityToken(), $token);
538 * Registers a session variable.
541 * @param mixed $value
543 public function register($key, $value)
545 $scope = $this->isACP ?
'acp' : 'frontend';
547 $this->variables
[$scope][$key] = $value;
548 $this->variablesChanged
= true;
552 * Unsets a session variable.
556 public function unregister($key)
558 $scope = $this->isACP ?
'acp' : 'frontend';
560 unset($this->variables
[$scope][$key]);
561 $this->variablesChanged
= true;
565 * Returns the value of a session variable or `null` if the session
566 * variable does not exist.
571 public function getVar($key)
573 $scope = $this->isACP ?
'acp' : 'frontend';
575 if (isset($this->variables
[$scope][$key])) {
576 return $this->variables
[$scope][$key];
581 * Returns the user object of this session.
585 public function getUser()
591 * Tries to read existing session identified by the given session id. Returns whether
592 * a session could be found.
594 protected function getExistingSession(string $sessionID): bool
597 FROM wcf" . WCF_N
. "_user_session
598 WHERE sessionID = ?";
599 $statement = WCF
::getDB()->prepareStatement($sql);
600 $statement->execute([
603 $row = $statement->fetchSingleRow();
609 // Check whether the session technically already expired.
610 $lifetime = ($row['userID'] ? self
::USER_SESSION_LIFETIME
: self
::GUEST_SESSION_LIFETIME
);
611 if ($row['lastActivityTime'] < (TIME_NOW
- $lifetime)) {
615 $variables = @\
unserialize($row['sessionVariables']);
616 // Check whether the session variables became corrupted.
617 if (!\
is_array($variables)) {
621 $this->sessionID
= $sessionID;
622 $this->user
= new User($row['userID']);
623 $this->variables
= $variables;
625 $sql = "UPDATE wcf" . WCF_N
. "_user_session
629 WHERE sessionID = ?";
630 $statement = WCF
::getDB()->prepareStatement($sql);
631 $statement->execute([
632 UserUtil
::getIpAddress(),
633 UserUtil
::getUserAgent(),
638 // Fetch legacy session.
639 $condition = new PreparedStatementConditionBuilder();
641 if ($row['userID']) {
642 // The `userID IS NOT NULL` condition technically is redundant, but is added for
643 // clarity and consistency with the guest case below.
644 $condition->add('userID IS NOT NULL');
645 $condition->add('userID = ?', [$row['userID']]);
647 $condition->add('userID IS NULL');
648 $condition->add('(sessionID = ? OR spiderID = ?)', [
650 $this->getSpiderID(UserUtil
::getUserAgent()),
655 FROM wcf" . WCF_N
. "_session
657 $statement = WCF
::getDB()->prepareStatement($sql);
658 $statement->execute($condition->getParameters());
659 $this->legacySession
= $statement->fetchSingleObject(LegacySession
::class);
661 if (!$this->legacySession
) {
662 $this->legacySession
= $this->createLegacySession();
669 * Creates a new session.
671 protected function create()
673 $this->sessionID
= Hex
::encode(\random_bytes
(20));
680 // Create new session.
681 $sql = "INSERT INTO wcf" . WCF_N
. "_user_session
682 (sessionID, ipAddress, userAgent, lastActivityTime, sessionVariables)
683 VALUES (?, ?, ?, ?, ?)";
684 $statement = WCF
::getDB()->prepareStatement($sql);
685 $statement->execute([
687 UserUtil
::getIpAddress(),
688 UserUtil
::getUserAgent(),
690 \
serialize($variables),
693 $this->variables
= $variables;
694 $this->user
= new User(null);
695 $this->firstVisit
= true;
697 HeaderUtil
::setCookie(
699 $this->getCookieValue()
702 // Maintain legacy session table for users online list.
703 $this->legacySession
= null;
705 // Try to find an existing spider session. Order by lastActivityTime to maintain a
706 // stable selection in case duplicates exist for some reason.
707 $spiderID = $this->getSpiderID(UserUtil
::getUserAgent());
710 FROM wcf" . WCF_N
. "_session
713 ORDER BY lastActivityTime DESC";
714 $statement = WCF
::getDB()->prepareStatement($sql);
715 $statement->execute([$spiderID]);
716 $this->legacySession
= $statement->fetchSingleObject(LegacySession
::class);
719 if (!$this->legacySession
) {
720 $this->legacySession
= $this->createLegacySession();
724 private function createLegacySession(): LegacySession
727 if (!$this->user
->userID
) {
728 $spiderID = $this->getSpiderID(UserUtil
::getUserAgent());
733 'sessionID' => $this->sessionID
,
734 'userID' => $this->user
->userID
,
735 'ipAddress' => UserUtil
::getIpAddress(),
736 'userAgent' => UserUtil
::getUserAgent(),
737 'lastActivityTime' => TIME_NOW
,
738 'requestURI' => UserUtil
::getRequestURI(),
739 'requestMethod' => !empty($_SERVER['REQUEST_METHOD']) ? \
substr($_SERVER['REQUEST_METHOD'], 0, 7) : '',
740 'spiderID' => $spiderID,
743 return SessionEditor
::create($sessionData);
747 * Returns the value of the permission with the given name.
749 * @param string $permission
750 * @return mixed permission value
752 public function getPermission($permission)
754 // check if a users only permission is checked for a guest and return
755 // false if that is the case
756 if (!$this->user
->userID
&& \
in_array($permission, $this->usersOnlyPermissions
)) {
760 $this->loadGroupData();
762 if (!isset($this->groupData
[$permission])) {
766 return $this->groupData
[$permission];
770 * Returns true if a permission was set to 'Never'. This is required to preserve
771 * compatibility, while preventing ACLs from overruling a 'Never' setting.
773 * @param string $permission
776 public function getNeverPermission($permission)
778 $this->loadGroupData();
780 return isset($this->groupData
['__never'][$permission]);
784 * Checks if the active user has the given permissions and throws a
785 * PermissionDeniedException if that isn't the case.
787 * @param string[] $permissions list of permissions where each one must pass
788 * @throws PermissionDeniedException
790 public function checkPermissions(array $permissions)
792 foreach ($permissions as $permission) {
793 if (!$this->getPermission($permission)) {
794 throw new PermissionDeniedException();
800 * Loads group data from cache.
802 protected function loadGroupData()
804 if ($this->groupData
!== null) {
808 // work-around for setup process (package wcf does not exist yet)
810 $sql = "SELECT groupID
811 FROM wcf" . WCF_N
. "_user_to_group
813 $statement = WCF
::getDB()->prepareStatement($sql);
814 $statement->execute([$this->user
->userID
]);
815 $groupIDs = $statement->fetchAll(\PDO
::FETCH_COLUMN
);
817 $groupIDs = $this->user
->getGroupIDs();
820 // get group data from cache
821 $this->groupData
= UserGroupPermissionCacheBuilder
::getInstance()->getData($groupIDs);
822 if (isset($this->groupData
['groupIDs']) && $this->groupData
['groupIDs'] != $groupIDs) {
823 $this->groupData
= [];
828 * Returns language ids for active user.
832 public function getLanguageIDs()
834 $this->loadLanguageIDs();
836 return $this->languageIDs
;
840 * Loads language ids for active user.
842 protected function loadLanguageIDs()
844 if ($this->languageIDs
!== null) {
848 $this->languageIDs
= [];
850 if (!$this->user
->userID
) {
854 // work-around for setup process (package wcf does not exist yet)
856 $sql = "SELECT languageID
857 FROM wcf" . WCF_N
. "_user_to_language
859 $statement = WCF
::getDB()->prepareStatement($sql);
860 $statement->execute([$this->user
->userID
]);
861 $this->languageIDs
= $statement->fetchAll(\PDO
::FETCH_COLUMN
);
863 $this->languageIDs
= $this->user
->getLanguageIDs();
868 * If multi-factor authentication is enabled for the given user then
869 * - the userID will be stored in the session variables, and
870 * - `true` is returned.
872 * - `changeUser()` will be called, and
873 * - `false` is returned.
875 * If `true` is returned you should perform a redirect to `MultifactorAuthenticationForm`.
879 public function changeUserAfterMultifactorAuthentication(User
$user): bool
881 if ($user->multifactorActive
) {
882 $this->register(self
::CHANGE_USER_AFTER_MULTIFACTOR_KEY
, [
883 'userId' => $user->userID
,
884 'expires' => TIME_NOW + self
::PENDING_USER_LIFETIME
,
886 $this->setLanguageID($user->languageID
);
890 $this->changeUser($user);
897 * Applies the pending user change, calling `changeUser()` for the user returned
898 * by `getPendingUserChange()`.
900 * As a safety check you must provide the `$expectedUser` as a parameter, it must match the
901 * data stored within the session.
903 * @throws \RuntimeException If the `$expectedUser` does not match.
904 * @throws \BadMethodCallException If `getPendingUserChange()` returns `null`.
905 * @see SessionHandler::getPendingUserChange()
908 public function applyPendingUserChange(User
$expectedUser): void
910 $user = $this->getPendingUserChange();
911 $this->clearPendingUserChange();
913 if ($user->userID
!== $expectedUser->userID
) {
914 throw new \
RuntimeException('Mismatching expectedUser.');
918 throw new \
BadMethodCallException('No pending user change.');
921 $this->changeUser($user);
925 * Returns the pending user change initiated by `changeUserAfterMultifactorAuthentication()`.
927 * @see SessionHandler::changeUserAfterMultifactorAuthentication()
930 public function getPendingUserChange(): ?User
932 $data = $this->getVar(self
::CHANGE_USER_AFTER_MULTIFACTOR_KEY
);
937 $userId = $data['userId'];
938 $expires = $data['expires'];
940 if ($expires < TIME_NOW
) {
944 $user = new User($userId);
946 if (!$user->userID
) {
954 * Clears a pending user change, reverses the effects of `changeUserAfterMultifactorAuthentication()`.
956 * @see SessionHandler::changeUserAfterMultifactorAuthentication()
959 public function clearPendingUserChange(): void
961 $this->unregister(self
::CHANGE_USER_AFTER_MULTIFACTOR_KEY
);
965 * Stores a new user object in this session, e.g. a user was guest because not
966 * logged in, after the login his old session is used to store his full data.
969 * @param bool $hideSession if true, database won't be updated
971 public function changeUser(User
$user, $hideSession = false)
973 $eventParameters = ['user' => $user, 'hideSession' => $hideSession];
975 EventHandler
::getInstance()->fireAction($this, 'beforeChangeUser', $eventParameters);
977 $user = $eventParameters['user'];
978 $hideSession = $eventParameters['hideSession'];
980 // skip changeUserVirtual, if session will not be persistent anyway
982 $this->changeUserVirtual($user);
985 // update user reference
989 $this->groupData
= null;
990 $this->languageIDs
= null;
991 $this->languageID
= $this->user
->languageID
;
992 $this->styleID
= $this->user
->styleID
;
995 WCF
::setLanguage($this->languageID ?
: 0);
997 // in some cases the language id can be stuck in the session variables
998 $this->unregister('languageID');
1000 EventHandler
::getInstance()->fireAction($this, 'afterChangeUser');
1004 * Changes the user stored in the session.
1007 * @throws DatabaseException
1009 protected function changeUserVirtual(User
$user)
1011 // We must delete the old session to not carry over any state across different users.
1014 // If the target user is a registered user ...
1015 if ($user->userID
) {
1016 // ... we create a new session with a new session ID ...
1019 // ... delete the newly created legacy session ...
1020 $sql = "DELETE FROM wcf" . WCF_N
. "_session
1021 WHERE sessionID = ?";
1022 $statement = WCF
::getDB()->prepareStatement($sql);
1023 $statement->execute([$this->sessionID
]);
1025 // ... perform the login ...
1026 $sql = "UPDATE wcf" . WCF_N
. "_user_session
1028 WHERE sessionID = ?";
1029 $statement = WCF
::getDB()->prepareStatement($sql);
1030 $statement->execute([
1035 // ... and reload the session with the updated information.
1036 $hasSession = $this->getExistingSession($this->sessionID
);
1039 throw new \
LogicException('Unreachable');
1045 * Checks whether the user needs to authenticate themselves once again
1046 * to access a security critical area.
1048 * If `true` is returned you should perform a redirect to `ReAuthenticationForm`,
1049 * otherwise the user is sufficiently authenticated and may proceed.
1051 * @throws \BadMethodCallException If the current user is a guest.
1054 public function needsReauthentication(): bool
1056 if (!$this->getUser()->userID
) {
1057 throw new \
BadMethodCallException('The current user is a guest.');
1060 // Reauthentication for third party authentication is not supported.
1061 if ($this->getUser()->authData
) {
1065 $data = $this->getVar(self
::REAUTHENTICATION_KEY
);
1067 // Request a new authentication if no stored information is available.
1072 $lastAuthentication = $data['lastAuthentication'];
1073 $lastCheck = $data['lastCheck'];
1075 // Request a new authentication if the hard limit since the last authentication
1077 if ($lastAuthentication < (TIME_NOW
- self
::REAUTHENTICATION_HARD_LIMIT
)) {
1081 $softLimit = self
::REAUTHENTICATION_SOFT_LIMIT
;
1083 $softLimit = self
::REAUTHENTICATION_SOFT_LIMIT_ACP
;
1085 // If both the debug mode and the developer tools are enabled the
1086 // reauthentication soft limit within the ACP matches the hard limit.
1088 // This allows for a continous access to the ACP and specifically the
1089 // developer tools within a single workday without needing to re-login
1090 // just because one spent 15 minutes within the IDE.
1091 if (ENABLE_DEBUG_MODE
&& ENABLE_DEVELOPER_TOOLS
) {
1092 $softLimit = self
::REAUTHENTICATION_HARD_LIMIT
;
1096 // Request a new authentication if the soft limit since the last authentication
1098 if ($lastAuthentication < (TIME_NOW
- $softLimit)) {
1099 // ... and the grace period since the last check is also exceeded.
1100 if ($lastCheck < (TIME_NOW
- self
::REAUTHENTICATION_GRACE_PERIOD
)) {
1105 // If we reach this point we determined that a new authentication is not necessary.
1107 ($lastAuthentication >= TIME_NOW
- $softLimit)
1108 ||
($lastAuthentication >= TIME_NOW
- self
::REAUTHENTICATION_HARD_LIMIT
1109 && $lastCheck >= TIME_NOW
- self
::REAUTHENTICATION_GRACE_PERIOD
)
1112 // Update the lastCheck timestamp to make sure that the grace period works properly.
1114 // The grace period allows the user to complete their action if the soft limit
1115 // expires between loading a form and actually submitting that form, provided that
1116 // the user does not take longer than the grace period to fill in the form.
1117 $data['lastCheck'] = TIME_NOW
;
1118 $this->register(self
::REAUTHENTICATION_KEY
, $data);
1124 * Registers that the user performed reauthentication successfully.
1126 * This method should be considered to be semi-public and is intended to be used
1127 * by `ReAuthenticationForm` only.
1129 * @throws \BadMethodCallException If the current user is a guest.
1130 * @see SessionHandler::needsReauthentication()
1133 public function registerReauthentication(): void
1135 if (!$this->getUser()->userID
) {
1136 throw new \
BadMethodCallException('The current user is a guest.');
1139 $this->register(self
::REAUTHENTICATION_KEY
, [
1140 'lastAuthentication' => TIME_NOW
,
1141 'lastCheck' => TIME_NOW
,
1146 * Clears that the user performed reauthentication successfully.
1148 * After this method is called `needsReauthentication()` will return true until
1149 * `registerReauthentication()` is called again.
1151 * @throws \BadMethodCallException If the current user is a guest.
1152 * @see SessionHandler::needsReauthentication()
1153 * @see SessionHandler::registerReauthentication()
1156 public function clearReauthentication(): void
1158 if (!$this->getUser()->userID
) {
1159 throw new \
BadMethodCallException('The current user is a guest.');
1162 $this->unregister(self
::REAUTHENTICATION_KEY
);
1166 * Updates user session on shutdown.
1168 public function update()
1170 if ($this->doNotUpdate
) {
1174 if ($this->variablesChanged
) {
1175 $sql = "UPDATE wcf" . WCF_N
. "_user_session
1176 SET sessionVariables = ?
1177 WHERE sessionID = ?";
1178 $statement = WCF
::getDB()->prepareStatement($sql);
1179 $statement->execute([
1180 \
serialize($this->variables
),
1184 // Reset the flag, because the variables are no longer dirty.
1185 $this->variablesChanged
= false;
1189 'ipAddress' => $this->ipAddress
,
1190 'userAgent' => $this->userAgent
,
1191 'requestURI' => $this->requestURI
,
1192 'requestMethod' => $this->requestMethod
,
1193 'lastActivityTime' => TIME_NOW
,
1194 'userID' => $this->user
->userID
,
1195 'sessionID' => $this->sessionID
,
1197 if (!\
class_exists('wcf\system\CLIWCF', false) && !$this->disableTracking
) {
1198 $pageLocations = PageLocationManager
::getInstance()->getLocations();
1199 if (isset($pageLocations[0])) {
1200 $data['pageID'] = $pageLocations[0]['pageID'];
1201 $data['pageObjectID'] = ($pageLocations[0]['pageObjectID'] ?
: null);
1202 $data['parentPageID'] = null;
1203 $data['parentPageObjectID'] = null;
1205 for ($i = 1, $length = \
count($pageLocations); $i < $length; $i++
) {
1206 if (!empty($pageLocations[$i]['useAsParentLocation'])) {
1207 $data['parentPageID'] = $pageLocations[$i]['pageID'];
1208 $data['parentPageObjectID'] = ($pageLocations[$i]['pageObjectID'] ?
: null);
1215 if ($this->legacySession
) {
1216 $sessionEditor = new SessionEditor($this->legacySession
);
1217 $sessionEditor->update($data);
1222 * @deprecated 5.4 - This method is a noop. The lastActivityTime is always updated immediately after loading.
1224 public function keepAlive()
1229 * Deletes this session and its related data.
1231 public function delete()
1234 if ($this->user
->userID
) {
1235 self
::resetSessions([$this->user
->userID
]);
1237 // update last activity time
1238 $editor = new UserEditor($this->user
);
1239 $editor->update(['lastActivityTime' => TIME_NOW
]);
1242 $this->deleteUserSession($this->sessionID
);
1246 * Prunes expired sessions.
1248 public function prune()
1250 $sql = "DELETE FROM wcf" . WCF_N
. "_user_session
1251 WHERE (lastActivityTime < ? AND userID IS NULL)
1252 OR (lastActivityTime < ? AND userID IS NOT NULL)";
1253 $statement = WCF
::getDB()->prepareStatement($sql);
1254 $statement->execute([
1255 TIME_NOW
- self
::GUEST_SESSION_LIFETIME
,
1256 TIME_NOW
- self
::USER_SESSION_LIFETIME
,
1259 // Legacy sessions live 120 minutes, they will be re-created on demand.
1260 $sql = "DELETE FROM wcf" . WCF_N
. "_session
1261 WHERE lastActivityTime < ?";
1262 $statement = WCF
::getDB()->prepareStatement($sql);
1263 $statement->execute([
1264 TIME_NOW
- (3600 * 2),
1269 * Deletes this session if:
1270 * - it is newly created in this request, and
1271 * - it belongs to a guest.
1273 * This method is useful if you have controllers that are likely to be
1274 * accessed by a user agent that is not going to re-use sessions (e.g.
1275 * curl in a cronjob). It immediately remove the session that was created
1276 * just for that request and that is not going to be used ever again.
1280 public function deleteIfNew()
1282 if ($this->isFirstVisit() && !$this->getUser()->userID
) {
1288 * Returns currently active language id.
1292 public function getLanguageID()
1294 return $this->languageID
;
1298 * Sets the currently active language id.
1300 * @param int $languageID
1302 public function setLanguageID($languageID)
1304 $this->languageID
= $languageID;
1305 $this->register('languageID', $this->languageID
);
1309 * Returns currently active style id.
1313 public function getStyleID()
1315 return $this->styleID
;
1319 * Sets the currently active style id.
1321 * @param int $styleID
1323 public function setStyleID($styleID)
1325 $this->styleID
= $styleID;
1326 $this->register('styleID', $this->styleID
);
1330 * Resets session-specific storage data.
1332 * @param int[] $userIDs
1334 public static function resetSessions(array $userIDs = [])
1336 if (!empty($userIDs)) {
1337 UserStorageHandler
::getInstance()->reset($userIDs, 'groupIDs');
1338 UserStorageHandler
::getInstance()->reset($userIDs, 'languageIDs');
1340 UserStorageHandler
::getInstance()->resetAll('groupIDs');
1341 UserStorageHandler
::getInstance()->resetAll('languageIDs');
1346 * Returns the spider id for given user agent.
1348 protected function getSpiderID(string $userAgent): ?
int
1350 $spiderList = SpiderCacheBuilder
::getInstance()->getData();
1351 $userAgent = \
strtolower($userAgent);
1353 foreach ($spiderList as $spider) {
1354 if (\
strpos($userAgent, $spider->spiderIdentifier
) !== false) {
1355 return \
intval($spider->spiderID
);
1363 * Returns true if this is a new session.
1367 public function isFirstVisit()
1369 return $this->firstVisit
;
1373 * Returns all user sessions for a specific user.
1376 * @throws \InvalidArgumentException if the given user is a guest.
1379 public function getUserSessions(User
$user): array
1381 return $this->getSessions($user, false);
1385 * Returns all acp sessions for a specific user.
1388 * @throws \InvalidArgumentException if the given user is a guest.
1391 public function getAcpSessions(User
$user): array
1393 return $this->getSessions($user, true);
1397 * Returns all sessions for a specific user.
1400 * @throws \InvalidArgumentException if the given user is a guest.
1403 private function getSessions(User
$user): array
1405 if (!$user->userID
) {
1406 throw new \
InvalidArgumentException("The given user is a guest.");
1410 FROM wcf" . WCF_N
. "_user_session
1412 $statement = WCF
::getDB()->prepareStatement($sql);
1413 $statement->execute([$user->userID
]);
1416 while ($row = $statement->fetchArray()) {
1417 $sessions[] = new Session($row);
1424 * Deletes the user sessions for a specific user, except the session with the given session id.
1426 * If the given session id is `null` or unknown, all sessions of the user will be deleted.
1428 * @throws \InvalidArgumentException if the given user is a guest.
1431 public function deleteUserSessionsExcept(User
$user, ?
string $sessionID = null): void
1433 if (!$user->userID
) {
1434 throw new \
InvalidArgumentException("The given user is a guest.");
1437 $conditionBuilder = new PreparedStatementConditionBuilder();
1438 $conditionBuilder->add('userID = ?', [$user->userID
]);
1440 if ($sessionID !== null) {
1441 $conditionBuilder->add('sessionID <> ?', [$sessionID]);
1444 $sql = "DELETE FROM wcf" . WCF_N
. "_user_session
1445 " . $conditionBuilder;
1446 $statement = WCF
::getDB()->prepareStatement($sql);
1447 $statement->execute($conditionBuilder->getParameters());
1449 // Delete legacy session.
1450 $sql = "DELETE FROM wcf" . WCF_N
. "_session
1451 " . $conditionBuilder;
1452 $statement = WCF
::getDB()->prepareStatement($sql);
1453 $statement->execute($conditionBuilder->getParameters());
1457 * Deletes a user session with the given session ID.
1461 public function deleteUserSession(string $sessionID): void
1463 $sql = "DELETE FROM wcf" . WCF_N
. "_user_session
1464 WHERE sessionID = ?";
1465 $statement = WCF
::getDB()->prepareStatement($sql);
1466 $statement->execute([$sessionID]);
1468 // Delete legacy session.
1469 $sql = "DELETE FROM wcf" . WCF_N
. "_session
1470 WHERE sessionID = ?";
1471 $statement = WCF
::getDB()->prepareStatement($sql);
1472 $statement->execute([$sessionID]);