Session.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Session;
 
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use Psr\Log\LoggerInterface;
use User;
use WebRequest;
 
class Session implements \Countable, \Iterator, \ArrayAccess {
    private static $encryptionAlgorithm = null;
 
    private $backend;
 
    private $index;
 
    private $logger;
 
    public function __construct( SessionBackend $backend, $index, LoggerInterface $logger ) {
        $this->backend = $backend;
        $this->index = $index;
        $this->logger = $logger;
    }
 
    public function __destruct() {
        $this->backend->deregisterSession( $this->index );
    }
 
    public function getId() {
        return $this->backend->getId();
    }
 
    public function getSessionId() {
        return $this->backend->getSessionId();
    }
 
    public function resetId() {
        return $this->backend->resetId();
    }
 
    public function getProvider() {
        return $this->backend->getProvider();
    }
 
    public function isPersistent() {
        return $this->backend->isPersistent();
    }
 
    public function persist() {
        $this->backend->persist();
    }
 
    public function unpersist() {
        $this->backend->unpersist();
    }
 
    public function shouldRememberUser() {
        return $this->backend->shouldRememberUser();
    }
 
    public function setRememberUser( $remember ) {
        $this->backend->setRememberUser( $remember );
    }
 
    public function getRequest() {
        return $this->backend->getRequest( $this->index );
    }
 
    public function getUser() {
        return $this->backend->getUser();
    }
 
    public function getAllowedUserRights() {
        return $this->backend->getAllowedUserRights();
    }
 
    public function canSetUser() {
        return $this->backend->canSetUser();
    }
 
    public function setUser( $user ) {
        $this->backend->setUser( $user );
    }
 
    public function suggestLoginUsername() {
        return $this->backend->suggestLoginUsername( $this->index );
    }
 
    public function shouldForceHTTPS() {
        return $this->backend->shouldForceHTTPS();
    }
 
    public function setForceHTTPS( $force ) {
        $this->backend->setForceHTTPS( $force );
    }
 
    public function getLoggedOutTimestamp() {
        return $this->backend->getLoggedOutTimestamp();
    }
 
    public function setLoggedOutTimestamp( $ts ) {
        $this->backend->setLoggedOutTimestamp( $ts );
    }
 
    public function getProviderMetadata() {
        return $this->backend->getProviderMetadata();
    }
 
    public function clear() {
        $data = &$this->backend->getData();
        if ( $data ) {
            $data = [];
            $this->backend->dirty();
        }
        if ( $this->backend->canSetUser() ) {
            $this->backend->setUser( new User );
        }
        $this->backend->save();
    }
 
    public function renew() {
        $this->backend->renew();
    }
 
    public function sessionWithRequest( WebRequest $request ) {
        $request->setSessionId( $this->backend->getSessionId() );
        return $this->backend->getSession( $request );
    }
 
    public function get( $key, $default = null ) {
        $data = &$this->backend->getData();
        return array_key_exists( $key, $data ) ? $data[$key] : $default;
    }
 
    public function exists( $key ) {
        $data = &$this->backend->getData();
        return array_key_exists( $key, $data );
    }
 
    public function set( $key, $value ) {
        $data = &$this->backend->getData();
        if ( !array_key_exists( $key, $data ) || $data[$key] !== $value ) {
            $data[$key] = $value;
            $this->backend->dirty();
        }
    }
 
    public function remove( $key ) {
        $data = &$this->backend->getData();
        if ( array_key_exists( $key, $data ) ) {
            unset( $data[$key] );
            $this->backend->dirty();
        }
    }
 
    public function hasToken( string $key = 'default' ): bool {
        $secrets = $this->get( 'wsTokenSecrets' );
        if ( !is_array( $secrets ) ) {
            return false;
        }
        return isset( $secrets[$key] ) && is_string( $secrets[$key] );
    }
 
    public function getToken( $salt = '', $key = 'default' ) {
        $new = false;
        $secrets = $this->get( 'wsTokenSecrets' );
        if ( !is_array( $secrets ) ) {
            $secrets = [];
        }
        if ( isset( $secrets[$key] ) && is_string( $secrets[$key] ) ) {
            $secret = $secrets[$key];
        } else {
            $secret = \MWCryptRand::generateHex( 32 );
            $secrets[$key] = $secret;
            $this->set( 'wsTokenSecrets', $secrets );
            $new = true;
        }
        if ( is_array( $salt ) ) {
            $salt = implode( '|', $salt );
        }
        return new Token( $secret, (string)$salt, $new );
    }
 
    public function resetToken( $key = 'default' ) {
        $secrets = $this->get( 'wsTokenSecrets' );
        if ( is_array( $secrets ) && isset( $secrets[$key] ) ) {
            unset( $secrets[$key] );
            $this->set( 'wsTokenSecrets', $secrets );
        }
    }
 
    public function resetAllTokens() {
        $this->remove( 'wsTokenSecrets' );
    }
 
    private function getSecretKeys() {
        $mainConfig = MediaWikiServices::getInstance()->getMainConfig();
        $sessionSecret = $mainConfig->get( MainConfigNames::SessionSecret );
        $secretKey = $mainConfig->get( MainConfigNames::SecretKey );
        $sessionPbkdf2Iterations = $mainConfig->get( MainConfigNames::SessionPbkdf2Iterations );
        $wikiSecret = $sessionSecret ?: $secretKey;
        $userSecret = $this->get( 'wsSessionSecret', null );
        if ( $userSecret === null ) {
            $userSecret = \MWCryptRand::generateHex( 32 );
            $this->set( 'wsSessionSecret', $userSecret );
        }
        $iterations = $this->get( 'wsSessionPbkdf2Iterations', null );
        if ( $iterations === null ) {
            $iterations = $sessionPbkdf2Iterations;
            $this->set( 'wsSessionPbkdf2Iterations', $iterations );
        }
 
        $keymats = hash_pbkdf2( 'sha256', $wikiSecret, $userSecret, $iterations, 64, true );
        return [
            substr( $keymats, 0, 32 ),
            substr( $keymats, 32, 32 ),
        ];
    }
 
    private static function getEncryptionAlgorithm() {
        $sessionInsecureSecrets = MediaWikiServices::getInstance()->getMainConfig()
            ->get( MainConfigNames::SessionInsecureSecrets );
 
        if ( self::$encryptionAlgorithm === null ) {
            if ( function_exists( 'openssl_encrypt' ) ) {
                $methods = openssl_get_cipher_methods();
                if ( in_array( 'aes-256-ctr', $methods, true ) ) {
                    self::$encryptionAlgorithm = [ 'openssl', 'aes-256-ctr' ];
                    return self::$encryptionAlgorithm;
                }
                if ( in_array( 'aes-256-cbc', $methods, true ) ) {
                    self::$encryptionAlgorithm = [ 'openssl', 'aes-256-cbc' ];
                    return self::$encryptionAlgorithm;
                }
            }
 
            if ( $sessionInsecureSecrets ) {
                // @todo: import a pure-PHP library for AES instead of this
                self::$encryptionAlgorithm = [ 'insecure' ];
                return self::$encryptionAlgorithm;
            }
 
            throw new \BadMethodCallException(
                'Encryption is not available. You really should install the PHP OpenSSL extension. ' .
                'But if you really can\'t and you\'re willing ' .
                'to accept insecure storage of sensitive session data, set ' .
                '$wgSessionInsecureSecrets = true in LocalSettings.php to make this exception go away.'
            );
        }
 
        return self::$encryptionAlgorithm;
    }
 
    public function setSecret( $key, $value ) {
        list( $encKey, $hmacKey ) = $this->getSecretKeys();
        $serialized = serialize( $value );
 
        // The code for encryption (with OpenSSL) and sealing is taken from
        // Chris Steipp's OATHAuthUtils class in Extension::OATHAuth.
 
        // Encrypt
        // @todo: import a pure-PHP library for AES instead of doing $wgSessionInsecureSecrets
        $iv = random_bytes( 16 );
        $algorithm = self::getEncryptionAlgorithm();
        switch ( $algorithm[0] ) {
            case 'openssl':
                $ciphertext = openssl_encrypt( $serialized, $algorithm[1], $encKey, OPENSSL_RAW_DATA, $iv );
                if ( $ciphertext === false ) {
                    throw new \UnexpectedValueException( 'Encryption failed: ' . openssl_error_string() );
                }
                break;
            case 'insecure':
                $ex = new \Exception( 'No encryption is available, storing data as plain text' );
                $this->logger->warning( $ex->getMessage(), [ 'exception' => $ex ] );
                $ciphertext = $serialized;
                break;
            default:
                throw new \LogicException( 'invalid algorithm' );
        }
 
        // Seal
        $sealed = base64_encode( $iv ) . '.' . base64_encode( $ciphertext );
        $hmac = hash_hmac( 'sha256', $sealed, $hmacKey, true );
        $encrypted = base64_encode( $hmac ) . '.' . $sealed;
 
        // Store
        $this->set( $key, $encrypted );
    }
 
    public function getSecret( $key, $default = null ) {
        // Fetch
        $encrypted = $this->get( $key, null );
        if ( $encrypted === null ) {
            return $default;
        }
 
        // The code for unsealing, checking, and decrypting (with OpenSSL) is
        // taken from Chris Steipp's OATHAuthUtils class in
        // Extension::OATHAuth.
 
        // Unseal and check
        $pieces = explode( '.', $encrypted, 4 );
        if ( count( $pieces ) !== 3 ) {
            $ex = new \Exception( 'Invalid sealed-secret format' );
            $this->logger->warning( $ex->getMessage(), [ 'exception' => $ex ] );
            return $default;
        }
        list( $hmac, $iv, $ciphertext ) = $pieces;
        list( $encKey, $hmacKey ) = $this->getSecretKeys();
        $integCalc = hash_hmac( 'sha256', $iv . '.' . $ciphertext, $hmacKey, true );
        if ( !hash_equals( $integCalc, base64_decode( $hmac ) ) ) {
            $ex = new \Exception( 'Sealed secret has been tampered with, aborting.' );
            $this->logger->warning( $ex->getMessage(), [ 'exception' => $ex ] );
            return $default;
        }
 
        // Decrypt
        $algorithm = self::getEncryptionAlgorithm();
        switch ( $algorithm[0] ) {
            case 'openssl':
                $serialized = openssl_decrypt( base64_decode( $ciphertext ), $algorithm[1], $encKey,
                    OPENSSL_RAW_DATA, base64_decode( $iv ) );
                if ( $serialized === false ) {
                    $ex = new \Exception( 'Decyption failed: ' . openssl_error_string() );
                    $this->logger->debug( $ex->getMessage(), [ 'exception' => $ex ] );
                    return $default;
                }
                break;
            case 'insecure':
                $ex = new \Exception(
                    'No encryption is available, retrieving data that was stored as plain text'
                );
                $this->logger->warning( $ex->getMessage(), [ 'exception' => $ex ] );
                $serialized = base64_decode( $ciphertext );
                break;
            default:
                throw new \LogicException( 'invalid algorithm' );
        }
 
        $value = unserialize( $serialized );
        if ( $value === false && $serialized !== serialize( false ) ) {
            $value = $default;
        }
        return $value;
    }
 
    public function delaySave() {
        return $this->backend->delaySave();
    }
 
    public function save() {
        $this->backend->save();
    }
 
    // region   Interface methods
    public function count(): int {
        $data = &$this->backend->getData();
        return count( $data );
    }
 
    #[\ReturnTypeWillChange]
    public function current() {
        $data = &$this->backend->getData();
        return current( $data );
    }
 
    #[\ReturnTypeWillChange]
    public function key() {
        $data = &$this->backend->getData();
        return key( $data );
    }
 
    public function next(): void {
        $data = &$this->backend->getData();
        next( $data );
    }
 
    public function rewind(): void {
        $data = &$this->backend->getData();
        reset( $data );
    }
 
    public function valid(): bool {
        $data = &$this->backend->getData();
        return key( $data ) !== null;
    }
 
    public function offsetExists( $offset ): bool {
        $data = &$this->backend->getData();
        return isset( $data[$offset] );
    }
 
    #[\ReturnTypeWillChange]
    public function &offsetGet( $offset ) {
        $data = &$this->backend->getData();
        if ( !array_key_exists( $offset, $data ) ) {
            $ex = new \Exception( "Undefined index (auto-adds to session with a null value): $offset" );
            $this->logger->debug( $ex->getMessage(), [ 'exception' => $ex ] );
        }
        return $data[$offset];
    }
 
    public function offsetSet( $offset, $value ): void {
        $this->set( $offset, $value );
    }
 
    public function offsetUnset( $offset ): void {
        $this->remove( $offset );
    }
 
    // endregion  -- end of Interface methods
}