This serves as the entry point to the MediaWiki session handling system. More...

Inheritance diagram for MediaWiki\Session\SessionManager:

[legend]

Collaboration diagram for MediaWiki\Session\SessionManager:

[legend]

Public Member Functions
	__construct ( $options=[])

	getEmptySession (WebRequest $request=null)
	Create a new, empty session.

	getSessionById ( $id, $create=false, WebRequest $request=null)
	Fetch a session by ID.

	getSessionForRequest (WebRequest $request)
	Fetch the session for a request (or a new empty session if none is attached to it)

	getVaryCookies ()
	Return the list of cookies that need varying on.

	getVaryHeaders ()
	Return the HTTP headers that need varying on.

	invalidateSessionsForUser (User $user)
	Invalidate sessions for a user.

	setHookContainer (HookContainer $hookContainer)

	setLogger (LoggerInterface $logger)

Static Public Member Functions
static	getGlobalSession ()
	Get the "global" session.

static	singleton ()
	Get the global SessionManager.

static	validateSessionId ( $id)
	Validate a session ID.

Private Member Functions
	getEmptySessionInternal (WebRequest $request=null, $id=null)

Private Attributes
SessionBackend[]	$allSessionBackends = []

SessionId[]	$allSessionIds = []

Config	$config

HookContainer	$hookContainer

HookRunner	$hookRunner

LoggerInterface	$logger

string[]	$preventUsers = []

SessionProvider[]	$sessionProviders = null

CachedBagOStuff null	$store

string[]	$varyCookies = null

array	$varyHeaders = null

Static Private Attributes
static Session null	$globalSession = null

static WebRequest null	$globalSessionRequest = null

static SessionManager null	$instance = null

Internal methods
static	resetCache ()
	Reset the internal caching for unit testing.

	preventSessionsForUser ( $username)
	Prevent future sessions for the user.

	isUserSessionPrevented ( $username)
	Test if a user is prevented.

	getProvider ( $name)
	Get a session provider by name.

	shutdown ()
	Save all active sessions on shutdown.

	getSessionFromInfo (SessionInfo $info, WebRequest $request)
	Create a Session corresponding to the passed SessionInfo.

	deregisterSessionBackend (SessionBackend $backend)
	Deregister a SessionBackend.

	changeBackendId (SessionBackend $backend)
	Change a SessionBackend's ID.

	generateSessionId ()
	Generate a new random session ID.

	setupPHPSessionHandler (PHPSessionHandler $handler)
	Call setters on a PHPSessionHandler.

	getSessionInfoForRequest (WebRequest $request)
	Fetch the SessionInfo(s) for a request.

	loadSessionInfoFromStore (SessionInfo &$info, WebRequest $request)
	Load and verify the session info against the store.

	getProviders ()
	Get the available SessionProviders.

Detailed Description

This serves as the entry point to the MediaWiki session handling system.

Most methods here are for internal use by session handling code. Other callers should only use getGlobalSession and the methods of SessionManagerInterface; the rest of the functionality is exposed via MediaWiki\Session\Session methods.

To provide custom session handling, implement a MediaWiki\Session\SessionProvider.

Since: 1.27

See also: https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager

Definition at line 52 of file SessionManager.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Session\SessionManager::__construct ( $options = [] )

Parameters

array

$options

config: Config to fetch configuration from. Defaults to the default 'main' config.
logger: LoggerInterface to use for logging. Defaults to the 'session' channel.
store: BagOStuff to store session data in.

Definition at line 155 of file SessionManager.php.

References MediaWiki\Session\SessionManager\$store, MediaWiki\MediaWikiServices\getInstance(), MediaWiki\Session\SessionManager\setHookContainer(), and MediaWiki\Session\SessionManager\setLogger().

Member Function Documentation

◆ changeBackendId()

MediaWiki\Session\SessionManager::changeBackendId ( SessionBackend $backend )

Change a SessionBackend's ID.

Definition at line 914 of file SessionManager.php.

References MediaWiki\Session\SessionManager\generateSessionId(), and MediaWiki\Session\SessionBackend\getSessionId().

◆ deregisterSessionBackend()

MediaWiki\Session\SessionManager::deregisterSessionBackend ( SessionBackend $backend )

Deregister a SessionBackend.

Definition at line 896 of file SessionManager.php.

References MediaWiki\Session\SessionBackend\getId(), and MediaWiki\Session\SessionBackend\getSessionId().

◆ generateSessionId()

MediaWiki\Session\SessionManager::generateSessionId ( )

Generate a new random session ID.

Returns: string

Definition at line 936 of file SessionManager.php.

References MWCryptRand\generateHex().

Referenced by MediaWiki\Session\SessionManager\changeBackendId().

◆ getEmptySession()

MediaWiki\Session\SessionManager::getEmptySession ( WebRequest $request = null )

Create a new, empty session.

The first provider configured that is able to provide an empty session will be used.

Parameters

WebRequest | null $request Corresponding request. Any existing session associated with this WebRequest object will be overwritten.

Returns: Session

Implements MediaWiki\Session\SessionManagerInterface.

Definition at line 267 of file SessionManager.php.

References MediaWiki\Session\SessionManager\getEmptySessionInternal().

Referenced by MediaWiki\Session\SessionManager\getSessionForRequest().

◆ getEmptySessionInternal()

MediaWiki\Session\SessionManager::getEmptySessionInternal	(	WebRequest	$request = `null`,
			$id = `null`
	)

private

See also: SessionManagerInterface::getEmptySession

Parameters

WebRequest \| null	$request
string \| null	$id	ID to force on the new session

Returns: Session

Definition at line 277 of file SessionManager.php.

References MediaWiki\Session\SessionInfo\compare(), MediaWiki\Session\SessionManager\getProviders(), and MediaWiki\Session\SessionManager\getSessionFromInfo().

Referenced by MediaWiki\Session\SessionManager\getEmptySession(), and MediaWiki\Session\SessionManager\getSessionById().

◆ getGlobalSession()

static MediaWiki\Session\SessionManager::getGlobalSession ( )

static

Get the "global" session.

If PHP's session_id() has been set, returns that session. Otherwise returns the session for RequestContext::getMain()->getRequest().

Returns: Session

Definition at line 114 of file SessionManager.php.

References MediaWiki\Session\SessionManager\$globalSession, MediaWiki\Session\PHPSessionHandler\isEnabled(), and MediaWiki\Session\SessionManager\singleton().

Referenced by MediaWiki\Session\SessionBackend\checkPHPSession().

◆ getProvider()

MediaWiki\Session\SessionManager::getProvider ( $name )

Get a session provider by name.

Generally, this will only be used by internal implementation of some special session-providing mechanism. General purpose code, if it needs to access a SessionProvider at all, will use Session::getProvider().

Parameters

string $name

Returns: SessionProvider|null

Definition at line 458 of file SessionManager.php.

References MediaWiki\Session\SessionManager\getProviders().

Referenced by MediaWiki\Session\SessionManager\loadSessionInfoFromStore().

◆ getProviders()

MediaWiki\Session\SessionManager::getProviders ( )

protected

Get the available SessionProviders.

Returns: SessionProvider[]

Definition at line 428 of file SessionManager.php.

References MediaWiki\Session\SessionManager\$sessionProviders, MediaWiki\Session\SessionProvider\setConfig(), MediaWiki\Session\SessionProvider\setHookContainer(), MediaWiki\Session\SessionProvider\setLogger(), and MediaWiki\Session\SessionProvider\setManager().

Referenced by MediaWiki\Session\SessionManager\getEmptySessionInternal(), MediaWiki\Session\SessionManager\getProvider(), MediaWiki\Session\SessionManager\getSessionInfoForRequest(), MediaWiki\Session\SessionManager\getVaryCookies(), MediaWiki\Session\SessionManager\getVaryHeaders(), MediaWiki\Session\SessionManager\invalidateSessionsForUser(), and MediaWiki\Session\SessionManager\preventSessionsForUser().

◆ getSessionById()

MediaWiki\Session\SessionManager::getSessionById	(		$id,
			$create = `false`,
		WebRequest	$request = `null`
	)

Fetch a session by ID.

Parameters

string	$id
bool	$create	If no session exists for $id, try to create a new one. May still return null if a session for $id exists but cannot be loaded.
WebRequest \| null	$request	Corresponding request. Any existing session associated with this WebRequest object will be overwritten.

Returns: Session|null

Implements MediaWiki\Session\SessionManagerInterface.

Definition at line 225 of file SessionManager.php.

References MediaWiki\Session\SessionManager\getEmptySessionInternal(), MediaWiki\Session\SessionManager\getSessionFromInfo(), MediaWiki\Session\SessionManager\loadSessionInfoFromStore(), and MediaWiki\Session\SessionInfo\MIN_PRIORITY.

◆ getSessionForRequest()

MediaWiki\Session\SessionManager::getSessionForRequest ( WebRequest $request )

Fetch the session for a request (or a new empty session if none is attached to it)

Note: You probably want to use $request->getSession() instead. It's more efficient and doesn't break FauxRequests or sessions that were changed by $this->getSessionById() or $this->getEmptySession().

Parameters

WebRequest $request Any existing associated session will be reset to the session corresponding to the data in the request itself.

Returns: Session

Exceptions

\OverflowException if there are multiple sessions tied for top priority in the request. Exception has a property "sessionInfos" holding the SessionInfo objects for the sessions involved.

Implements MediaWiki\Session\SessionManagerInterface.

Definition at line 214 of file SessionManager.php.

References MediaWiki\Session\SessionManager\getEmptySession(), MediaWiki\Session\SessionManager\getSessionFromInfo(), and MediaWiki\Session\SessionManager\getSessionInfoForRequest().

◆ getSessionFromInfo()

MediaWiki\Session\SessionManager::getSessionFromInfo	(	SessionInfo	$info,
		WebRequest	$request
	)

Create a Session corresponding to the passed SessionInfo.

Definition at line 839 of file SessionManager.php.

References MediaWiki\Session\SessionInfo\getId(), MediaWiki\Session\SessionInfo\isIdSafe(), MW_NO_SESSION, WebRequest\setSessionId(), MediaWiki\Session\SessionInfo\wasPersisted(), and MediaWiki\Session\SessionInfo\wasRemembered().

Referenced by MediaWiki\Session\SessionManager\getEmptySessionInternal(), MediaWiki\Session\SessionManager\getSessionById(), and MediaWiki\Session\SessionManager\getSessionForRequest().

◆ getSessionInfoForRequest()

MediaWiki\Session\SessionManager::getSessionInfoForRequest ( WebRequest $request )

private

Fetch the SessionInfo(s) for a request.

Parameters

WebRequest $request

Returns: SessionInfo|null

Definition at line 486 of file SessionManager.php.

References MediaWiki\Session\SessionInfo\compare(), MediaWiki\Session\SessionManager\getProviders(), and MediaWiki\Session\SessionManager\loadSessionInfoFromStore().

Referenced by MediaWiki\Session\SessionManager\getSessionForRequest().

◆ getVaryCookies()

MediaWiki\Session\SessionManager::getVaryCookies ( )

Return the list of cookies that need varying on.

Returns: string[]

Implements MediaWiki\Session\SessionManagerInterface.

Definition at line 366 of file SessionManager.php.

References MediaWiki\Session\SessionManager\$varyCookies, MediaWiki\Session\SessionManager\getProviders(), and MW_NO_SESSION.

◆ getVaryHeaders()

MediaWiki\Session\SessionManager::getVaryHeaders ( )

Return the HTTP headers that need varying on.

The return value is such that someone could theoretically do this:

foreach ( $provider->getVaryHeaders() as $header => $options ) {
  $outputPage->addVaryHeader( $header, $options );
}

Note that the $options argument to OutputPage::addVaryHeader() has been deprecated and should always be null.

Returns: array

Implements MediaWiki\Session\SessionManagerInterface.

Definition at line 346 of file SessionManager.php.

References $header, MediaWiki\Session\SessionManager\$varyHeaders, MediaWiki\Session\SessionManager\getProviders(), and MW_NO_SESSION.

◆ invalidateSessionsForUser()

MediaWiki\Session\SessionManager::invalidateSessionsForUser ( User $user )

Invalidate sessions for a user.

After calling this, existing sessions should be invalid. For mutable session providers, this generally means the user has to log in again; for immutable providers, it generally means the loss of session data.

Parameters

User $user

Implements MediaWiki\Session\SessionManagerInterface.

Definition at line 337 of file SessionManager.php.

References MediaWiki\Session\SessionManager\getProviders(), User\saveSettings(), and User\setToken().

◆ isUserSessionPrevented()

MediaWiki\Session\SessionManager::isUserSessionPrevented ( $username )

Test if a user is prevented.

Definition at line 420 of file SessionManager.php.

◆ loadSessionInfoFromStore()

MediaWiki\Session\SessionManager::loadSessionInfoFromStore	(	SessionInfo &	$info,
		WebRequest	$request
	)

private

Load and verify the session info against the store.

Parameters

SessionInfo	&$info	Will likely be replaced with an updated SessionInfo instance
WebRequest	$request

Returns: bool Whether the session info matches the stored data (if any)

Definition at line 549 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\getSessionById(), MediaWiki\Session\SessionManager\getSessionInfoForRequest(), and MediaWiki\Session\SessionManager\loadSessionInfoFromStore().

◆ preventSessionsForUser()

MediaWiki\Session\SessionManager::preventSessionsForUser ( $username )

Prevent future sessions for the user.

The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the prevention of access).

Definition at line 405 of file SessionManager.php.

References MediaWiki\Session\SessionManager\getProviders().

◆ resetCache()

static MediaWiki\Session\SessionManager::resetCache ( )

static

Reset the internal caching for unit testing.

Note: Unit tests only

Definition at line 958 of file SessionManager.php.

◆ setHookContainer()

MediaWiki\Session\SessionManager::setHookContainer ( HookContainer $hookContainer )

Definition at line 209 of file SessionManager.php.

References MediaWiki\Session\SessionManager\$hookContainer.

Referenced by MediaWiki\Session\SessionManager\__construct().

◆ setLogger()

MediaWiki\Session\SessionManager::setLogger ( LoggerInterface $logger )

Definition at line 201 of file SessionManager.php.

References MediaWiki\Session\SessionManager\$logger.

Referenced by MediaWiki\Session\SessionManager\__construct().

◆ setupPHPSessionHandler()

MediaWiki\Session\SessionManager::setupPHPSessionHandler ( PHPSessionHandler $handler )

Call setters on a PHPSessionHandler.

Definition at line 949 of file SessionManager.php.

References MediaWiki\Session\PHPSessionHandler\setManager().

◆ shutdown()

MediaWiki\Session\SessionManager::shutdown ( )

Save all active sessions on shutdown.

Definition at line 467 of file SessionManager.php.

◆ singleton()

static MediaWiki\Session\SessionManager::singleton ( )

static

Get the global SessionManager.

Returns: self

Definition at line 99 of file SessionManager.php.

References MediaWiki\Session\SessionManager\$instance.

Referenced by MediaWiki\Session\SessionManager\getGlobalSession().

◆ validateSessionId()

static MediaWiki\Session\SessionManager::validateSessionId ( $id )

static

Validate a session ID.

Parameters

string $id

Returns: bool

Definition at line 387 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionInfo\__construct(), MediaWiki\Session\ImmutableSessionProviderWithCookie\getSessionIdFromCookie(), and MediaWiki\Session\CookieSessionProvider\provideSessionInfo().

Member Data Documentation

◆ $allSessionBackends

SessionBackend [] MediaWiki\Session\SessionManager::$allSessionBackends = []

private

Definition at line 87 of file SessionManager.php.

◆ $allSessionIds

SessionId [] MediaWiki\Session\SessionManager::$allSessionIds = []

private

Definition at line 90 of file SessionManager.php.

◆ $config

Config MediaWiki\Session\SessionManager::$config

private

Definition at line 72 of file SessionManager.php.

◆ $globalSession

Session null MediaWiki\Session\SessionManager::$globalSession = null

staticprivate

Definition at line 57 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\getGlobalSession().

◆ $globalSessionRequest

WebRequest null MediaWiki\Session\SessionManager::$globalSessionRequest = null

staticprivate

Definition at line 60 of file SessionManager.php.

◆ $hookContainer

HookContainer MediaWiki\Session\SessionManager::$hookContainer

private

Definition at line 66 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\setHookContainer().

◆ $hookRunner

HookRunner MediaWiki\Session\SessionManager::$hookRunner

private

Definition at line 69 of file SessionManager.php.

◆ $instance

SessionManager null MediaWiki\Session\SessionManager::$instance = null

staticprivate

Definition at line 54 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\singleton().

◆ $logger

LoggerInterface MediaWiki\Session\SessionManager::$logger

private

Definition at line 63 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\setLogger().

◆ $preventUsers

string [] MediaWiki\Session\SessionManager::$preventUsers = []

private

Definition at line 93 of file SessionManager.php.

◆ $sessionProviders

SessionProvider [] MediaWiki\Session\SessionManager::$sessionProviders = null

private

Definition at line 78 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\getProviders().

◆ $store

CachedBagOStuff null MediaWiki\Session\SessionManager::$store

private

Definition at line 75 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\__construct().

◆ $varyCookies

string [] MediaWiki\Session\SessionManager::$varyCookies = null

private

Definition at line 81 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\getVaryCookies().

◆ $varyHeaders

array MediaWiki\Session\SessionManager::$varyHeaders = null

private

Definition at line 84 of file SessionManager.php.

Referenced by MediaWiki\Session\SessionManager\getVaryHeaders().

The documentation for this class was generated from the following file:

includes/session/SessionManager.php

Public Member Functions

Static Public Member Functions

Private Member Functions

Private Attributes

Static Private Attributes

Internal methods

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ changeBackendId()

◆ deregisterSessionBackend()

◆ generateSessionId()

◆ getEmptySession()

◆ getEmptySessionInternal()

◆ getGlobalSession()

◆ getProvider()

◆ getProviders()

◆ getSessionById()

◆ getSessionForRequest()

◆ getSessionFromInfo()

◆ getSessionInfoForRequest()

◆ getVaryCookies()

◆ getVaryHeaders()

◆ invalidateSessionsForUser()

◆ isUserSessionPrevented()

◆ loadSessionInfoFromStore()

◆ preventSessionsForUser()

◆ resetCache()

◆ setHookContainer()

◆ setLogger()

◆ setupPHPSessionHandler()

◆ shutdown()

◆ singleton()

◆ validateSessionId()

Member Data Documentation

◆ $allSessionBackends

◆ $allSessionIds

◆ $config

◆ $globalSession

◆ $globalSessionRequest

◆ $hookContainer

◆ $hookRunner

◆ $instance

◆ $logger

◆ $preventUsers

◆ $sessionProviders

◆ $store

◆ $varyCookies

◆ $varyHeaders