MediaWiki REL1_37
|
This serves as the entry point to the MediaWiki session handling system. More...
Public Member Functions | |
__construct ( $options=[]) | |
getEmptySession (WebRequest $request=null) | |
Create a new, empty session. | |
getSessionById ( $id, $create=false, WebRequest $request=null) | |
Fetch a session by ID. | |
getSessionForRequest (WebRequest $request) | |
Fetch the session for a request (or a new empty session if none is attached to it) | |
getVaryCookies () | |
Return the list of cookies that need varying on. | |
getVaryHeaders () | |
Return the HTTP headers that need varying on. | |
invalidateSessionsForUser (User $user) | |
Invalidate sessions for a user. | |
setHookContainer (HookContainer $hookContainer) | |
setLogger (LoggerInterface $logger) | |
Static Public Member Functions | |
static | getGlobalSession () |
If PHP's session_id() has been set, returns that session. | |
static | singleton () |
Get the global SessionManager. | |
static | validateSessionId ( $id) |
Validate a session ID. | |
Private Member Functions | |
getEmptySessionInternal (WebRequest $request=null, $id=null) | |
Private Attributes | |
SessionBackend[] | $allSessionBackends = [] |
SessionId[] | $allSessionIds = [] |
Config | $config |
HookContainer | $hookContainer |
HookRunner | $hookRunner |
LoggerInterface | $logger |
string[] | $preventUsers = [] |
SessionProvider[] | $sessionProviders = null |
CachedBagOStuff null | $store |
UserNameUtils | $userNameUtils |
string[] | $varyCookies = null |
array | $varyHeaders = null |
Static Private Attributes | |
static Session null | $globalSession = null |
static WebRequest null | $globalSessionRequest = null |
static SessionManager null | $instance = null |
Internal methods | |
static | resetCache () |
Reset the internal caching for unit testing. | |
preventSessionsForUser ( $username) | |
Prevent future sessions for the user. | |
isUserSessionPrevented ( $username) | |
Test if a user is prevented. | |
getProvider ( $name) | |
Get a session provider by name. | |
shutdown () | |
Save all active sessions on shutdown. | |
getSessionFromInfo (SessionInfo $info, WebRequest $request) | |
Create a Session corresponding to the passed SessionInfo. | |
deregisterSessionBackend (SessionBackend $backend) | |
Deregister a SessionBackend. | |
changeBackendId (SessionBackend $backend) | |
Change a SessionBackend's ID. | |
generateSessionId () | |
Generate a new random session ID. | |
setupPHPSessionHandler (PHPSessionHandler $handler) | |
Call setters on a PHPSessionHandler. | |
logPotentialSessionLeakage (Session $session=null) | |
If the same session is suddenly used from a different IP, that's potentially due to a session leak, so log it. | |
getSessionInfoForRequest (WebRequest $request) | |
Fetch the SessionInfo(s) for a request. | |
loadSessionInfoFromStore (SessionInfo &$info, WebRequest $request) | |
Load and verify the session info against the store. | |
logUnpersist (SessionInfo $info, WebRequest $request) | |
Reset the internal caching for unit testing. | |
getProviders () | |
Get the available SessionProviders. | |
This serves as the entry point to the MediaWiki session handling system.
Most methods here are for internal use by session handling code. Other callers should only use getGlobalSession and the methods of SessionManagerInterface; the rest of the functionality is exposed via MediaWiki\Session\Session methods.
To provide custom session handling, implement a MediaWiki\Session\SessionProvider.
The SessionManager should be configured with a very fast storage system that is optimized for holding key-value pairs. It expects:
The SessionManager uses set() and delete() for write operations, which should by default be synchronous in the local data centre, and replicate asynchronously to any others. This behaviour can be overridden by the use of the WRITE_SYNC flag.
Definition at line 83 of file SessionManager.php.
MediaWiki\Session\SessionManager::__construct | ( | $options = [] | ) |
array | $options |
Definition at line 187 of file SessionManager.php.
References MediaWiki\MediaWikiServices\getInstance().
MediaWiki\Session\SessionManager::changeBackendId | ( | SessionBackend | $backend | ) |
Change a SessionBackend's ID.
SessionBackend | $backend |
Definition at line 954 of file SessionManager.php.
References MediaWiki\Session\SessionBackend\getSessionId().
MediaWiki\Session\SessionManager::deregisterSessionBackend | ( | SessionBackend | $backend | ) |
Deregister a SessionBackend.
SessionBackend | $backend |
Definition at line 936 of file SessionManager.php.
References MediaWiki\Session\SessionBackend\getId(), and MediaWiki\Session\SessionBackend\getSessionId().
MediaWiki\Session\SessionManager::generateSessionId | ( | ) |
Generate a new random session ID.
Definition at line 976 of file SessionManager.php.
References MWCryptRand\generateHex().
MediaWiki\Session\SessionManager::getEmptySession | ( | WebRequest | $request = null | ) |
Create a new, empty session.
The first provider configured that is able to provide an empty session will be used.
WebRequest | null | $request | Corresponding request. Any existing session associated with this WebRequest object will be overwritten. |
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 300 of file SessionManager.php.
|
private |
WebRequest | null | $request | |
string | null | $id | ID to force on the new session |
Definition at line 310 of file SessionManager.php.
References MediaWiki\Session\SessionInfo\compare().
|
static |
If PHP's session_id() has been set, returns that session.
Otherwise returns the session for RequestContext::getMain()->getRequest().
Definition at line 146 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionBackend\checkPHPSession().
MediaWiki\Session\SessionManager::getProvider | ( | $name | ) |
Get a session provider by name.
Generally, this will only be used by internal implementation of some special session-providing mechanism. General purpose code, if it needs to access a SessionProvider at all, will use Session::getProvider().
string | $name |
Definition at line 493 of file SessionManager.php.
|
protected |
Get the available SessionProviders.
Definition at line 460 of file SessionManager.php.
References MediaWiki\Session\SessionProvider\init().
MediaWiki\Session\SessionManager::getSessionById | ( | $id, | |
$create = false , |
|||
WebRequest | $request = null |
||
) |
Fetch a session by ID.
string | $id | |
bool | $create | If no session exists for $id, try to create a new one. May still return null if a session for $id exists but cannot be loaded. |
WebRequest | null | $request | Corresponding request. Any existing session associated with this WebRequest object will be overwritten. |
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 258 of file SessionManager.php.
References MediaWiki\Session\SessionInfo\MIN_PRIORITY.
MediaWiki\Session\SessionManager::getSessionForRequest | ( | WebRequest | $request | ) |
Fetch the session for a request (or a new empty session if none is attached to it)
WebRequest | $request | Any existing associated session will be reset to the session corresponding to the data in the request itself. |
\OverflowException if there are multiple sessions tied for top priority in the request. Exception has a property "sessionInfos" holding the SessionInfo objects for the sessions involved.
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 247 of file SessionManager.php.
MediaWiki\Session\SessionManager::getSessionFromInfo | ( | SessionInfo | $info, |
WebRequest | $request | ||
) |
Create a Session corresponding to the passed SessionInfo.
SessionInfo | $info | |
WebRequest | $request |
Definition at line 877 of file SessionManager.php.
References MediaWiki\Session\SessionInfo\getId(), MediaWiki\Session\SessionInfo\isIdSafe(), MW_ENTRY_POINT, MW_NO_SESSION, WebRequest\setSessionId(), MediaWiki\Session\SessionInfo\wasPersisted(), and MediaWiki\Session\SessionInfo\wasRemembered().
|
private |
Fetch the SessionInfo(s) for a request.
WebRequest | $request |
Definition at line 521 of file SessionManager.php.
References MediaWiki\Session\SessionInfo\compare().
MediaWiki\Session\SessionManager::getVaryCookies | ( | ) |
Return the list of cookies that need varying on.
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 399 of file SessionManager.php.
References MW_NO_SESSION.
MediaWiki\Session\SessionManager::getVaryHeaders | ( | ) |
Return the HTTP headers that need varying on.
The return value is such that someone could theoretically do this:
Note that the $options argument to OutputPage::addVaryHeader() has been deprecated and should always be null.
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 379 of file SessionManager.php.
References $header, and MW_NO_SESSION.
MediaWiki\Session\SessionManager::invalidateSessionsForUser | ( | User | $user | ) |
Invalidate sessions for a user.
After calling this, existing sessions should be invalid. For mutable session providers, this generally means the user has to log in again; for immutable providers, it generally means the loss of session data.
User | $user |
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 370 of file SessionManager.php.
References User\saveSettings(), and User\setToken().
MediaWiki\Session\SessionManager::isUserSessionPrevented | ( | $username | ) |
Test if a user is prevented.
string | $username |
Definition at line 452 of file SessionManager.php.
|
private |
Load and verify the session info against the store.
SessionInfo | &$info | Will likely be replaced with an updated SessionInfo instance |
WebRequest | $request |
Definition at line 587 of file SessionManager.php.
References $blob, MediaWiki\Session\SessionInfo\__toString(), MediaWiki\Session\SessionInfo\forceHTTPS(), MediaWiki\Session\SessionInfo\forceUse(), MediaWiki\Session\MetadataMergeException\getContext(), MediaWiki\Session\SessionInfo\getId(), MediaWiki\Session\SessionInfo\getPriority(), MediaWiki\Session\SessionInfo\getProvider(), MediaWiki\Session\SessionInfo\getProviderMetadata(), MediaWiki\Session\SessionInfo\getUserInfo(), MediaWiki\Session\SessionInfo\isIdSafe(), MediaWiki\Session\UserInfo\newAnonymous(), MediaWiki\Session\UserInfo\newFromId(), MediaWiki\Session\UserInfo\newFromName(), MediaWiki\Session\SessionInfo\wasPersisted(), and MediaWiki\Session\SessionInfo\wasRemembered().
MediaWiki\Session\SessionManager::logPotentialSessionLeakage | ( | Session | $session = null | ) |
If the same session is suddenly used from a different IP, that's potentially due to a session leak, so log it.
In the vast majority of cases it is a false positive due to a user switching connections, but we are interested in an audit track where we can look up a specific username, so a noisy log is fine. Also log changes to the mwuser cookie, an analytics cookie set by mediawiki.user.js which should be a little less noisy.
Session | null | $session | For testing only |
Definition at line 1036 of file SessionManager.php.
References MediaWiki\MediaWikiServices\getInstance().
|
private |
Reset the internal caching for unit testing.
Definition at line 1009 of file SessionManager.php.
References WebRequest\getHeader(), MediaWiki\Session\SessionInfo\getId(), WebRequest\getIP(), MediaWiki\Session\SessionInfo\getProvider(), and MediaWiki\Session\SessionInfo\getUserInfo().
MediaWiki\Session\SessionManager::preventSessionsForUser | ( | $username | ) |
Prevent future sessions for the user.
The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the prevention of access).
string | $username |
Definition at line 437 of file SessionManager.php.
|
static |
Reset the internal caching for unit testing.
Definition at line 998 of file SessionManager.php.
MediaWiki\Session\SessionManager::setHookContainer | ( | HookContainer | $hookContainer | ) |
HookContainer | $hookContainer |
Definition at line 242 of file SessionManager.php.
MediaWiki\Session\SessionManager::setLogger | ( | LoggerInterface | $logger | ) |
Definition at line 234 of file SessionManager.php.
MediaWiki\Session\SessionManager::setupPHPSessionHandler | ( | PHPSessionHandler | $handler | ) |
Call setters on a PHPSessionHandler.
PHPSessionHandler | $handler |
Definition at line 989 of file SessionManager.php.
References MediaWiki\Session\PHPSessionHandler\setManager().
MediaWiki\Session\SessionManager::shutdown | ( | ) |
Save all active sessions on shutdown.
Definition at line 502 of file SessionManager.php.
|
static |
Get the global SessionManager.
Definition at line 133 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$instance.
|
static |
Validate a session ID.
string | $id |
Definition at line 420 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionInfo\__construct(), MediaWiki\Session\ImmutableSessionProviderWithCookie\getSessionIdFromCookie(), and MediaWiki\Session\CookieSessionProvider\provideSessionInfo().
|
private |
Definition at line 121 of file SessionManager.php.
|
private |
Definition at line 124 of file SessionManager.php.
|
private |
Definition at line 103 of file SessionManager.php.
|
staticprivate |
Definition at line 88 of file SessionManager.php.
|
staticprivate |
Definition at line 91 of file SessionManager.php.
|
private |
Definition at line 97 of file SessionManager.php.
|
private |
Definition at line 100 of file SessionManager.php.
|
staticprivate |
Definition at line 85 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\singleton().
|
private |
Definition at line 94 of file SessionManager.php.
|
private |
Definition at line 127 of file SessionManager.php.
|
private |
Definition at line 112 of file SessionManager.php.
|
private |
Definition at line 109 of file SessionManager.php.
|
private |
Definition at line 106 of file SessionManager.php.
|
private |
Definition at line 115 of file SessionManager.php.
|
private |
Definition at line 118 of file SessionManager.php.