SessionBackend.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Session;
 
use CachedBagOStuff;
use MediaWiki\HookContainer\HookContainer;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use Psr\Log\LoggerInterface;
use User;
use WebRequest;
use Wikimedia\AtEase\AtEase;
 
final class SessionBackend {
    private $id;
 
    private $persist = false;
 
    private $remember = false;
 
    private $forceHTTPS = false;
 
    private $data = null;
 
    private $forcePersist = false;
 
    private $persistenceChangeType;
 
    private $persistenceChangeData = [];
 
    private $metaDirty = false;
 
    private $dataDirty = false;
 
    private $dataHash = null;
 
    private $store;
 
    private $logger;
 
    private $hookRunner;
 
    private $lifetime;
 
    private $user;
 
    private $curIndex = 0;
 
    private $requests = [];
 
    private $provider;
 
    private $providerMetadata = null;
 
    private $expires = 0;
 
    private $loggedOut = 0;
 
    private $delaySave = 0;
 
    private $usePhpSessionHandling;
    private $checkPHPSessionRecursionGuard = false;
 
    private $shutdown = false;
 
    public function __construct(
        SessionId $id, SessionInfo $info, CachedBagOStuff $store, LoggerInterface $logger,
        HookContainer $hookContainer, $lifetime
    ) {
        $phpSessionHandling = MediaWikiServices::getInstance()->getMainConfig()
            ->get( MainConfigNames::PHPSessionHandling );
        $this->usePhpSessionHandling = $phpSessionHandling !== 'disable';
 
        if ( $info->getUserInfo() && !$info->getUserInfo()->isVerified() ) {
            throw new \InvalidArgumentException(
                "Refusing to create session for unverified user {$info->getUserInfo()}"
            );
        }
        if ( $info->getProvider() === null ) {
            throw new \InvalidArgumentException( 'Cannot create session without a provider' );
        }
        if ( $info->getId() !== $id->getId() ) {
            throw new \InvalidArgumentException( 'SessionId and SessionInfo don\'t match' );
        }
 
        $this->id = $id;
        $this->user = $info->getUserInfo() ? $info->getUserInfo()->getUser() : new User;
        $this->store = $store;
        $this->logger = $logger;
        $this->hookRunner = new HookRunner( $hookContainer );
        $this->lifetime = $lifetime;
        $this->provider = $info->getProvider();
        $this->persist = $info->wasPersisted();
        $this->remember = $info->wasRemembered();
        $this->forceHTTPS = $info->forceHTTPS();
        $this->providerMetadata = $info->getProviderMetadata();
 
        $blob = $store->get( $store->makeKey( 'MWSession', (string)$this->id ) );
        if ( !is_array( $blob ) ||
            !isset( $blob['metadata'] ) || !is_array( $blob['metadata'] ) ||
            !isset( $blob['data'] ) || !is_array( $blob['data'] )
        ) {
            $this->data = [];
            $this->dataDirty = true;
            $this->metaDirty = true;
            $this->persistenceChangeType = 'no-store';
            $this->logger->debug(
                'SessionBackend "{session}" is unsaved, marking dirty in constructor',
                [
                    'session' => $this->id->__toString(),
            ] );
        } else {
            $this->data = $blob['data'];
            if ( isset( $blob['metadata']['loggedOut'] ) ) {
                $this->loggedOut = (int)$blob['metadata']['loggedOut'];
            }
            if ( isset( $blob['metadata']['expires'] ) ) {
                $this->expires = (int)$blob['metadata']['expires'];
            } else {
                $this->metaDirty = true;
                $this->persistenceChangeType = 'no-expiry';
                $this->logger->debug(
                    'SessionBackend "{session}" metadata dirty due to missing expiration timestamp',
                [
                    'session' => $this->id->__toString(),
                ] );
            }
        }
        $this->dataHash = md5( serialize( $this->data ) );
    }
 
    public function getSession( WebRequest $request ) {
        $index = ++$this->curIndex;
        $this->requests[$index] = $request;
        $session = new Session( $this, $index, $this->logger );
        return $session;
    }
 
    public function deregisterSession( $index ) {
        unset( $this->requests[$index] );
        if ( !$this->shutdown && !count( $this->requests ) ) {
            $this->save( true );
            $this->provider->getManager()->deregisterSessionBackend( $this );
        }
    }
 
    public function shutdown() {
        $this->save( true );
        $this->shutdown = true;
    }
 
    public function getId() {
        return (string)$this->id;
    }
 
    public function getSessionId() {
        return $this->id;
    }
 
    public function resetId() {
        if ( $this->provider->persistsSessionId() ) {
            $oldId = (string)$this->id;
            $restart = $this->usePhpSessionHandling && $oldId === session_id() &&
                PHPSessionHandler::isEnabled();
 
            if ( $restart ) {
                // If this session is the one behind PHP's $_SESSION, we need
                // to close then reopen it.
                session_write_close();
            }
 
            $this->provider->getManager()->changeBackendId( $this );
            $this->provider->sessionIdWasReset( $this, $oldId );
            $this->metaDirty = true;
            $this->logger->debug(
                'SessionBackend "{session}" metadata dirty due to ID reset (formerly "{oldId}")',
                [
                    'session' => $this->id->__toString(),
                    'oldId' => $oldId,
            ] );
 
            if ( $restart ) {
                session_id( (string)$this->id );
                AtEase::quietCall( 'session_start' );
            }
 
            $this->autosave();
 
            // Delete the data for the old session ID now
            $this->store->delete( $this->store->makeKey( 'MWSession', $oldId ) );
        }
 
        return $this->id;
    }
 
    public function getProvider() {
        return $this->provider;
    }
 
    public function isPersistent() {
        return $this->persist;
    }
 
    public function persist() {
        if ( !$this->persist ) {
            $this->persist = true;
            $this->forcePersist = true;
            $this->metaDirty = true;
            $this->logger->debug(
                'SessionBackend "{session}" force-persist due to persist()',
                [
                    'session' => $this->id->__toString(),
            ] );
            $this->autosave();
        } else {
            $this->renew();
        }
    }
 
    public function unpersist() {
        if ( $this->persist ) {
            // Close the PHP session, if we're the one that's open
            if ( $this->usePhpSessionHandling && PHPSessionHandler::isEnabled() &&
                session_id() === (string)$this->id
            ) {
                $this->logger->debug(
                    'SessionBackend "{session}" Closing PHP session for unpersist',
                    [ 'session' => $this->id->__toString() ]
                );
                session_write_close();
                session_id( '' );
            }
 
            $this->persist = false;
            $this->forcePersist = true;
            $this->metaDirty = true;
 
            // Delete the session data, so the local cache-only write in
            // self::save() doesn't get things out of sync with the backend.
            $this->store->delete( $this->store->makeKey( 'MWSession', (string)$this->id ) );
 
            $this->autosave();
        }
    }
 
    public function shouldRememberUser() {
        return $this->remember;
    }
 
    public function setRememberUser( $remember ) {
        if ( $this->remember !== (bool)$remember ) {
            $this->remember = (bool)$remember;
            $this->metaDirty = true;
            $this->logger->debug(
                'SessionBackend "{session}" metadata dirty due to remember-user change',
                [
                    'session' => $this->id->__toString(),
            ] );
            $this->autosave();
        }
    }
 
    public function getRequest( $index ) {
        if ( !isset( $this->requests[$index] ) ) {
            throw new \InvalidArgumentException( 'Invalid session index' );
        }
        return $this->requests[$index];
    }
 
    public function getUser() {
        return $this->user;
    }
 
    public function getAllowedUserRights() {
        return $this->provider->getAllowedUserRights( $this );
    }
 
    public function canSetUser() {
        return $this->provider->canChangeUser();
    }
 
    public function setUser( $user ) {
        if ( !$this->canSetUser() ) {
            throw new \BadMethodCallException(
                'Cannot set user on this session; check $session->canSetUser() first'
            );
        }
 
        $this->user = $user;
        $this->metaDirty = true;
        $this->logger->debug(
            'SessionBackend "{session}" metadata dirty due to user change',
            [
                'session' => $this->id->__toString(),
        ] );
        $this->autosave();
    }
 
    public function suggestLoginUsername( $index ) {
        if ( !isset( $this->requests[$index] ) ) {
            throw new \InvalidArgumentException( 'Invalid session index' );
        }
        return $this->provider->suggestLoginUsername( $this->requests[$index] );
    }
 
    public function shouldForceHTTPS() {
        return $this->forceHTTPS;
    }
 
    public function setForceHTTPS( $force ) {
        if ( $this->forceHTTPS !== (bool)$force ) {
            $this->forceHTTPS = (bool)$force;
            $this->metaDirty = true;
            $this->logger->debug(
                'SessionBackend "{session}" metadata dirty due to force-HTTPS change',
                [
                    'session' => $this->id->__toString(),
            ] );
            $this->autosave();
        }
    }
 
    public function getLoggedOutTimestamp() {
        return $this->loggedOut;
    }
 
    public function setLoggedOutTimestamp( $ts = null ) {
        $ts = (int)$ts;
        if ( $this->loggedOut !== $ts ) {
            $this->loggedOut = $ts;
            $this->metaDirty = true;
            $this->logger->debug(
                'SessionBackend "{session}" metadata dirty due to logged-out-timestamp change',
                [
                    'session' => $this->id->__toString(),
            ] );
            $this->autosave();
        }
    }
 
    public function getProviderMetadata() {
        return $this->providerMetadata;
    }
 
    public function setProviderMetadata( $metadata ) {
        if ( $metadata !== null && !is_array( $metadata ) ) {
            throw new \InvalidArgumentException( '$metadata must be an array or null' );
        }
        if ( $this->providerMetadata !== $metadata ) {
            $this->providerMetadata = $metadata;
            $this->metaDirty = true;
            $this->logger->debug(
                'SessionBackend "{session}" metadata dirty due to provider metadata change',
                [
                    'session' => $this->id->__toString(),
            ] );
            $this->autosave();
        }
    }
 
    public function &getData() {
        return $this->data;
    }
 
    public function addData( array $newData ) {
        $data = &$this->getData();
        foreach ( $newData as $key => $value ) {
            if ( !array_key_exists( $key, $data ) || $data[$key] !== $value ) {
                $data[$key] = $value;
                $this->dataDirty = true;
                $this->logger->debug(
                    'SessionBackend "{session}" data dirty due to addData(): {callers}',
                    [
                        'session' => $this->id->__toString(),
                        'callers' => wfGetAllCallers( 5 ),
                ] );
            }
        }
    }
 
    public function dirty() {
        $this->dataDirty = true;
        $this->logger->debug(
            'SessionBackend "{session}" data dirty due to dirty(): {callers}',
            [
                'session' => $this->id->__toString(),
                'callers' => wfGetAllCallers( 5 ),
        ] );
    }
 
    public function renew() {
        if ( time() + $this->lifetime / 2 > $this->expires ) {
            $this->metaDirty = true;
            $this->logger->debug(
                'SessionBackend "{callers}" metadata dirty for renew(): {callers}',
                [
                    'session' => $this->id->__toString(),
                    'callers' => wfGetAllCallers( 5 ),
            ] );
            if ( $this->persist ) {
                $this->persistenceChangeType = 'renew';
                $this->forcePersist = true;
                $this->logger->debug(
                    'SessionBackend "{session}" force-persist for renew(): {callers}',
                    [
                        'session' => $this->id->__toString(),
                        'callers' => wfGetAllCallers( 5 ),
                ] );
            }
        }
        $this->autosave();
    }
 
    public function delaySave() {
        $this->delaySave++;
        return new \Wikimedia\ScopedCallback( function () {
            if ( --$this->delaySave <= 0 ) {
                $this->delaySave = 0;
                $this->save();
            }
        } );
    }
 
    private function autosave() {
        if ( $this->delaySave <= 0 ) {
            $this->save();
        }
    }
 
    public function save( $closing = false ) {
        $anon = $this->user->isAnon();
 
        if ( !$anon && $this->provider->getManager()->isUserSessionPrevented( $this->user->getName() ) ) {
            $this->logger->debug(
                'SessionBackend "{session}" not saving, user {user} was ' .
                'passed to SessionManager::preventSessionsForUser',
                [
                    'session' => $this->id->__toString(),
                    'user' => $this->user->__toString(),
            ] );
            return;
        }
 
        // Ensure the user has a token
        // @codeCoverageIgnoreStart
        if ( !$anon && !$this->user->getToken( false ) ) {
            $this->logger->debug(
                'SessionBackend "{session}" creating token for user {user} on save',
                [
                    'session' => $this->id->__toString(),
                    'user' => $this->user->__toString(),
            ] );
            $this->user->setToken();
            if ( !MediaWikiServices::getInstance()->getReadOnlyMode()->isReadOnly() ) {
                // Promise that the token set here will be valid; save it at end of request
                $user = $this->user;
                \DeferredUpdates::addCallableUpdate( static function () use ( $user ) {
                    $user->saveSettings();
                } );
            }
            $this->metaDirty = true;
        }
        // @codeCoverageIgnoreEnd
 
        if ( !$this->metaDirty && !$this->dataDirty &&
            $this->dataHash !== md5( serialize( $this->data ) )
        ) {
            $this->logger->debug(
                'SessionBackend "{session}" data dirty due to hash mismatch, {expected} !== {got}',
                [
                    'session' => $this->id->__toString(),
                    'expected' => $this->dataHash,
                    'got' => md5( serialize( $this->data ) ),
            ] );
            $this->dataDirty = true;
        }
 
        if ( !$this->metaDirty && !$this->dataDirty && !$this->forcePersist ) {
            return;
        }
 
        $this->logger->debug(
            'SessionBackend "{session}" save: dataDirty={dataDirty} ' .
            'metaDirty={metaDirty} forcePersist={forcePersist}',
            [
                'session' => $this->id->__toString(),
                'dataDirty' => (int)$this->dataDirty,
                'metaDirty' => (int)$this->metaDirty,
                'forcePersist' => (int)$this->forcePersist,
        ] );
 
        // Persist or unpersist to the provider, if necessary
        if ( $this->metaDirty || $this->forcePersist ) {
            if ( $this->persist ) {
                foreach ( $this->requests as $request ) {
                    $request->setSessionId( $this->getSessionId() );
                    $this->logPersistenceChange( $request, true );
                    $this->provider->persistSession( $this, $request );
                }
                if ( !$closing ) {
                    $this->checkPHPSession();
                }
            } else {
                foreach ( $this->requests as $request ) {
                    if ( $request->getSessionId() === $this->id ) {
                        $this->logPersistenceChange( $request, false );
                        $this->provider->unpersistSession( $request );
                    }
                }
            }
        }
 
        $this->forcePersist = false;
        $this->persistenceChangeType = null;
 
        if ( !$this->metaDirty && !$this->dataDirty ) {
            return;
        }
 
        // Save session data to store, if necessary
        $metadata = $origMetadata = [
            'provider' => (string)$this->provider,
            'providerMetadata' => $this->providerMetadata,
            'userId' => $anon ? 0 : $this->user->getId(),
            'userName' => MediaWikiServices::getInstance()->getUserNameUtils()
                ->isValid( $this->user->getName() ) ? $this->user->getName() : null,
            'userToken' => $anon ? null : $this->user->getToken(),
            'remember' => !$anon && $this->remember,
            'forceHTTPS' => $this->forceHTTPS,
            'expires' => time() + $this->lifetime,
            'loggedOut' => $this->loggedOut,
            'persisted' => $this->persist,
        ];
 
        $this->hookRunner->onSessionMetadata( $this, $metadata, $this->requests );
 
        foreach ( $origMetadata as $k => $v ) {
            if ( $metadata[$k] !== $v ) {
                throw new \UnexpectedValueException( "SessionMetadata hook changed metadata key \"$k\"" );
            }
        }
 
        $flags = $this->persist ? 0 : CachedBagOStuff::WRITE_CACHE_ONLY;
        $this->store->set(
            $this->store->makeKey( 'MWSession', (string)$this->id ),
            [
                'data' => $this->data,
                'metadata' => $metadata,
            ],
            $metadata['expires'],
            $flags
        );
 
        $this->metaDirty = false;
        $this->dataDirty = false;
        $this->dataHash = md5( serialize( $this->data ) );
        $this->expires = $metadata['expires'];
    }
 
    private function checkPHPSession() {
        if ( !$this->checkPHPSessionRecursionGuard ) {
            $this->checkPHPSessionRecursionGuard = true;
            $reset = new \Wikimedia\ScopedCallback( function () {
                $this->checkPHPSessionRecursionGuard = false;
            } );
 
            if ( $this->usePhpSessionHandling && session_id() === '' && PHPSessionHandler::isEnabled() &&
                SessionManager::getGlobalSession()->getId() === (string)$this->id
            ) {
                $this->logger->debug(
                    'SessionBackend "{session}" Taking over PHP session',
                    [
                        'session' => $this->id->__toString(),
                ] );
                session_id( (string)$this->id );
                AtEase::quietCall( 'session_start' );
            }
        }
    }
 
    private function logPersistenceChange( WebRequest $request, bool $persist ) {
        if ( !$this->isPersistent() && !$persist ) {
            // FIXME SessionManager calls unpersistSession() on anonymous requests (and the cookie
            //   filtering in WebResponse makes it a noop). Skip those.
            return;
        }
 
        $verb = $persist ? 'Persisting' : 'Unpersisting';
        if ( $this->persistenceChangeType === 'renew' ) {
            $message = "$verb session for renewal";
        } elseif ( $this->persistenceChangeType === 'no-store' ) {
            $message = "$verb session due to no pre-existing stored session";
        } elseif ( $this->persistenceChangeType === 'no-expiry' ) {
            $message = "$verb session due to lack of stored expiry";
        } elseif ( $this->persistenceChangeType === null ) {
            $message = "$verb session for unknown reason";
        }
 
        // Because SessionManager repeats session loading several times in the same request,
        // it will try to persist or unpersist several times. WebResponse deduplicates, but
        // we want to deduplicate logging as well since the volume is already fairly large.
        $id = $this->getId();
        $user = $this->getUser()->isAnon() ? '<anon>' : $this->getUser()->getName();
        if ( $this->persistenceChangeData
            && $this->persistenceChangeData['id'] === $id
            && $this->persistenceChangeData['user'] === $user
            // @phan-suppress-next-line PhanPossiblyUndeclaredVariable message always set
            && $this->persistenceChangeData['message'] === $message
        ) {
            return;
        }
        // @phan-suppress-next-line PhanPossiblyUndeclaredVariable message always set
        $this->persistenceChangeData = [ 'id' => $id, 'user' => $user, 'message' => $message ];
 
        // @phan-suppress-next-line PhanTypeMismatchArgumentNullable,PhanPossiblyUndeclaredVariable message always set
        $this->logger->info( $message, [
            'id' => $id,
            'provider' => get_class( $this->getProvider() ),
            'user' => $user,
            'clientip' => $request->getIP(),
            'userAgent' => $request->getHeader( 'user-agent' ),
        ] );
    }
 
}