SetCookieCompat.php

Go to the documentation of this file.

<?php
 
namespace Wikimedia\Http;
 
class SetCookieCompat {
    public static function setcookie( $name, $value, $options = [] ) {
        return ( new self )->setCookieInternal( true, $name, $value, $options );
    }
 
    public static function setrawcookie( $name, $value, $options = [] ) {
        return ( new self )->setCookieInternal( false, $name, $value, $options );
    }
 
    public function setCookieInternal( $urlEncode, $name, $value, $options = [] ) {
        $supportsAssoc = version_compare( PHP_VERSION, '7.3.0', '>=' );
        if ( $supportsAssoc ) {
            if ( $urlEncode && version_compare( PHP_VERSION, '7.4.3', '>=' ) ) {
                return setcookie( $name, $value, $options );
            } elseif ( $urlEncode ) {
                return setrawcookie( $name, rawurlencode( $value ), $options );
            } else {
                return setrawcookie( $name, $value, $options );
            }
        }
 
        if ( !isset( $options['samesite'] ) || !strlen( $options['samesite'] ) ) {
            return setrawcookie(
                $name,
                $urlEncode ? rawurlencode( $value ) : $value,
                $options['expires'],
                $options['path'],
                $options['domain'],
                $options['secure'],
                $options['httponly']
            );
        }
 
        return self::setCookieEmulated( $urlEncode, $name, $value, $options );
    }
 
    public function setCookieEmulated( $urlEncode, $name, $value, $options = [] ) {
        $func = $urlEncode ? 'setcookie()' : 'setrawcookie()';
        $expires = 0;
        $path = null;
        $domain = null;
        $secure = false;
        $httponly = false;
        $samesite = null;
        $found = 0;
        foreach ( $options as $key => $opt ) {
            if ( $key === 'expires' ) {
                $expires = (int)$opt;
                $found++;
            } elseif ( $key === 'path' ) {
                $path = (string)$opt;
                $found++;
            } elseif ( $key === 'domain' ) {
                $domain = (string)$opt;
                $found++;
            } elseif ( $key === 'secure' ) {
                $secure = (bool)$opt;
                $found++;
            } elseif ( $key === 'httponly' ) {
                $httponly = (bool)$opt;
                $found++;
            } elseif ( $key === 'samesite' ) {
                $samesite = (string)$opt;
                $found++;
            } else {
                $this->error( "$func: Unrecognized key '$key' found in the options array" );
            }
        }
 
        if ( $found == 0 && count( $options ) > 0 ) {
            $this->error( "$func: No valid options were found in the given array" );
        }
 
        if ( !strlen( $name ) ) {
            $this->error( 'Cookie names must not be empty' );
            return false;
        } elseif ( strpbrk( $name, "=,; \t\r\n\013\014" ) !== false ) {
            $this->error( "Cookie names cannot contain any of the following " .
                "'=,; \\t\\r\\n\\013\\014'" );
            return false;
        }
 
        if ( !$urlEncode && $value !== null
            && strpbrk( $value, ",; \t\r\n\013\014" ) !== false
        ) {
            $this->error( "Cookie values cannot contain any of the following ',; \\t\\r\\n\\013\\014'" );
            return false;
        }
 
        if ( $path !== null && strpbrk( $path, ",; \t\r\n\013\014" ) !== false ) {
            $this->error( "Cookie paths cannot contain any of the following ',; \\t\\r\\n\\013\\014'" );
            return false;
        }
 
        if ( $domain !== null && strpbrk( $domain, ",; \t\r\n\013\014" ) !== false ) {
            $this->error( "Cookie domains cannot contain any of the following ',; \\t\\r\\n\\013\\014'" );
            return false;
        }
 
        $buf = '';
        if ( $value === null || strlen( $value ) === 0 ) {
            $dt = gmdate( "D, d-M-Y H:i:s T", 1 );
            $buf .= "Set-Cookie: $name=deleted; expires=$dt; Max-Age=0";
        } else {
            $buf .= "Set-Cookie: $name=";
            if ( $urlEncode ) {
                $buf .= rawurlencode( $value );
            } else {
                $buf .= $value;
            }
 
            if ( $expires > 0 ) {
                $dt = gmdate( "D, d-M-Y H:i:s T", $expires );
                $p = strrpos( $dt, '-' );
                if ( $p === false || substr( $dt, $p + 5, 1 ) !== ' ' ) {
                    $this->error( "Expiry date cannot have a year greater than 9999" );
                    return false;
                }
 
                $buf .= "; expires=$dt";
 
                $diff = $expires - $this->time();
                if ( $diff < 0 ) {
                    $diff = 0;
                }
                $buf .= "; Max-Age=$diff";
            }
        }
 
        if ( $path !== null && strlen( $path ) ) {
            $buf .= "; path=$path";
        }
        if ( $domain !== null && strlen( $domain ) ) {
            $buf .= "; domain=$domain";
        }
        if ( $secure ) {
            $buf .= "; secure";
        }
        if ( $httponly ) {
            $buf .= "; HttpOnly";
        }
        if ( $samesite !== null && strlen( $samesite ) ) {
            $buf .= "; SameSite=$samesite";
        }
 
        // sapi_header_op() returns a value which setcookie() uses, but
        // header() discards it. The most likely way for sapi_header_op() to
        // fail is due to headers already being sent.
        if ( $this->headers_sent() ) {
            $this->error( "Cannot modify header information - headers already sent" );
            return false;
        }
        $this->header( $buf );
        return true;
    }
 
    protected function time() {
        return time();
    }
 
    protected function error( $message ) {
        trigger_error( $message, E_USER_WARNING );
    }
 
    protected function headers_sent() {
        return headers_sent();
    }
 
    protected function header( $header ) {
        header( $header, false );
    }
}