MediaWiki  master
ImmutableSessionProviderWithCookie.php
Go to the documentation of this file.
1 <?php
24 namespace MediaWiki\Session;
25 
26 use WebRequest;
27 
41 
43  protected $sessionCookieName = null;
45  protected $sessionCookieOptions = [];
46 
53  public function __construct( $params = [] ) {
54  parent::__construct();
55 
56  if ( isset( $params['sessionCookieName'] ) ) {
57  if ( !is_string( $params['sessionCookieName'] ) ) {
58  throw new \InvalidArgumentException( 'sessionCookieName must be a string' );
59  }
60  $this->sessionCookieName = $params['sessionCookieName'];
61  }
62  if ( isset( $params['sessionCookieOptions'] ) ) {
63  if ( !is_array( $params['sessionCookieOptions'] ) ) {
64  throw new \InvalidArgumentException( 'sessionCookieOptions must be an array' );
65  }
66  $this->sessionCookieOptions = $params['sessionCookieOptions'];
67  }
68  }
69 
81  protected function getSessionIdFromCookie( WebRequest $request ) {
82  if ( $this->sessionCookieName === null ) {
83  throw new \BadMethodCallException(
84  __METHOD__ . ' may not be called when $this->sessionCookieName === null'
85  );
86  }
87 
88  $prefix = $this->sessionCookieOptions['prefix'] ?? $this->config->get( 'CookiePrefix' );
89  $id = $request->getCookie( $this->sessionCookieName, $prefix );
90  return SessionManager::validateSessionId( $id ) ? $id : null;
91  }
92 
93  public function persistsSessionId() {
94  return $this->sessionCookieName !== null;
95  }
96 
97  public function canChangeUser() {
98  return false;
99  }
100 
101  public function persistSession( SessionBackend $session, WebRequest $request ) {
102  if ( $this->sessionCookieName === null ) {
103  return;
104  }
105 
106  $response = $request->response();
107  if ( $response->headersSent() ) {
108  // Can't do anything now
109  $this->logger->debug( __METHOD__ . ': Headers already sent' );
110  return;
111  }
112 
113  $options = $this->sessionCookieOptions;
114  if ( $session->shouldForceHTTPS() || $session->getUser()->requiresHTTPS() ) {
115  $response->setCookie( 'forceHTTPS', 'true', null,
116  [ 'prefix' => '', 'secure' => false ] + $options );
117  $options['secure'] = true;
118  }
119 
120  $response->setCookie( $this->sessionCookieName, $session->getId(), null, $options );
121  }
122 
123  public function unpersistSession( WebRequest $request ) {
124  if ( $this->sessionCookieName === null ) {
125  return;
126  }
127 
128  $response = $request->response();
129  if ( $response->headersSent() ) {
130  // Can't do anything now
131  $this->logger->debug( __METHOD__ . ': Headers already sent' );
132  return;
133  }
134 
135  $response->clearCookie( $this->sessionCookieName, $this->sessionCookieOptions );
136  }
137 
138  public function getVaryCookies() {
139  if ( $this->sessionCookieName === null ) {
140  return [];
141  }
142 
143  $prefix = $this->sessionCookieOptions['prefix'] ?? $this->config->get( 'CookiePrefix' );
144  return [ $prefix . $this->sessionCookieName ];
145  }
146 
147  public function whyNoSession() {
148  return wfMessage( 'sessionprovider-nocookies' );
149  }
150 }
getUser()
Returns the authenticated user for this session.
$response
This is the actual workhorse for Session.
response()
Return a handle to WebResponse style object, for setting cookies, headers and other stuff...
A SessionProvider provides SessionInfo and support for Session.
An ImmutableSessionProviderWithCookie doesn&#39;t persist the user, but optionally can use a cookie to su...
getId()
Returns the session ID.
getSessionIdFromCookie(WebRequest $request)
Get the session ID from the cookie, if any.
getCookie( $key, $prefix=null, $default=null)
Get a cookie from the $_COOKIE jar.
Definition: WebRequest.php:845
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
shouldForceHTTPS()
Whether HTTPS should be forced.
whyNoSession()
Return a Message for why sessions might not be being persisted.
static validateSessionId( $id)
Validate a session ID.