ImmutableSessionProviderWithCookie.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Session;
 
use MediaWiki\MainConfigNames;
use MediaWiki\Request\WebRequest;
 
abstract class ImmutableSessionProviderWithCookie extends SessionProvider {
 
    protected $sessionCookieName = null;
    protected $sessionCookieOptions = [];
 
    public function __construct( $params = [] ) {
        parent::__construct();
 
        if ( isset( $params['sessionCookieName'] ) ) {
            if ( !is_string( $params['sessionCookieName'] ) ) {
                throw new \InvalidArgumentException( 'sessionCookieName must be a string' );
            }
            $this->sessionCookieName = $params['sessionCookieName'];
        }
        if ( isset( $params['sessionCookieOptions'] ) ) {
            if ( !is_array( $params['sessionCookieOptions'] ) ) {
                throw new \InvalidArgumentException( 'sessionCookieOptions must be an array' );
            }
            $this->sessionCookieOptions = $params['sessionCookieOptions'];
        }
    }
 
    protected function getSessionIdFromCookie( WebRequest $request ) {
        if ( $this->sessionCookieName === null ) {
            throw new \BadMethodCallException(
                __METHOD__ . ' may not be called when $this->sessionCookieName === null'
            );
        }
 
        $prefix = $this->sessionCookieOptions['prefix']
            ?? $this->getConfig()->get( MainConfigNames::CookiePrefix );
        $id = $request->getCookie( $this->sessionCookieName, $prefix );
        return SessionManager::validateSessionId( $id ) ? $id : null;
    }
 
    public function persistsSessionId() {
        return $this->sessionCookieName !== null;
    }
 
    public function canChangeUser() {
        return false;
    }
 
    public function persistSession( SessionBackend $session, WebRequest $request ) {
        if ( $this->sessionCookieName === null ) {
            return;
        }
 
        $response = $request->response();
        if ( $response->headersSent() ) {
            // Can't do anything now
            $this->logger->debug( __METHOD__ . ': Headers already sent' );
            return;
        }
 
        $options = $this->sessionCookieOptions;
        if ( $session->shouldForceHTTPS() || $session->getUser()->requiresHTTPS() ) {
            // Send a cookie unless $wgForceHTTPS is set (T256095)
            if ( !$this->getConfig()->get( MainConfigNames::ForceHTTPS ) ) {
                $response->setCookie( 'forceHTTPS', 'true', null,
                    [ 'prefix' => '', 'secure' => false ] + $options );
            }
            $options['secure'] = true;
        }
 
        $response->setCookie( $this->sessionCookieName, $session->getId(), null, $options );
    }
 
    public function unpersistSession( WebRequest $request ) {
        if ( $this->sessionCookieName === null ) {
            return;
        }
 
        $response = $request->response();
        if ( $response->headersSent() ) {
            // Can't do anything now
            $this->logger->debug( __METHOD__ . ': Headers already sent' );
            return;
        }
 
        $response->clearCookie( $this->sessionCookieName, $this->sessionCookieOptions );
    }
 
    public function getVaryCookies() {
        if ( $this->sessionCookieName === null ) {
            return [];
        }
 
        $prefix = $this->sessionCookieOptions['prefix'] ??
            $this->getConfig()->get( MainConfigNames::CookiePrefix );
        return [ $prefix . $this->sessionCookieName ];
    }
 
    public function whyNoSession() {
        return wfMessage( 'sessionprovider-nocookies' );
    }
}