PHPSessionHandler.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Session;
 
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiServices;
use Psr\Log\LoggerInterface;
use Psr\Log\NullLogger;
use SessionHandlerInterface;
use Wikimedia\PhpSessionSerializer;
 
class PHPSessionHandler implements SessionHandlerInterface {
    protected static $instance = null;
 
    protected $enable = false;
 
    protected $warn = true;
 
    protected ?SessionManagerInterface $manager = null;
    protected LoggerInterface $logger;
 
    protected $sessionFieldCache = [];
 
    protected function __construct( SessionManagerInterface $manager ) {
        $this->setEnableFlags(
            MediaWikiServices::getInstance()->getMainConfig()->get( MainConfigNames::PHPSessionHandling )
        );
        if ( $manager instanceof SessionManager ) {
            $manager->setupPHPSessionHandler( $this );
        }
    }
 
    private function setEnableFlags( $PHPSessionHandling ) {
        switch ( $PHPSessionHandling ) {
            case 'enable':
                $this->enable = true;
                $this->warn = false;
                break;
 
            case 'warn':
                $this->enable = true;
                $this->warn = true;
                break;
 
            case 'disable':
                $this->enable = false;
                $this->warn = false;
                break;
        }
    }
 
    public static function isInstalled() {
        return (bool)self::$instance;
    }
 
    public static function isEnabled() {
        return self::$instance && self::$instance->enable;
    }
 
    public static function install( SessionManagerInterface $manager ) {
        /* @var SessionManager $manager*/'@phan-var SessionManager $manager';
        if ( self::$instance ) {
            $manager->setupPHPSessionHandler( self::$instance );
            return;
        }
 
        // @codeCoverageIgnoreStart
        if ( defined( 'MW_NO_SESSION_HANDLER' ) ) {
            throw new \BadMethodCallException( 'MW_NO_SESSION_HANDLER is defined' );
        }
        // @codeCoverageIgnoreEnd
 
        self::$instance = new self( $manager );
 
        // Close any auto-started session, before we replace it
        session_write_close();
 
        // Tell PHP not to mess with cookies itself
        // phpcs:ignore Generic.PHP.NoSilencedErrors.Discouraged
        @ini_set( 'session.use_cookies', 0 );
 
        // T124510: Disable automatic PHP session related cache headers.
        // MediaWiki adds its own headers and the default PHP behavior may
        // set headers such as 'Pragma: no-cache' that cause problems with
        // some user agents.
        // phpcs:ignore Generic.PHP.NoSilencedErrors.Discouraged
        @session_cache_limiter( '' );
 
        // Also set a serialization handler
        PhpSessionSerializer::setSerializeHandler();
 
        // Register this as the save handler, and register an appropriate
        // shutdown function.
        // phpcs:ignore Generic.PHP.NoSilencedErrors.Discouraged
        @session_set_save_handler( self::$instance, true );
    }
 
    private function getSessionManager(): SessionManagerInterface {
        // NOTE: PHPUnit tests also run in CLI mode, so we need to ignore them
        // otherwise tests will break in CI.
        if ( wfIsCLI() && !defined( 'MW_PHPUNIT_TEST' ) ) {
            // T405450: Don't reuse a reference of the cached session manager
            // object in command-line mode when spawning child processes. Always
            // get a fresh instance. This is because during service reset, there
            // could be references to services container that is disabled.
            return MediaWikiServices::getInstance()->getSessionManager();
        }
 
        // @phan-suppress-next-line PhanTypeMismatchReturnNullable
        return $this->manager;
    }
 
    public function setManager(
        SessionManagerInterface $manager, LoggerInterface $logger
    ) {
        if ( $this->manager !== $manager ) {
            // Close any existing session before we change stores
            if ( $this->manager ) {
                session_write_close();
            }
            $this->manager = $manager;
            $this->logger = $logger;
            PhpSessionSerializer::setLogger( $this->logger );
        }
    }
 
    #[\ReturnTypeWillChange]
    public function open( $save_path, $session_name ) {
        if ( self::$instance !== $this ) {
            throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
        }
        if ( !$this->enable ) {
            throw new \BadMethodCallException( 'Attempt to use PHP session management' );
        }
        return true;
    }
 
    #[\ReturnTypeWillChange]
    public function close() {
        if ( self::$instance !== $this ) {
            throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
        }
        $this->sessionFieldCache = [];
        return true;
    }
 
    #[\ReturnTypeWillChange]
    public function read( $id ) {
        if ( self::$instance !== $this ) {
            throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
        }
        if ( !$this->enable ) {
            throw new \BadMethodCallException( 'Attempt to use PHP session management' );
        }
 
        $session = $this->getSessionManager()->getSessionById( $id, false );
 
        if ( !$session ) {
            return '';
        }
        $session->persist();
 
        $data = iterator_to_array( $session );
        $this->sessionFieldCache[$id] = $data;
        return (string)PhpSessionSerializer::encode( $data );
    }
 
    private function valueContainsAnyObject( mixed $value ): bool {
        if ( is_object( $value ) ) {
            return true;
        }
        if ( is_array( $value ) ) {
            $result = false;
            array_walk_recursive( $value, static function ( $val ) use ( &$result ) {
                if ( is_object( $val ) ) {
                    $result = true;
                }
            } );
            return $result;
        }
        return false;
    }
 
    #[\ReturnTypeWillChange]
    public function write( $id, $dataStr ) {
        if ( self::$instance !== $this ) {
            throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
        }
        if ( !$this->enable ) {
            throw new \BadMethodCallException( 'Attempt to use PHP session management' );
        }
 
        $session = $this->getSessionManager()->getSessionById( $id, true );
        if ( !$session ) {
            // This can happen under normal circumstances, if the session exists but is
            // invalid. Let's emit a log warning instead of a PHP warning.
            $this->logger->warning(
                __METHOD__ . ': Session "{session}" cannot be loaded, skipping write.',
                [
                    'session' => $id,
                ] );
            return true;
        }
 
        // First, decode the string PHP handed us
        $data = PhpSessionSerializer::decode( $dataStr );
        if ( $data === null ) {
            // @codeCoverageIgnoreStart
            return false;
            // @codeCoverageIgnoreEnd
        }
 
        // Now merge the data into the Session object.
        $changed = [];
        $cache = $this->sessionFieldCache[$id] ?? [];
        foreach ( $data as $key => $value ) {
            if ( !array_key_exists( $key, $cache ) ) {
                if ( $session->exists( $key ) ) {
                    // New in both, so ignore and log
                    $this->logger->warning(
                        __METHOD__ . ": Key \"$key\" added in both Session and \$_SESSION!"
                    );
                } else {
                    // New in $_SESSION, keep it
                    $session->set( $key, $value );
                    $changed[] = $key;
                }
            } elseif ( $cache[$key] === $value ) {
                // Unchanged in $_SESSION, so ignore it
            } elseif (
                $this->valueContainsAnyObject( $cache[$key] ) &&
                $this->valueContainsAnyObject( $value ) &&
                PhpSessionSerializer::encode( [ $key => $cache[$key] ] ) ===
                    PhpSessionSerializer::encode( [ $key => $value ] )
            ) {
                // Also unchanged in $_SESSION. The values go through a serialize-and-deserialize
                // operation before they get here, so if anyone stored any objects in session data,
                // they will not compare as equal with `===`. Compare their serialized representation
                // in that case to avoid unnecessary session writes and spurious warnings. (T402602)
            } elseif ( !$session->exists( $key ) ) {
                // Deleted in Session, keep but log
                $this->logger->warning(
                    __METHOD__ . ": Key \"$key\" deleted in Session and changed in \$_SESSION!"
                );
                $session->set( $key, $value );
                $changed[] = $key;
            } elseif ( $cache[$key] === $session->get( $key ) ) {
                // Unchanged in Session, so keep it
                $session->set( $key, $value );
                $changed[] = $key;
            } else {
                // Changed in both, so ignore and log
                $this->logger->warning(
                    __METHOD__ . ": Key \"$key\" changed in both Session and \$_SESSION!"
                );
            }
        }
        // Anything deleted in $_SESSION and unchanged in Session should be deleted too
        // (but not if $_SESSION can't represent it at all)
        PhpSessionSerializer::setLogger( new NullLogger() );
        foreach ( $cache as $key => $value ) {
            if ( !array_key_exists( $key, $data ) && $session->exists( $key ) &&
                PhpSessionSerializer::encode( [ $key => true ] )
            ) {
                if ( $value === $session->get( $key ) ) {
                    // Unchanged in Session, delete it
                    $session->remove( $key );
                    $changed[] = $key;
                } else {
                    // Changed in Session, ignore deletion and log
                    $this->logger->warning(
                        __METHOD__ . ": Key \"$key\" changed in Session and deleted in \$_SESSION!"
                    );
                }
            }
        }
        PhpSessionSerializer::setLogger( $this->logger );
 
        // Save and update cache if anything changed
        if ( $changed ) {
            if ( $this->warn ) {
                wfDeprecated( '$_SESSION', '1.27' );
                foreach ( $changed as $key ) {
                    $this->logger->warning( "Something wrote to \$_SESSION['$key']!" );
                }
            }
 
            $session->save();
            $this->sessionFieldCache[$id] = iterator_to_array( $session );
        }
 
        $session->persist();
 
        return true;
    }
 
    #[\ReturnTypeWillChange]
    public function destroy( $id ) {
        if ( self::$instance !== $this ) {
            throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
        }
        if ( !$this->enable ) {
            throw new \BadMethodCallException( 'Attempt to use PHP session management' );
        }
        $session = $this->getSessionManager()->getSessionById( $id, false );
        if ( $session ) {
            $session->clear();
        }
        return true;
    }
 
    #[\ReturnTypeWillChange]
    public function gc( $maxlifetime ) {
        if ( self::$instance !== $this ) {
            throw new \UnexpectedValueException( __METHOD__ . ': Wrong instance called!' );
        }
        return true;
    }
}