MediaWiki
master
|
This serves as the entry point to the MediaWiki session handling system. More...
Public Member Functions | |
__construct ( $options=[]) | |
getEmptySession (WebRequest $request=null) | |
Create a new, empty session. More... | |
getSessionById ( $id, $create=false, WebRequest $request=null) | |
Fetch a session by ID. More... | |
getSessionForRequest (WebRequest $request) | |
Fetch the session for a request (or a new empty session if none is attached to it) More... | |
getVaryCookies () | |
Return the list of cookies that need varying on. More... | |
getVaryHeaders () | |
Return the HTTP headers that need varying on. More... | |
invalidateSessionsForUser (User $user) | |
Invalidate sessions for a user. More... | |
setHookContainer (HookContainer $hookContainer) | |
setLogger (LoggerInterface $logger) | |
Static Public Member Functions | |
static | getGlobalSession () |
If PHP's session_id() has been set, returns that session. More... | |
static | singleton () |
Get the global SessionManager. More... | |
static | validateSessionId ( $id) |
Validate a session ID. More... | |
Private Member Functions | |
getEmptySessionInternal (WebRequest $request=null, $id=null) | |
Private Attributes | |
SessionBackend[] | $allSessionBackends = [] |
SessionId[] | $allSessionIds = [] |
Config | $config |
HookContainer | $hookContainer |
HookRunner | $hookRunner |
LoggerInterface | $logger |
string[] | $preventUsers = [] |
SessionProvider[] | $sessionProviders = null |
CachedBagOStuff null | $store |
string[] | $varyCookies = null |
array | $varyHeaders = null |
Static Private Attributes | |
static Session null | $globalSession = null |
static WebRequest null | $globalSessionRequest = null |
static SessionManager null | $instance = null |
Internal methods | |
static | resetCache () |
Reset the internal caching for unit testing. More... | |
preventSessionsForUser ( $username) | |
Prevent future sessions for the user. More... | |
isUserSessionPrevented ( $username) | |
Test if a user is prevented. More... | |
getProvider ( $name) | |
Get a session provider by name. More... | |
shutdown () | |
Save all active sessions on shutdown. More... | |
getSessionFromInfo (SessionInfo $info, WebRequest $request) | |
Create a Session corresponding to the passed SessionInfo. More... | |
deregisterSessionBackend (SessionBackend $backend) | |
Deregister a SessionBackend. More... | |
changeBackendId (SessionBackend $backend) | |
Change a SessionBackend's ID. More... | |
generateSessionId () | |
Generate a new random session ID. More... | |
setupPHPSessionHandler (PHPSessionHandler $handler) | |
Call setters on a PHPSessionHandler. More... | |
logPotentialSessionLeakage (Session $session=null) | |
If the same session is suddenly used from a different IP, that's potentially due to a session leak, so log it. More... | |
getSessionInfoForRequest (WebRequest $request) | |
Fetch the SessionInfo(s) for a request. More... | |
loadSessionInfoFromStore (SessionInfo &$info, WebRequest $request) | |
Load and verify the session info against the store. More... | |
logUnpersist (SessionInfo $info, WebRequest $request) | |
Reset the internal caching for unit testing. More... | |
getProviders () | |
Get the available SessionProviders. More... | |
This serves as the entry point to the MediaWiki session handling system.
Most methods here are for internal use by session handling code. Other callers should only use getGlobalSession and the methods of SessionManagerInterface; the rest of the functionality is exposed via MediaWiki\Session\Session methods.
To provide custom session handling, implement a MediaWiki\Session\SessionProvider.
Definition at line 53 of file SessionManager.php.
MediaWiki\Session\SessionManager::__construct | ( | $options = [] | ) |
array | $options |
Definition at line 154 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$store, ObjectCache\getInstance(), MediaWiki\MediaWikiServices\getInstance(), MediaWiki\Session\SessionManager\setHookContainer(), and MediaWiki\Session\SessionManager\setLogger().
MediaWiki\Session\SessionManager::changeBackendId | ( | SessionBackend | $backend | ) |
Change a SessionBackend's ID.
Definition at line 915 of file SessionManager.php.
References MediaWiki\Session\SessionManager\generateSessionId(), and MediaWiki\Session\SessionBackend\getSessionId().
MediaWiki\Session\SessionManager::deregisterSessionBackend | ( | SessionBackend | $backend | ) |
Deregister a SessionBackend.
Definition at line 897 of file SessionManager.php.
References MediaWiki\Session\SessionBackend\getId(), and MediaWiki\Session\SessionBackend\getSessionId().
MediaWiki\Session\SessionManager::generateSessionId | ( | ) |
Generate a new random session ID.
Definition at line 937 of file SessionManager.php.
References MWCryptRand\generateHex().
Referenced by MediaWiki\Session\SessionManager\changeBackendId().
MediaWiki\Session\SessionManager::getEmptySession | ( | WebRequest | $request = null | ) |
Create a new, empty session.
The first provider configured that is able to provide an empty session will be used.
WebRequest | null | $request | Corresponding request. Any existing session associated with this WebRequest object will be overwritten. |
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 266 of file SessionManager.php.
References MediaWiki\Session\SessionManager\getEmptySessionInternal().
Referenced by MediaWiki\Session\SessionManager\getSessionForRequest().
|
private |
WebRequest | null | $request | |
string | null | $id | ID to force on the new session |
Definition at line 276 of file SessionManager.php.
References MediaWiki\Session\SessionInfo\compare(), MediaWiki\Session\SessionManager\getProviders(), and MediaWiki\Session\SessionManager\getSessionFromInfo().
Referenced by MediaWiki\Session\SessionManager\getEmptySession(), and MediaWiki\Session\SessionManager\getSessionById().
|
static |
If PHP's session_id() has been set, returns that session.
Otherwise returns the session for RequestContext::getMain()->getRequest().
Definition at line 113 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$globalSession, RequestContext\getMain(), MediaWiki\Session\PHPSessionHandler\isEnabled(), and MediaWiki\Session\SessionManager\singleton().
Referenced by MediaWiki\Auth\RememberMeAuthenticationRequest\__construct(), MediaWiki\Session\SessionBackend\checkPHPSession(), ApiLogin\execute(), ApiLogout\execute(), RequestContext\exportSession(), MediaWiki\Permissions\PermissionManager\isEveryoneAllowed(), MediaWiki\Session\SessionManager\logPotentialSessionLeakage(), SpecialUserLogout\onSubmit(), RawAction\onView(), McrUndoAction\show(), and SubmitAction\show().
MediaWiki\Session\SessionManager::getProvider | ( | $name | ) |
Get a session provider by name.
Generally, this will only be used by internal implementation of some special session-providing mechanism. General purpose code, if it needs to access a SessionProvider at all, will use Session::getProvider().
string | $name |
Definition at line 456 of file SessionManager.php.
References MediaWiki\Session\SessionManager\getProviders().
Referenced by MediaWiki\Session\SessionManager\loadSessionInfoFromStore().
|
protected |
Get the available SessionProviders.
Definition at line 426 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$sessionProviders, MediaWiki\Session\SessionProvider\setConfig(), MediaWiki\Session\SessionProvider\setHookContainer(), MediaWiki\Session\SessionProvider\setLogger(), and MediaWiki\Session\SessionProvider\setManager().
Referenced by MediaWiki\Session\SessionManager\getEmptySessionInternal(), MediaWiki\Session\SessionManager\getProvider(), MediaWiki\Session\SessionManager\getSessionInfoForRequest(), MediaWiki\Session\SessionManager\getVaryCookies(), MediaWiki\Session\SessionManager\getVaryHeaders(), MediaWiki\Session\SessionManager\invalidateSessionsForUser(), and MediaWiki\Session\SessionManager\preventSessionsForUser().
MediaWiki\Session\SessionManager::getSessionById | ( | $id, | |
$create = false , |
|||
WebRequest | $request = null |
||
) |
Fetch a session by ID.
string | $id | |
bool | $create | If no session exists for $id, try to create a new one. May still return null if a session for $id exists but cannot be loaded. |
WebRequest | null | $request | Corresponding request. Any existing session associated with this WebRequest object will be overwritten. |
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 224 of file SessionManager.php.
References MediaWiki\Session\SessionManager\getEmptySessionInternal(), MediaWiki\Session\SessionManager\getSessionFromInfo(), MediaWiki\Session\SessionManager\loadSessionInfoFromStore(), and MediaWiki\Session\SessionInfo\MIN_PRIORITY.
MediaWiki\Session\SessionManager::getSessionForRequest | ( | WebRequest | $request | ) |
Fetch the session for a request (or a new empty session if none is attached to it)
WebRequest | $request | Any existing associated session will be reset to the session corresponding to the data in the request itself. |
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 213 of file SessionManager.php.
References MediaWiki\Session\SessionManager\getEmptySession(), MediaWiki\Session\SessionManager\getSessionFromInfo(), and MediaWiki\Session\SessionManager\getSessionInfoForRequest().
MediaWiki\Session\SessionManager::getSessionFromInfo | ( | SessionInfo | $info, |
WebRequest | $request | ||
) |
Create a Session corresponding to the passed SessionInfo.
Definition at line 840 of file SessionManager.php.
References MediaWiki\Session\SessionInfo\getId(), MediaWiki\Session\SessionInfo\isIdSafe(), MW_NO_SESSION, WebRequest\setSessionId(), MediaWiki\Session\SessionInfo\wasPersisted(), and MediaWiki\Session\SessionInfo\wasRemembered().
Referenced by MediaWiki\Session\SessionManager\getEmptySessionInternal(), MediaWiki\Session\SessionManager\getSessionById(), and MediaWiki\Session\SessionManager\getSessionForRequest().
|
private |
Fetch the SessionInfo(s) for a request.
WebRequest | $request |
Definition at line 484 of file SessionManager.php.
References MediaWiki\Session\SessionInfo\compare(), MediaWiki\Session\SessionManager\getProviders(), MediaWiki\Session\SessionManager\loadSessionInfoFromStore(), and MediaWiki\Session\SessionManager\logUnpersist().
Referenced by MediaWiki\Session\SessionManager\getSessionForRequest().
MediaWiki\Session\SessionManager::getVaryCookies | ( | ) |
Return the list of cookies that need varying on.
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 365 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$varyCookies, MediaWiki\Session\SessionManager\getProviders(), and MW_NO_SESSION.
MediaWiki\Session\SessionManager::getVaryHeaders | ( | ) |
Return the HTTP headers that need varying on.
The return value is such that someone could theoretically do this:
Note that the $options argument to OutputPage::addVaryHeader() has been deprecated and should always be null.
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 345 of file SessionManager.php.
References $header, MediaWiki\Session\SessionManager\$varyHeaders, MediaWiki\Session\SessionManager\getProviders(), and MW_NO_SESSION.
MediaWiki\Session\SessionManager::invalidateSessionsForUser | ( | User | $user | ) |
Invalidate sessions for a user.
After calling this, existing sessions should be invalid. For mutable session providers, this generally means the user has to log in again; for immutable providers, it generally means the loss of session data.
User | $user |
Implements MediaWiki\Session\SessionManagerInterface.
Definition at line 336 of file SessionManager.php.
References MediaWiki\Session\SessionManager\getProviders(), User\saveSettings(), and User\setToken().
MediaWiki\Session\SessionManager::isUserSessionPrevented | ( | $username | ) |
Test if a user is prevented.
Definition at line 418 of file SessionManager.php.
|
private |
Load and verify the session info against the store.
SessionInfo | &$info | Will likely be replaced with an updated SessionInfo instance |
WebRequest | $request |
Definition at line 550 of file SessionManager.php.
References $blob, MediaWiki\Session\SessionInfo\forceHTTPS(), MediaWiki\Session\SessionInfo\forceUse(), MediaWiki\Session\MetadataMergeException\getContext(), MediaWiki\Session\SessionInfo\getId(), MediaWiki\Session\SessionInfo\getPriority(), MediaWiki\Session\SessionManager\getProvider(), MediaWiki\Session\SessionInfo\getProvider(), MediaWiki\Session\SessionInfo\getProviderMetadata(), MediaWiki\Session\SessionInfo\getUserInfo(), MediaWiki\Session\SessionInfo\isIdSafe(), MediaWiki\Session\UserInfo\newAnonymous(), MediaWiki\Session\UserInfo\newFromId(), MediaWiki\Session\UserInfo\newFromName(), MediaWiki\Session\SessionInfo\wasPersisted(), and MediaWiki\Session\SessionInfo\wasRemembered().
Referenced by MediaWiki\Session\SessionManager\getSessionById(), and MediaWiki\Session\SessionManager\getSessionInfoForRequest().
MediaWiki\Session\SessionManager::logPotentialSessionLeakage | ( | Session | $session = null | ) |
If the same session is suddenly used from a different IP, that's potentially due to a session leak, so log it.
In the vast majority of cases it is a false positive due to a user switching connections, but we are interested in an audit track where we can look up a specific username, so a noisy log is fine. Also log changes to the mwuser cookie, an analytics cookie set by mediawiki.user.js which should be a little less noisy.
Session | null | $session | For testing only |
Definition at line 997 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$logger, MediaWiki\Session\SessionManager\getGlobalSession(), MediaWiki\Logger\LoggerFactory\getInstance(), and MediaWiki\MediaWikiServices\getInstance().
|
private |
Reset the internal caching for unit testing.
Definition at line 970 of file SessionManager.php.
References WebRequest\getHeader(), MediaWiki\Session\SessionInfo\getId(), WebRequest\getIP(), MediaWiki\Session\SessionInfo\getProvider(), and MediaWiki\Session\SessionInfo\getUserInfo().
Referenced by MediaWiki\Session\SessionManager\getSessionInfoForRequest().
MediaWiki\Session\SessionManager::preventSessionsForUser | ( | $username | ) |
Prevent future sessions for the user.
The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the prevention of access).
Definition at line 403 of file SessionManager.php.
References MediaWiki\Session\SessionManager\getProviders().
|
static |
Reset the internal caching for unit testing.
Definition at line 959 of file SessionManager.php.
MediaWiki\Session\SessionManager::setHookContainer | ( | HookContainer | $hookContainer | ) |
Definition at line 208 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$hookContainer.
Referenced by MediaWiki\Session\SessionManager\__construct().
MediaWiki\Session\SessionManager::setLogger | ( | LoggerInterface | $logger | ) |
Definition at line 200 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$logger.
Referenced by MediaWiki\Session\SessionManager\__construct().
MediaWiki\Session\SessionManager::setupPHPSessionHandler | ( | PHPSessionHandler | $handler | ) |
Call setters on a PHPSessionHandler.
Definition at line 950 of file SessionManager.php.
References MediaWiki\Session\PHPSessionHandler\setManager().
MediaWiki\Session\SessionManager::shutdown | ( | ) |
Save all active sessions on shutdown.
Definition at line 465 of file SessionManager.php.
|
static |
Get the global SessionManager.
Definition at line 100 of file SessionManager.php.
References MediaWiki\Session\SessionManager\$instance.
Referenced by MediaWiki\Session\SessionManager\getGlobalSession(), and RequestContext\importScopedSession().
|
static |
Validate a session ID.
string | $id |
Definition at line 386 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionInfo\__construct(), MediaWiki\Session\ImmutableSessionProviderWithCookie\getSessionIdFromCookie(), and MediaWiki\Session\CookieSessionProvider\provideSessionInfo().
|
private |
Definition at line 88 of file SessionManager.php.
|
private |
Definition at line 91 of file SessionManager.php.
|
private |
Definition at line 73 of file SessionManager.php.
|
staticprivate |
Definition at line 58 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\getGlobalSession().
|
staticprivate |
Definition at line 61 of file SessionManager.php.
|
private |
Definition at line 67 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\setHookContainer().
|
private |
Definition at line 70 of file SessionManager.php.
|
staticprivate |
Definition at line 55 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\singleton().
|
private |
Definition at line 64 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\logPotentialSessionLeakage(), and MediaWiki\Session\SessionManager\setLogger().
|
private |
Definition at line 94 of file SessionManager.php.
|
private |
Definition at line 79 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\getProviders().
|
private |
Definition at line 76 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\__construct().
|
private |
Definition at line 82 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\getVaryCookies().
|
private |
Definition at line 85 of file SessionManager.php.
Referenced by MediaWiki\Session\SessionManager\getVaryHeaders().