1 <?php
2 /**
3 * @package Joomla.Platform
4 * @subpackage Session
5 *
6 * @copyright Copyright (C) 2005 - 2017 Open Source Matters, Inc. All rights reserved.
7 * @license GNU General Public License version 2 or later; see LICENSE
8 */
9
10 defined('JPATH_PLATFORM') or die;
11
12 /**
13 * Interface for managing HTTP sessions
14 *
15 * @since 3.5
16 * @deprecated 4.0 The CMS' Session classes will be replaced with the `joomla/session` package
17 */
18 class JSessionHandlerJoomla extends JSessionHandlerNative
19 {
20 /**
21 * The input object
22 *
23 * @var JInput
24 * @since 3.5
25 */
26 public $input = null;
27
28 /**
29 * Force cookies to be SSL only
30 *
31 * @var boolean
32 * @since 3.5
33 */
34 protected $force_ssl = false;
35
36 /**
37 * Public constructor
38 *
39 * @param array $options An array of configuration options
40 *
41 * @since 3.5
42 */
43 public function __construct($options = array())
44 {
45 // Disable transparent sid support
46 ini_set('session.use_trans_sid', '0');
47
48 // Only allow the session ID to come from cookies and nothing else.
49 ini_set('session.use_only_cookies', '1');
50
51 // Set options
52 $this->setOptions($options);
53 $this->setCookieParams();
54 }
55
56 /**
57 * Starts the session
58 *
59 * @return boolean True if started
60 *
61 * @since 3.5
62 * @throws RuntimeException If something goes wrong starting the session.
63 */
64 public function start()
65 {
66 $session_name = $this->getName();
67
68 // Get the JInputCookie object
69 $cookie = $this->input->cookie;
70
71 if (is_null($cookie->get($session_name)))
72 {
73 $session_clean = $this->input->get($session_name, false, 'string');
74
75 if ($session_clean)
76 {
77 $this->setId($session_clean);
78 $cookie->set($session_name, '', 1);
79 }
80 }
81
82 return parent::start();
83 }
84
85 /**
86 * Clear all session data in memory.
87 *
88 * @return void
89 *
90 * @since 3.5
91 */
92 public function clear()
93 {
94 $session_name = $this->getName();
95
96 /*
97 * In order to kill the session altogether, such as to log the user out, the session id
98 * must also be unset. If a cookie is used to propagate the session id (default behavior),
99 * then the session cookie must be deleted.
100 * We need to use setcookie here or we will get a warning in some session handlers (ex: files).
101 */
102 if (isset($_COOKIE[$session_name]))
103 {
104 setcookie($session_name, '', 1);
105 }
106
107 parent::clear();
108 }
109
110 /**
111 * Set session cookie parameters
112 *
113 * @return void
114 *
115 * @since 3.5
116 */
117 protected function setCookieParams()
118 {
119 $cookie = session_get_cookie_params();
120
121 if ($this->force_ssl)
122 {
123 $cookie['secure'] = true;
124 }
125
126 $config = JFactory::getConfig();
127
128 if ($config->get('cookie_domain', '') != '')
129 {
130 $cookie['domain'] = $config->get('cookie_domain');
131 }
132
133 if ($config->get('cookie_path', '') != '')
134 {
135 $cookie['path'] = $config->get('cookie_path');
136 }
137
138 session_set_cookie_params($cookie['lifetime'], $cookie['path'], $cookie['domain'], $cookie['secure'], true);
139 }
140
141 /**
142 * Set additional session options
143 *
144 * @param array $options List of parameter
145 *
146 * @return boolean True on success
147 *
148 * @since 3.5
149 */
150 protected function setOptions(array $options)
151 {
152 if (isset($options['force_ssl']))
153 {
154 $this->force_ssl = (bool) $options['force_ssl'];
155 }
156
157 return true;
158 }
159 }
160