namespace MediaWiki\Session;
use Psr\Log\LoggerInterface;
+use Psr\Log\LogLevel;
use BagOStuff;
+use CachedBagOStuff;
use Config;
use FauxRequest;
-use Language;
-use Message;
use User;
use WebRequest;
/** @var Config */
private $config;
- /** @var BagOStuff|null */
- private $tempStore;
-
- /** @var BagOStuff|null */
- private $permStore;
+ /** @var CachedBagOStuff|null */
+ private $store;
/** @var SessionProvider[] */
private $sessionProviders = null;
$this->setLogger( \MediaWiki\Logger\LoggerFactory::getInstance( 'session' ) );
}
- $this->tempStore = new \HashBagOStuff;
if ( isset( $options['store'] ) ) {
if ( !$options['store'] instanceof BagOStuff ) {
throw new \InvalidArgumentException(
'$options[\'store\'] must be an instance of BagOStuff'
);
}
- $this->permStore = $options['store'];
+ $store = $options['store'];
} else {
- $this->permStore = \ObjectCache::getInstance( $this->config->get( 'SessionCacheType' ) );
- $this->permStore->setLogger( $this->logger );
+ $store = \ObjectCache::getInstance( $this->config->get( 'SessionCacheType' ) );
+ $store->setLogger( $this->logger );
}
+ $this->store = $store instanceof CachedBagOStuff ? $store : new CachedBagOStuff( $store );
register_shutdown_function( array( $this, 'shutdown' ) );
}
// Test this here to provide a better log message for the common case
// of "no such ID"
$key = wfMemcKey( 'MWSession', $id );
- $existing = $this->tempStore->get( $key );
- if ( $existing === false ) {
- $existing = $this->permStore->get( $key );
- if ( $existing !== false ) {
- $this->tempStore->set( $key, $existing );
- }
- }
- if ( is_array( $existing ) ) {
+ if ( is_array( $this->store->get( $key ) ) ) {
$info = new SessionInfo( SessionInfo::MIN_PRIORITY, array( 'id' => $id, 'idIsSafe' => true ) );
if ( $this->loadSessionInfoFromStore( $info, $request ) ) {
$session = $this->getSessionFromInfo( $info, $request );
try {
$session = $this->getEmptySessionInternal( $request, $id );
} catch ( \Exception $ex ) {
- $this->logger->error( __METHOD__ . ': failed to create empty session: ' .
- $ex->getMessage() );
+ $this->logger->error( 'Failed to create empty session: {exception}',
+ array(
+ 'method' => __METHOD__,
+ 'exception' => $ex,
+ ) );
$session = null;
}
}
}
$key = wfMemcKey( 'MWSession', $id );
- $existing = $this->tempStore->get( $key );
- if ( $existing === false ) {
- $existing = $this->permStore->get( $key );
- if ( $existing !== false ) {
- $this->tempStore->set( $key, $existing );
- }
- }
- if ( is_array( $existing ) ) {
+ if ( is_array( $this->store->get( $key ) ) ) {
throw new \InvalidArgumentException( 'Session ID already exists' );
}
}
// Checks passed, create the user...
$from = isset( $_SERVER['REQUEST_URI'] ) ? $_SERVER['REQUEST_URI'] : 'CLI';
- $logger->info( __METHOD__ . ": creating new user ($userName) - from: $from" );
+ $logger->info( __METHOD__ . ': creating new user ({username}) - from: {url}',
+ array(
+ 'username' => $userName,
+ 'url' => $from,
+ ) );
try {
// Insert the user into the local DB master
$status = $user->addToDatabase();
if ( !$status->isOK() ) {
// @codeCoverageIgnoreStart
- $logger->error( __METHOD__ . ': failed with message ' . $status->getWikiText() );
+ $logger->error( __METHOD__ . ': failed with message ' . $status->getWikiText(),
+ array(
+ 'username' => $userName,
+ ) );
$user->setId( 0 );
$user->loadFromId();
return false;
}
} catch ( \Exception $ex ) {
// @codeCoverageIgnoreStart
- $logger->error( __METHOD__ . ': failed with exception ' . $ex->getMessage() );
+ $logger->error( __METHOD__ . ': failed with exception {exception}', array(
+ 'exception' => $ex,
+ 'username' => $userName,
+ ) );
// Do not keep throwing errors for a while
$cache->set( $backoffKey, 1, 600 );
// Bubble up error; which should normally trigger DB rollbacks
public function preventSessionsForUser( $username ) {
$this->preventUsers[$username] = true;
- // Reset the user's token to kill existing sessions
- $user = User::newFromName( $username );
- if ( $user && $user->getToken( false ) ) {
- $user->setToken();
- $user->saveSettings();
- }
-
// Instruct the session providers to kill any other sessions too.
foreach ( $this->getProviders() as $provider ) {
$provider->preventSessionsForUser( $username );
*/
private function loadSessionInfoFromStore( SessionInfo &$info, WebRequest $request ) {
$key = wfMemcKey( 'MWSession', $info->getId() );
- $blob = $this->tempStore->get( $key );
- if ( $blob === false ) {
- $blob = $this->permStore->get( $key );
- if ( $blob !== false ) {
- $this->tempStore->set( $key, $blob );
- }
- }
+ $blob = $this->store->get( $key );
$newParams = array();
if ( $blob !== false ) {
// Sanity check: blob must be an array, if it's saved at all
if ( !is_array( $blob ) ) {
- $this->logger->warning( "Session $info: Bad data" );
- $this->tempStore->delete( $key );
- $this->permStore->delete( $key );
+ $this->logger->warning( 'Session "{session}": Bad data', array(
+ 'session' => $info,
+ ) );
+ $this->store->delete( $key );
return false;
}
if ( !isset( $blob['data'] ) || !is_array( $blob['data'] ) ||
!isset( $blob['metadata'] ) || !is_array( $blob['metadata'] )
) {
- $this->logger->warning( "Session $info: Bad data structure" );
- $this->tempStore->delete( $key );
- $this->permStore->delete( $key );
+ $this->logger->warning( 'Session "{session}": Bad data structure', array(
+ 'session' => $info,
+ ) );
+ $this->store->delete( $key );
return false;
}
!array_key_exists( 'userToken', $metadata ) ||
!array_key_exists( 'provider', $metadata )
) {
- $this->logger->warning( "Session $info: Bad metadata" );
- $this->tempStore->delete( $key );
- $this->permStore->delete( $key );
+ $this->logger->warning( 'Session "{session}": Bad metadata', array(
+ 'session' => $info,
+ ) );
+ $this->store->delete( $key );
return false;
}
if ( $provider === null ) {
$newParams['provider'] = $provider = $this->getProvider( $metadata['provider'] );
if ( !$provider ) {
- $this->logger->warning( "Session $info: Unknown provider, " . $metadata['provider'] );
- $this->tempStore->delete( $key );
- $this->permStore->delete( $key );
+ $this->logger->warning(
+ 'Session "{session}": Unknown provider ' . $metadata['provider'],
+ array(
+ 'session' => $info,
+ )
+ );
+ $this->store->delete( $key );
return false;
}
} elseif ( $metadata['provider'] !== (string)$provider ) {
- $this->logger->warning( "Session $info: Wrong provider, " .
- $metadata['provider'] . ' !== ' . $provider );
+ $this->logger->warning( 'Session "{session}": Wrong provider ' .
+ $metadata['provider'] . ' !== ' . $provider,
+ array(
+ 'session' => $info,
+ ) );
return false;
}
if ( $newProviderMetadata !== $providerMetadata ) {
$newParams['metadata'] = $newProviderMetadata;
}
- } catch ( \UnexpectedValueException $ex ) {
- $this->logger->warning( "Session $info: Metadata merge failed: " . $ex->getMessage() );
+ } catch ( MetadataMergeException $ex ) {
+ $this->logger->warning(
+ 'Session "{session}": Metadata merge failed: {exception}',
+ array(
+ 'session' => $info,
+ 'exception' => $ex,
+ ) + $ex->getContext()
+ );
return false;
}
}
$userInfo = UserInfo::newAnonymous();
}
} catch ( \InvalidArgumentException $ex ) {
- $this->logger->error( "Session $info: " . $ex->getMessage() );
+ $this->logger->error( 'Session "{session}": {exception}', array(
+ 'session' => $info,
+ 'exception' => $ex,
+ ) );
return false;
}
$newParams['userInfo'] = $userInfo;
// is no saved ID and the names match.
if ( $metadata['userId'] ) {
if ( $metadata['userId'] !== $userInfo->getId() ) {
- $this->logger->warning( "Session $info: User ID mismatch, " .
- $metadata['userId'] . ' !== ' . $userInfo->getId() );
+ $this->logger->warning(
+ 'Session "{session}": User ID mismatch, {uid_a} !== {uid_b}',
+ array(
+ 'session' => $info,
+ 'uid_a' => $metadata['userId'],
+ 'uid_b' => $userInfo->getId(),
+ ) );
return false;
}
if ( $metadata['userName'] !== null &&
$userInfo->getName() !== $metadata['userName']
) {
- $this->logger->warning( "Session $info: User ID matched but name didn't (rename?), " .
- $metadata['userName'] . ' !== ' . $userInfo->getName() );
+ $this->logger->warning(
+ 'Session "{session}": User ID matched but name didn\'t (rename?), {uname_a} !== {uname_b}',
+ array(
+ 'session' => $info,
+ 'uname_a' => $metadata['userName'],
+ 'uname_b' => $userInfo->getName(),
+ ) );
return false;
}
} elseif ( $metadata['userName'] !== null ) { // Shouldn't happen, but just in case
if ( $metadata['userName'] !== $userInfo->getName() ) {
- $this->logger->warning( "Session $info: User name mismatch, " .
- $metadata['userName'] . ' !== ' . $userInfo->getName() );
+ $this->logger->warning(
+ 'Session "{session}": User name mismatch, {uname_a} !== {uname_b}',
+ array(
+ 'session' => $info,
+ 'uname_a' => $metadata['userName'],
+ 'uname_b' => $userInfo->getName(),
+ ) );
return false;
}
} elseif ( !$userInfo->isAnon() ) {
// Metadata specifies an anonymous user, but the passed-in
// user isn't anonymous.
$this->logger->warning(
- "Session $info: Metadata has an anonymous user, " .
- 'but a non-anon user was provided'
- );
+ 'Session "{session}": Metadata has an anonymous user, but a non-anon user was provided',
+ array(
+ 'session' => $info,
+ ) );
return false;
}
}
if ( $metadata['userToken'] !== null &&
$userInfo->getToken() !== $metadata['userToken']
) {
- $this->logger->warning( "Session $info: User token mismatch" );
+ $this->logger->warning( 'Session "{session}": User token mismatch', array(
+ 'session' => $info,
+ ) );
return false;
}
if ( !$userInfo->isVerified() ) {
} else {
// No metadata, so we can't load the provider if one wasn't given.
if ( $info->getProvider() === null ) {
- $this->logger->warning( "Session $info: Null provider and no metadata" );
+ $this->logger->warning(
+ 'Session "{session}": Null provider and no metadata',
+ array(
+ 'session' => $info,
+ ) );
return false;
}
$newParams['userInfo'] = UserInfo::newAnonymous();
} else {
$this->logger->info(
- "Session $info: No user provided and provider cannot set user"
- );
+ 'Session "{session}": No user provided and provider cannot set user',
+ array(
+ 'session' => $info,
+ ) );
return false;
}
} elseif ( !$info->getUserInfo()->isVerified() ) {
$this->logger->warning(
- "Session $info: Unverified user provided and no metadata to auth it"
- );
+ 'Session "{session}": Unverified user provided and no metadata to auth it',
+ array(
+ 'session' => $info,
+ ) );
return false;
}
'SessionCheckInfo',
array( &$reason, $info, $request, $metadata, $data )
) ) {
- $this->logger->warning( "Session $info: $reason" );
+ $this->logger->warning( 'Session "{session}": ' . $reason, array(
+ 'session' => $info,
+ ) );
return false;
}
$backend = new SessionBackend(
$this->allSessionIds[$id],
$info,
- $this->tempStore,
- $this->permStore,
+ $this->store,
$this->logger,
$this->config->get( 'ObjectCacheSessionExpiry' )
);
do {
$id = wfBaseConvert( \MWCryptRand::generateHex( 40 ), 16, 32, 32 );
$key = wfMemcKey( 'MWSession', $id );
- } while ( isset( $this->allSessionIds[$id] ) ||
- is_array( $this->tempStore->get( $key ) ) || is_array( $this->permStore->get( $key ) )
- );
+ } while ( isset( $this->allSessionIds[$id] ) || is_array( $this->store->get( $key ) ) );
return $id;
}
* @param PHPSessionHandler $handler
*/
public function setupPHPSessionHandler( PHPSessionHandler $handler ) {
- $handler->setManager( $this, $this->permStore, $this->logger );
+ $handler->setManager( $this, $this->store, $this->logger );
}
/**
self::$globalSessionRequest = null;
}
+ /**
+ * Do a sanity check to make sure the session is not used from many different IP addresses
+ * and store some data for later sanity checks.
+ * FIXME remove this once SessionManager is considered stable
+ * @private For use in Setup.php only
+ * @param Session $session Defaults to the global session.
+ */
+ public function checkIpLimits( Session $session = null ) {
+ $session = $session ?: self::getGlobalSession();
+
+ try {
+ $ip = $session->getRequest()->getIP();
+ } catch ( \MWException $e ) {
+ return;
+ }
+ if ( $ip === '127.0.0.1' || \IP::isConfiguredProxy( $ip ) ) {
+ return;
+ }
+ $now = time();
+
+ // Record (and possibly log) that the IP is using the current session.
+ // Don't touch the stored data unless we are adding a new IP or re-adding an expired one.
+ // This is slightly inaccurate (when an existing IP is seen again, the expiry is not
+ // extended) but that shouldn't make much difference and limits the session write frequency
+ // to # of IPs / $wgSuspiciousIpExpiry.
+ $data = $session->get( 'SessionManager-ip', array() );
+ if (
+ !isset( $data[$ip] )
+ || $data[$ip] < $now
+ ) {
+ $data[$ip] = time() + $this->config->get( 'SuspiciousIpExpiry' );
+ foreach ( $data as $key => $expires ) {
+ if ( $expires < $now ) {
+ unset( $data[$key] );
+ }
+ }
+ $session->set( 'SessionManager-ip', $data );
+
+ $logger = \MediaWiki\Logger\LoggerFactory::getInstance( 'session-ip' );
+ $logLevel = count( $data ) >= $this->config->get( 'SuspiciousIpPerSessionLimit' )
+ ? LogLevel::WARNING : ( count( $data ) === 1 ? LogLevel::DEBUG : LogLevel::INFO );
+ $logger->log(
+ $logLevel,
+ 'Same session used from {count} IPs',
+ array(
+ 'count' => count( $data ),
+ 'ips' => $data,
+ 'session' => $session->getId(),
+ 'user' => $session->getUser()->getName(),
+ 'persistent' => $session->isPersistent(),
+ )
+ );
+ }
+
+ // Now do the same thing globally for the current user.
+ // We are using the object cache and assume it is shared between all wikis of a farm,
+ // and further assume that the same name belongs to the same user on all wikis. (It's either
+ // that or a central ID lookup which would mean an extra SQL query on every request.)
+ if ( $session->getUser()->isLoggedIn() ) {
+ $userKey = 'SessionManager-ip:' . md5( $session->getUser()->getName() );
+ $data = $this->store->get( $userKey ) ?: array();
+ if (
+ !isset( $data[$ip] )
+ || $data[$ip] < $now
+ ) {
+ $data[$ip] = time() + $this->config->get( 'SuspiciousIpExpiry' );
+ foreach ( $data as $key => $expires ) {
+ if ( $expires < $now ) {
+ unset( $data[$key] );
+ }
+ }
+ $this->store->set( $userKey, $data, $this->config->get( 'SuspiciousIpExpiry' ) );
+ $logger = \MediaWiki\Logger\LoggerFactory::getInstance( 'session-ip' );
+ $logLevel = count( $data ) >= $this->config->get( 'SuspiciousIpPerUserLimit' )
+ ? LogLevel::WARNING : ( count( $data ) === 1 ? LogLevel::DEBUG : LogLevel::INFO );
+ $logger->log(
+ $logLevel,
+ 'Same user had sessions from {count} IPs',
+ array(
+ 'count' => count( $data ),
+ 'ips' => $data,
+ 'session' => $session->getId(),
+ 'user' => $session->getUser()->getName(),
+ 'persistent' => $session->isPersistent(),
+ )
+ );
+ }
+ }
+ }
+
/**@}*/
}
dépôts / lhc / web / wiklou.git / blobdiff