includes/session/SessionBackend.php

   1 <?php
   2 /**
   3  * MediaWiki session backend
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  * @ingroup Session
  22  */
  23
  24 namespace MediaWiki\Session;
  25
  26 use BagOStuff;
  27 use Psr\Log\LoggerInterface;
  28 use User;
  29 use WebRequest;
  30
  31 /**
  32  * This is the actual workhorse for Session.
  33  *
  34  * Most code does not need to use this class, you want \\MediaWiki\\Session\\Session.
  35  * The exceptions are SessionProviders and SessionMetadata hook functions,
  36  * which get an instance of this class rather than Session.
  37  *
  38  * The reasons for this split are:
  39  * 1. A session can be attached to multiple requests, but we want the Session
  40  *    object to have some features that correspond to just one of those
  41  *    requests.
  42  * 2. We want reasonable garbage collection behavior, but we also want the
  43  *    SessionManager to hold a reference to every active session so it can be
  44  *    saved when the request ends.
  45  *
  46  * @ingroup Session
  47  * @since 1.27
  48  */
  49 final class SessionBackend {
  50         /** @var SessionId */
  51         private $id;
  52
  53         private $persist = false;
  54         private $remember = false;
  55         private $forceHTTPS = false;
  56
  57         /** @var array|null */
  58         private $data = null;
  59
  60         private $forcePersist = false;
  61         private $metaDirty = false;
  62         private $dataDirty = false;
  63
  64         /** @var string Used to detect subarray modifications */
  65         private $dataHash = null;
  66
  67         /** @var BagOStuff */
  68         private $store;
  69
  70         /** @var LoggerInterface */
  71         private $logger;
  72
  73         /** @var int */
  74         private $lifetime;
  75
  76         /** @var User */
  77         private $user;
  78
  79         private $curIndex = 0;
  80
  81         /** @var WebRequest[] Session requests */
  82         private $requests = array();
  83
  84         /** @var SessionProvider provider */
  85         private $provider;
  86
  87         /** @var array|null provider-specified metadata */
  88         private $providerMetadata = null;
  89
  90         private $expires = 0;
  91         private $loggedOut = 0;
  92         private $delaySave = 0;
  93
  94         private $usePhpSessionHandling = true;
  95         private $checkPHPSessionRecursionGuard = false;
  96
  97         /**
  98          * @param SessionId $id Session ID object
  99          * @param SessionInfo $info Session info to populate from
 100          * @param BagOStuff $store Backend data store
 101          * @param LoggerInterface $logger
 102          * @param int $lifetime Session data lifetime in seconds
 103          */
 104         public function __construct(
 105                 SessionId $id, SessionInfo $info, BagOStuff $store, LoggerInterface $logger, $lifetime
 106         ) {
 107                 $phpSessionHandling = \RequestContext::getMain()->getConfig()->get( 'PHPSessionHandling' );
 108                 $this->usePhpSessionHandling = $phpSessionHandling !== 'disable';
 109
 110                 if ( $info->getUserInfo() && !$info->getUserInfo()->isVerified() ) {
 111                         throw new \InvalidArgumentException(
 112                                 "Refusing to create session for unverified user {$info->getUserInfo()}"
 113                         );
 114                 }
 115                 if ( $info->getProvider() === null ) {
 116                         throw new \InvalidArgumentException( 'Cannot create session without a provider' );
 117                 }
 118                 if ( $info->getId() !== $id->getId() ) {
 119                         throw new \InvalidArgumentException( 'SessionId and SessionInfo don\'t match' );
 120                 }
 121
 122                 $this->id = $id;
 123                 $this->user = $info->getUserInfo() ? $info->getUserInfo()->getUser() : new User;
 124                 $this->store = $store;
 125                 $this->logger = $logger;
 126                 $this->lifetime = $lifetime;
 127                 $this->provider = $info->getProvider();
 128                 $this->persist = $info->wasPersisted();
 129                 $this->remember = $info->wasRemembered();
 130                 $this->forceHTTPS = $info->forceHTTPS();
 131                 $this->providerMetadata = $info->getProviderMetadata();
 132
 133                 $blob = $store->get( wfMemcKey( 'MWSession', (string)$this->id ) );
 134                 if ( !is_array( $blob ) ||
 135                         !isset( $blob['metadata'] ) || !is_array( $blob['metadata'] ) ||
 136                         !isset( $blob['data'] ) || !is_array( $blob['data'] )
 137                 ) {
 138                         $this->data = array();
 139                         $this->dataDirty = true;
 140                         $this->metaDirty = true;
 141                         $this->logger->debug( "SessionBackend $this->id is unsaved, marking dirty in constructor" );
 142                 } else {
 143                         $this->data = $blob['data'];
 144                         if ( isset( $blob['metadata']['loggedOut'] ) ) {
 145                                 $this->loggedOut = (int)$blob['metadata']['loggedOut'];
 146                         }
 147                         if ( isset( $blob['metadata']['expires'] ) ) {
 148                                 $this->expires = (int)$blob['metadata']['expires'];
 149                         } else {
 150                                 $this->metaDirty = true;
 151                                 $this->logger->debug(
 152                                         "SessionBackend $this->id metadata dirty due to missing expiration timestamp"
 153                                 );
 154                         }
 155                 }
 156                 $this->dataHash = md5( serialize( $this->data ) );
 157         }
 158
 159         /**
 160          * Return a new Session for this backend
 161          * @param WebRequest $request
 162          * @return Session
 163          */
 164         public function getSession( WebRequest $request ) {
 165                 $index = ++$this->curIndex;
 166                 $this->requests[$index] = $request;
 167                 $session = new Session( $this, $index );
 168                 return $session;
 169         }
 170
 171         /**
 172          * Deregister a Session
 173          * @private For use by \\MediaWiki\\Session\\Session::__destruct() only
 174          * @param int $index
 175          */
 176         public function deregisterSession( $index ) {
 177                 unset( $this->requests[$index] );
 178                 if ( !count( $this->requests ) ) {
 179                         $this->save( true );
 180                         $this->provider->getManager()->deregisterSessionBackend( $this );
 181                 }
 182         }
 183
 184         /**
 185          * Returns the session ID.
 186          * @return string
 187          */
 188         public function getId() {
 189                 return (string)$this->id;
 190         }
 191
 192         /**
 193          * Fetch the SessionId object
 194          * @private For internal use by WebRequest
 195          * @return SessionId
 196          */
 197         public function getSessionId() {
 198                 return $this->id;
 199         }
 200
 201         /**
 202          * Changes the session ID
 203          * @return string New ID (might be the same as the old)
 204          */
 205         public function resetId() {
 206                 if ( $this->provider->persistsSessionId() ) {
 207                         $oldId = (string)$this->id;
 208                         $restart = $this->usePhpSessionHandling && $oldId === session_id() &&
 209                                 PHPSessionHandler::isEnabled();
 210
 211                         if ( $restart ) {
 212                                 // If this session is the one behind PHP's $_SESSION, we need
 213                                 // to close then reopen it.
 214                                 session_write_close();
 215                         }
 216
 217                         $this->provider->getManager()->changeBackendId( $this );
 218                         $this->provider->sessionIdWasReset( $this, $oldId );
 219                         $this->metaDirty = true;
 220                         $this->logger->debug(
 221                                 "SessionBackend $this->id metadata dirty due to ID reset (formerly $oldId)"
 222                         );
 223
 224                         if ( $restart ) {
 225                                 session_id( (string)$this->id );
 226                                 \MediaWiki\quietCall( 'session_start' );
 227                         }
 228
 229                         $this->autosave();
 230
 231                         // Delete the data for the old session ID now
 232                         $this->store->delete( wfMemcKey( 'MWSession', $oldId ) );
 233                 }
 234         }
 235
 236         /**
 237          * Fetch the SessionProvider for this session
 238          * @return SessionProviderInterface
 239          */
 240         public function getProvider() {
 241                 return $this->provider;
 242         }
 243
 244         /**
 245          * Indicate whether this session is persisted across requests
 246          *
 247          * For example, if cookies are set.
 248          *
 249          * @return bool
 250          */
 251         public function isPersistent() {
 252                 return $this->persist;
 253         }
 254
 255         /**
 256          * Make this session persisted across requests
 257          *
 258          * If the session is already persistent, equivalent to calling
 259          * $this->renew().
 260          */
 261         public function persist() {
 262                 if ( !$this->persist ) {
 263                         $this->persist = true;
 264                         $this->forcePersist = true;
 265                         $this->logger->debug( "SessionBackend $this->id force-persist due to persist()" );
 266                         $this->autosave();
 267                 } else {
 268                         $this->renew();
 269                 }
 270         }
 271
 272         /**
 273          * Indicate whether the user should be remembered independently of the
 274          * session ID.
 275          * @return bool
 276          */
 277         public function shouldRememberUser() {
 278                 return $this->remember;
 279         }
 280
 281         /**
 282          * Set whether the user should be remembered independently of the session
 283          * ID.
 284          * @param bool $remember
 285          */
 286         public function setRememberUser( $remember ) {
 287                 if ( $this->remember !== (bool)$remember ) {
 288                         $this->remember = (bool)$remember;
 289                         $this->metaDirty = true;
 290                         $this->logger->debug( "SessionBackend $this->id metadata dirty due to remember-user change" );
 291                         $this->autosave();
 292                 }
 293         }
 294
 295         /**
 296          * Returns the request associated with a Session
 297          * @param int $index Session index
 298          * @return WebRequest
 299          */
 300         public function getRequest( $index ) {
 301                 if ( !isset( $this->requests[$index] ) ) {
 302                         throw new \InvalidArgumentException( 'Invalid session index' );
 303                 }
 304                 return $this->requests[$index];
 305         }
 306
 307         /**
 308          * Returns the authenticated user for this session
 309          * @return User
 310          */
 311         public function getUser() {
 312                 return $this->user;
 313         }
 314
 315         /**
 316          * Fetch the rights allowed the user when this session is active.
 317          * @return null|string[] Allowed user rights, or null to allow all.
 318          */
 319         public function getAllowedUserRights() {
 320                 return $this->provider->getAllowedUserRights( $this );
 321         }
 322
 323         /**
 324          * Indicate whether the session user info can be changed
 325          * @return bool
 326          */
 327         public function canSetUser() {
 328                 return $this->provider->canChangeUser();
 329         }
 330
 331         /**
 332          * Set a new user for this session
 333          * @note This should only be called when the user has been authenticated via a login process
 334          * @param User $user User to set on the session.
 335          *   This may become a "UserValue" in the future, or User may be refactored
 336          *   into such.
 337          */
 338         public function setUser( $user ) {
 339                 if ( !$this->canSetUser() ) {
 340                         throw new \BadMethodCallException(
 341                                 'Cannot set user on this session; check $session->canSetUser() first'
 342                         );
 343                 }
 344
 345                 $this->user = $user;
 346                 $this->metaDirty = true;
 347                 $this->logger->debug( "SessionBackend $this->id metadata dirty due to user change" );
 348                 $this->autosave();
 349         }
 350
 351         /**
 352          * Get a suggested username for the login form
 353          * @param int $index Session index
 354          * @return string|null
 355          */
 356         public function suggestLoginUsername( $index ) {
 357                 if ( !isset( $this->requests[$index] ) ) {
 358                         throw new \InvalidArgumentException( 'Invalid session index' );
 359                 }
 360                 return $this->provider->suggestLoginUsername( $this->requests[$index] );
 361         }
 362
 363         /**
 364          * Whether HTTPS should be forced
 365          * @return bool
 366          */
 367         public function shouldForceHTTPS() {
 368                 return $this->forceHTTPS;
 369         }
 370
 371         /**
 372          * Set whether HTTPS should be forced
 373          * @param bool $force
 374          */
 375         public function setForceHTTPS( $force ) {
 376                 if ( $this->forceHTTPS !== (bool)$force ) {
 377                         $this->forceHTTPS = (bool)$force;
 378                         $this->metaDirty = true;
 379                         $this->logger->debug( "SessionBackend $this->id metadata dirty due to force-HTTPS change" );
 380                         $this->autosave();
 381                 }
 382         }
 383
 384         /**
 385          * Fetch the "logged out" timestamp
 386          * @return int
 387          */
 388         public function getLoggedOutTimestamp() {
 389                 return $this->loggedOut;
 390         }
 391
 392         /**
 393          * Set the "logged out" timestamp
 394          * @param int $ts
 395          */
 396         public function setLoggedOutTimestamp( $ts = null ) {
 397                 $ts = (int)$ts;
 398                 if ( $this->loggedOut !== $ts ) {
 399                         $this->loggedOut = $ts;
 400                         $this->metaDirty = true;
 401                         $this->logger->debug(
 402                                 "SessionBackend $this->id metadata dirty due to logged-out-timestamp change"
 403                         );
 404                         $this->autosave();
 405                 }
 406         }
 407
 408         /**
 409          * Fetch provider metadata
 410          * @protected For use by SessionProvider subclasses only
 411          * @return array|null
 412          */
 413         public function getProviderMetadata() {
 414                 return $this->providerMetadata;
 415         }
 416
 417         /**
 418          * Set provider metadata
 419          * @protected For use by SessionProvider subclasses only
 420          * @param array|null $metadata
 421          */
 422         public function setProviderMetadata( $metadata ) {
 423                 if ( $metadata !== null && !is_array( $metadata ) ) {
 424                         throw new \InvalidArgumentException( '$metadata must be an array or null' );
 425                 }
 426                 if ( $this->providerMetadata !== $metadata ) {
 427                         $this->providerMetadata = $metadata;
 428                         $this->metaDirty = true;
 429                         $this->logger->debug(
 430                                 "SessionBackend $this->id metadata dirty due to provider metadata change"
 431                         );
 432                         $this->autosave();
 433                 }
 434         }
 435
 436         /**
 437          * Fetch the session data array
 438          *
 439          * Note the caller is responsible for calling $this->dirty() if anything in
 440          * the array is changed.
 441          *
 442          * @private For use by \\MediaWiki\\Session\\Session only.
 443          * @return array
 444          */
 445         public function &getData() {
 446                 return $this->data;
 447         }
 448
 449         /**
 450          * Add data to the session.
 451          *
 452          * Overwrites any existing data under the same keys.
 453          *
 454          * @param array $newData Key-value pairs to add to the session
 455          */
 456         public function addData( array $newData ) {
 457                 $data = &$this->getData();
 458                 foreach ( $newData as $key => $value ) {
 459                         if ( !array_key_exists( $key, $data ) || $data[$key] !== $value ) {
 460                                 $data[$key] = $value;
 461                                 $this->dataDirty = true;
 462                                 $this->logger->debug(
 463                                         "SessionBackend $this->id data dirty due to addData(): " . wfGetAllCallers( 5 )
 464                                 );
 465                         }
 466                 }
 467         }
 468
 469         /**
 470          * Mark data as dirty
 471          * @private For use by \\MediaWiki\\Session\\Session only.
 472          */
 473         public function dirty() {
 474                 $this->dataDirty = true;
 475                 $this->logger->debug(
 476                         "SessionBackend $this->id data dirty due to dirty(): " . wfGetAllCallers( 5 )
 477                 );
 478         }
 479
 480         /**
 481          * Renew the session by resaving everything
 482          *
 483          * Resets the TTL in the backend store if the session is near expiring, and
 484          * re-persists the session to any active WebRequests if persistent.
 485          */
 486         public function renew() {
 487                 if ( time() + $this->lifetime / 2 > $this->expires ) {
 488                         $this->metaDirty = true;
 489                         $this->logger->debug(
 490                                 "SessionBackend $this->id metadata dirty for renew(): " . wfGetAllCallers( 5 )
 491                         );
 492                         if ( $this->persist ) {
 493                                 $this->forcePersist = true;
 494                                 $this->logger->debug(
 495                                         "SessionBackend $this->id force-persist for renew(): " . wfGetAllCallers( 5 )
 496                                 );
 497                         }
 498                 }
 499                 $this->autosave();
 500         }
 501
 502         /**
 503          * Delay automatic saving while multiple updates are being made
 504          *
 505          * Calls to save() will not be delayed.
 506          *
 507          * @return \ScopedCallback When this goes out of scope, a save will be triggered
 508          */
 509         public function delaySave() {
 510                 $that = $this;
 511                 $this->delaySave++;
 512                 $ref = &$this->delaySave;
 513                 return new \ScopedCallback( function () use ( $that, &$ref ) {
 514                         if ( --$ref <= 0 ) {
 515                                 $ref = 0;
 516                                 $that->save();
 517                         }
 518                 } );
 519         }
 520
 521         /**
 522          * Save and persist session data, unless delayed
 523          */
 524         private function autosave() {
 525                 if ( $this->delaySave <= 0 ) {
 526                         $this->save();
 527                 }
 528         }
 529
 530         /**
 531          * Save and persist session data
 532          * @param bool $closing Whether the session is being closed
 533          */
 534         public function save( $closing = false ) {
 535                 if ( $this->provider->getManager()->isUserSessionPrevented( $this->user->getName() ) ) {
 536                         $this->logger->debug(
 537                                 "SessionBackend $this->id not saving, " .
 538                                         "user {$this->user} was passed to SessionManager::preventSessionsForUser"
 539                         );
 540                         return;
 541                 }
 542
 543                 // Ensure the user has a token
 544                 // @codeCoverageIgnoreStart
 545                 $anon = $this->user->isAnon();
 546                 if ( !$anon && !$this->user->getToken() ) {
 547                         $this->logger->debug(
 548                                 "SessionBackend $this->id creating token for user {$this->user} on save"
 549                         );
 550                         $this->user->setToken();
 551                         if ( !wfReadOnly() ) {
 552                                 $this->user->saveSettings();
 553                         }
 554                         $this->metaDirty = true;
 555                 }
 556                 // @codeCoverageIgnoreEnd
 557
 558                 if ( !$this->metaDirty && !$this->dataDirty &&
 559                         $this->dataHash !== md5( serialize( $this->data ) )
 560                 ) {
 561                         $this->logger->debug( "SessionBackend $this->id data dirty due to hash mismatch, " .
 562                                 "$this->dataHash !== " . md5( serialize( $this->data ) ) );
 563                         $this->dataDirty = true;
 564                 }
 565
 566                 if ( !$this->metaDirty && !$this->dataDirty && !$this->forcePersist ) {
 567                         return;
 568                 }
 569
 570                 $this->logger->debug( "SessionBackend $this->id save: " .
 571                         'dataDirty=' . (int)$this->dataDirty . ' ' .
 572                         'metaDirty=' . (int)$this->metaDirty . ' ' .
 573                         'forcePersist=' . (int)$this->forcePersist
 574                 );
 575
 576                 // Persist to the provider, if flagged
 577                 if ( $this->persist && ( $this->metaDirty || $this->forcePersist ) ) {
 578                         foreach ( $this->requests as $request ) {
 579                                 $request->setSessionId( $this->getSessionId() );
 580                                 $this->provider->persistSession( $this, $request );
 581                         }
 582                         if ( !$closing ) {
 583                                 $this->checkPHPSession();
 584                         }
 585                 }
 586
 587                 $this->forcePersist = false;
 588
 589                 if ( !$this->metaDirty && !$this->dataDirty ) {
 590                         return;
 591                 }
 592
 593                 // Save session data to store, if necessary
 594                 $metadata = $origMetadata = array(
 595                         'provider' => (string)$this->provider,
 596                         'providerMetadata' => $this->providerMetadata,
 597                         'userId' => $anon ? 0 : $this->user->getId(),
 598                         'userName' => $anon ? null : $this->user->getName(),
 599                         'userToken' => $anon ? null : $this->user->getToken(),
 600                         'remember' => !$anon && $this->remember,
 601                         'forceHTTPS' => $this->forceHTTPS,
 602                         'expires' => time() + $this->lifetime,
 603                         'loggedOut' => $this->loggedOut,
 604                 );
 605
 606                 \Hooks::run( 'SessionMetadata', array( $this, &$metadata, $this->requests ) );
 607
 608                 foreach ( $origMetadata as $k => $v ) {
 609                         if ( $metadata[$k] !== $v ) {
 610                                 throw new \UnexpectedValueException( "SessionMetadata hook changed metadata key \"$k\"" );
 611                         }
 612                 }
 613
 614                 $this->store->set(
 615                         wfMemcKey( 'MWSession', (string)$this->id ),
 616                         array(
 617                                 'data' => $this->data,
 618                                 'metadata' => $metadata,
 619                         ),
 620                         $metadata['expires']
 621                 );
 622
 623                 $this->metaDirty = false;
 624                 $this->dataDirty = false;
 625                 $this->dataHash = md5( serialize( $this->data ) );
 626                 $this->expires = $metadata['expires'];
 627         }
 628
 629         /**
 630          * For backwards compatibility, open the PHP session when the global
 631          * session is persisted
 632          */
 633         private function checkPHPSession() {
 634                 if ( !$this->checkPHPSessionRecursionGuard ) {
 635                         $this->checkPHPSessionRecursionGuard = true;
 636                         $ref = &$this->checkPHPSessionRecursionGuard;
 637                         $reset = new \ScopedCallback( function () use ( &$ref ) {
 638                                 $ref = false;
 639                         } );
 640
 641                         if ( $this->usePhpSessionHandling && session_id() === '' && PHPSessionHandler::isEnabled() &&
 642                                 SessionManager::getGlobalSession()->getId() === (string)$this->id
 643                         ) {
 644                                 $this->logger->debug( "SessionBackend $this->id: Taking over PHP session" );
 645                                 session_id( (string)$this->id );
 646                                 \MediaWiki\quietCall( 'session_start' );
 647                         }
 648                 }
 649         }
 650
 651 }