diff options
Diffstat (limited to 'phpBB/includes/sessions.php')
| -rw-r--r-- | phpBB/includes/sessions.php | 120 |
1 files changed, 68 insertions, 52 deletions
diff --git a/phpBB/includes/sessions.php b/phpBB/includes/sessions.php index 81f2441fbd..7663aa8818 100644 --- a/phpBB/includes/sessions.php +++ b/phpBB/includes/sessions.php @@ -21,8 +21,6 @@ ***************************************************************************/ // -// session_begin() -// // Adds/updates a new session to the database for the given userid. // Returns the new session ID on success. // @@ -54,8 +52,7 @@ function session_begin($user_id, $user_ip, $page_id, $auto_create = 0, $enable_a $expiry_time = $current_time - $board_config['session_length']; // - // Try and pull the last time stored - // in a cookie, if it exists + // Try and pull the last time stored in a cookie, if it exists // $sql = "SELECT * FROM " . USERS_TABLE . " @@ -81,8 +78,6 @@ function session_begin($user_id, $user_ip, $page_id, $auto_create = 0, $enable_a // autologinid matches password $login = 1; $enable_autologin = 1; - - $last_visit = ( $userdata['user_session_time'] > 0 ) ? $userdata['user_session_time'] : $current_time; } else { @@ -102,7 +97,6 @@ function session_begin($user_id, $user_ip, $page_id, $auto_create = 0, $enable_a } else { - $last_visit = ( $userdata['user_session_time'] > 0 ) ? $userdata['user_session_time'] : $current_time; $login = 1; } } @@ -146,27 +140,29 @@ function session_begin($user_id, $user_ip, $page_id, $auto_create = 0, $enable_a SET session_user_id = $user_id, session_start = $current_time, session_time = $current_time, session_page = $page_id, session_logged_in = $login WHERE session_id = '" . $session_id . "' AND session_ip = '$user_ip'"; - if ( !($result = $db->sql_query($sql)) || !$db->sql_affectedrows() ) + if ( !$db->sql_query($sql) || !$db->sql_affectedrows() ) { $session_id = md5(uniqid($user_ip)); $sql = "INSERT INTO " . SESSIONS_TABLE . " (session_id, session_user_id, session_start, session_time, session_ip, session_page, session_logged_in) VALUES ('$session_id', $user_id, $current_time, $current_time, '$user_ip', $page_id, $login)"; - if ( !($result = $db->sql_query($sql)) ) + if ( !$db->sql_query($sql) ) { - message_die(CRITICAL_ERROR, 'Error creating new session : session_begin', '', __LINE__, __FILE__, $sql); + message_die(CRITICAL_ERROR, 'Error creating new session', '', __LINE__, __FILE__, $sql); } } if ( $user_id != ANONYMOUS ) - { + {// ( $userdata['user_session_time'] > $expiry_time && $auto_create ) ? $userdata['user_lastvisit'] : ( + $last_visit = ( $userdata['user_session_time'] > 0 ) ? $userdata['user_session_time'] : $current_time; + $sql = "UPDATE " . USERS_TABLE . " SET user_session_time = $current_time, user_session_page = $page_id, user_lastvisit = $last_visit WHERE user_id = $user_id"; if ( !$db->sql_query($sql) ) { - message_die(CRITICAL_ERROR, 'Error updating last visit time : session_begin', '', __LINE__, __FILE__, $sql); + message_die(CRITICAL_ERROR, 'Error updating last visit time', '', __LINE__, __FILE__, $sql); } $userdata['user_lastvisit'] = $last_visit; @@ -185,8 +181,6 @@ function session_begin($user_id, $user_ip, $page_id, $auto_create = 0, $enable_a setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure); setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure); -// header('Set-cookie: ' . $cookiename . '_data=' . urlencode(serialize($sessiondata)) . '; expires=' . gmdate("l, d-M-Y H:i:s", $current_time + 31536000) . ' GMT; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure); -// header('Set-cookie: ' . $cookiename . '_sid=' . $session_id . '; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure); $SID = ( $sessionmethod == SESSION_METHOD_GET ) ? 'sid=' . $session_id : ''; @@ -194,8 +188,8 @@ function session_begin($user_id, $user_ip, $page_id, $auto_create = 0, $enable_a } // -// Checks for a given user session, tidies session -// table and updates user sessions at each page refresh +// Checks for a given user session, tidies session table and updates user +// sessions at each page refresh // function session_pagestart($user_ip, $thispage_id) { @@ -206,7 +200,6 @@ function session_pagestart($user_ip, $thispage_id) $cookiepath = $board_config['cookie_path']; $cookiedomain = $board_config['cookie_domain']; $cookiesecure = $board_config['cookie_secure']; - $cookiesecure = ( $board_config['cookie_secure'] ) ? '; secure' : ''; $current_time = time(); unset($userdata); @@ -240,7 +233,7 @@ function session_pagestart($user_ip, $thispage_id) AND s.session_ip = '$user_ip'"; if ( !($result = $db->sql_query($sql)) ) { - message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch : session_pagestart', '', __LINE__, __FILE__, $sql); + message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql); } $userdata = $db->sql_fetchrow($result); @@ -255,32 +248,66 @@ function session_pagestart($user_ip, $thispage_id) // // Only update session DB a minute or so after last update // - $last_update = ( $userdata['user_id'] == ANONYMOUS ) ? $userdata['session_time'] : $userdata['user_session_time']; - - if ( $current_time - $last_update > 60 ) - { // || $userdata['user_session_page'] != $thispage_id - $sql = ( $userdata['user_id'] == ANONYMOUS ) ? "UPDATE " . SESSIONS_TABLE . " SET session_time = $current_time, session_page = $thispage_id WHERE session_id = '" . $userdata['session_id'] . "' AND session_ip = '$user_ip'" : "UPDATE " . USERS_TABLE . " SET user_session_time = $current_time, user_session_page = $thispage_id WHERE user_id = " . $userdata['user_id']; + if ( $current_time - $userdata['session_time'] > 60 || $userdata['session_page'] != $thispage_id ) + { + $sql = "UPDATE " . SESSIONS_TABLE . " + SET session_time = $current_time, session_page = $thispage_id + WHERE session_id = '" . $userdata['session_id'] . "' + AND session_ip = '$user_ip'"; if ( !$db->sql_query($sql) ) { - message_die(CRITICAL_ERROR, 'Error updating sessions table : session_pagestart', '', __LINE__, __FILE__, $sql); + message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql); } - // - // Delete expired sessions - // - $expiry_time = $current_time - $board_config['session_length']; - $sql = "DELETE FROM " . SESSIONS_TABLE . " - WHERE session_time < $expiry_time - AND session_id <> '$session_id'"; - if ( !($result = $db->sql_query($sql)) ) + if ( $current_time - $board_config['session_gc'] > $board_config['session_last_gc'] ) { - message_die(CRITICAL_ERROR, 'Error clearing sessions table : session_pagestart', '', __LINE__, __FILE__, $sql); + $sql = "SELECT * + FROM " . SESSIONS_TABLE . " + WHERE session_time < " . ( $current_time - $board_config['session_length'] ) . " + AND session_logged_in = 1"; + if ( !($result = $db->sql_query($sql)) ) + { + message_die(CRITICAL_ERROR, 'Could not obtain expired session list', '', __LINE__, __FILE__, $sql); + } + + $del_session_id = ''; + while ( $row = $db->sql_fetchrow($result) ) + { + $sql = "UPDATE " . USERS_TABLE . " + SET user_lastvisit = " . $row['session_time'] . ", user_session_page = " . $row['session_page'] . " + WHERE user_id = " . $row['session_user_id']; + if ( !$db->sql_query($sql) ) + { + message_die(CRITICAL_ERROR, 'Could not update user session info', '', __LINE__, __FILE__, $sql); + } + + $del_session_id .= ( ( $del_session_id != '' ) ? ', ' : '' ) . '\'' . $row['session_id'] . '\''; + } + + if ( $del_session_id != '' ) + { + // + // Delete expired sessions + // + $sql = "DELETE FROM " . SESSIONS_TABLE . " + WHERE session_id IN ($del_session_id)"; + if ( !$db->sql_query($sql) ) + { + message_die(CRITICAL_ERROR, 'Error clearing sessions table', '', __LINE__, __FILE__, $sql); + } + } + + echo $sql = "UPDATE " . CONFIG_TABLE . " + SET config_value = '$current_time' + WHERE config_name = 'session_last_gc'"; + if ( !$db->sql_query($sql) ) + { + message_die(CRITICAL_ERROR, 'Could not update session gc time', '', __LINE__, __FILE__, $sql); + } } setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure); setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure); -// header('Set-cookie: ' . $cookiename . '_data=' . urlencode(serialize($sessiondata)) . '; expires=' . gmdate("l, d-M-Y H:i:s", $current_time + 31536000) . ' GMT; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure); -// header('Set-cookie: ' . $cookiename . '_sid=' . $session_id . '; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure); } return $userdata; @@ -295,7 +322,7 @@ function session_pagestart($user_ip, $thispage_id) if ( !($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE)) ) { - message_die(CRITICAL_ERROR, 'Error creating user session : session_pagestart', '', __LINE__, __FILE__, $sql); + message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql); } return $userdata; @@ -316,7 +343,6 @@ function session_end($session_id, $user_id) $cookiepath = $board_config['cookie_path']; $cookiedomain = $board_config['cookie_domain']; $cookiesecure = $board_config['cookie_secure']; -// $cookiesecure = ( $board_config['cookie_secure'] ) ? '; secure' : ''; // // Pull cookiedata or grab the URI propagated sid @@ -324,12 +350,10 @@ function session_end($session_id, $user_id) if ( isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ) { $session_id = isset( $HTTP_COOKIE_VARS[$cookiename . '_sid'] ) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : ''; - $sessionmethod = SESSION_METHOD_COOKIE; } else { $session_id = ( isset($HTTP_GET_VARS['sid']) ) ? $HTTP_GET_VARS['sid'] : ''; - $sessionmethod = SESSION_METHOD_GET; } // @@ -338,27 +362,19 @@ function session_end($session_id, $user_id) $sql = "DELETE FROM " . SESSIONS_TABLE . " WHERE session_id = '$session_id' AND session_user_id = $user_id"; - if ( !($result = $db->sql_query($sql)) ) + if ( !$db->sql_query($sql) ) { - message_die(CRITICAL_ERROR, 'Error removing user session : session_end', '', __LINE__, __FILE__, $sql); + message_die(CRITICAL_ERROR, 'Error removing user session', '', __LINE__, __FILE__, $sql); } setcookie($cookiename . '_data', '', $current_time - 31536000, $cookiepath, $cookiedomain, $cookiesecure); setcookie($cookiename . '_sid', '', $current_time - 31536000, $cookiepath, $cookiedomain, $cookiesecure); -// header('Set-cookie: ' . $cookiename . '_data=0; expires=' . gmdate("l, d-M-Y H:i:s", 0) . ' GMT; domain=' . $cookiedomain . '; path=' . $cookiepath. $cookiesecure); -// header('Set-cookie: ' . $cookiename . '_sid=0; expires=' . gmdate("l, d-M-Y H:i:s", 0) . ' GMT; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure); - - $SID = ( $sessionmethod == SESSION_METHOD_GET ) ? 'sid=' . $session_id : ''; - - return TRUE; + return true; } // -// Append $SID to a url. Borrowed from phplib and modified. This is an -// extra routine utilised by the session code above and acts as a wrapper -// around every single URL and form action. If you replace the session -// code you must include this routine, even if it's empty. +// Append $SID to a url. Borrowed from phplib and modified. // function append_sid($url, $non_html_amp = false) { @@ -372,4 +388,4 @@ function append_sid($url, $non_html_amp = false) return($url); } -?> +?>
\ No newline at end of file |