From 7030578bbe9e11c18b5becaf8b06e670e3c2e3cd Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Sun, 14 Jul 2013 01:32:34 -0400
Subject: [ticket/11698] Moving all autoloadable files to phpbb/

PHPBB3-11698
---
 phpBB/phpbb/session.php | 1516 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 1516 insertions(+)
 create mode 100644 phpBB/phpbb/session.php

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
new file mode 100644
index 0000000000..e0585b1523
--- /dev/null
+++ b/phpBB/phpbb/session.php
@@ -0,0 +1,1516 @@
+<?php
+/**
+*
+* @package phpBB3
+* @copyright (c) 2005 phpBB Group
+* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+*
+*/
+
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
+/**
+* Session class
+* @package phpBB3
+*/
+class phpbb_session
+{
+	var $cookie_data = array();
+	var $page = array();
+	var $data = array();
+	var $browser = '';
+	var $forwarded_for = '';
+	var $host = '';
+	var $session_id = '';
+	var $ip = '';
+	var $load = 0;
+	var $time_now = 0;
+	var $update_session_page = true;
+
+	/**
+	* Extract current session page
+	*
+	* @param string $root_path current root path (phpbb_root_path)
+	*/
+	static function extract_current_page($root_path)
+	{
+		global $request;
+
+		$page_array = array();
+
+		// First of all, get the request uri...
+		$script_name = htmlspecialchars_decode($request->server('PHP_SELF'));
+		$args = explode('&', htmlspecialchars_decode($request->server('QUERY_STRING')));
+
+		// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
+		if (!$script_name)
+		{
+			$script_name = htmlspecialchars_decode($request->server('REQUEST_URI'));
+			$script_name = (($pos = strpos($script_name, '?')) !== false) ? substr($script_name, 0, $pos) : $script_name;
+			$page_array['failover'] = 1;
+		}
+
+		// Replace backslashes and doubled slashes (could happen on some proxy setups)
+		$script_name = str_replace(array('\\', '//'), '/', $script_name);
+
+		// Now, remove the sid and let us get a clean query string...
+		$use_args = array();
+
+		// Since some browser do not encode correctly we need to do this with some "special" characters...
+		// " -> %22, ' => %27, < -> %3C, > -> %3E
+		$find = array('"', "'", '<', '>');
+		$replace = array('%22', '%27', '%3C', '%3E');
+
+		foreach ($args as $key => $argument)
+		{
+			if (strpos($argument, 'sid=') === 0)
+			{
+				continue;
+			}
+
+			$use_args[] = str_replace($find, $replace, $argument);
+		}
+		unset($args);
+
+		// The following examples given are for an request uri of {path to the phpbb directory}/adm/index.php?i=10&b=2
+
+		// The current query string
+		$query_string = trim(implode('&', $use_args));
+
+		// basenamed page name (for example: index.php)
+		$page_name = (substr($script_name, -1, 1) == '/') ? '' : basename($script_name);
+		$page_name = urlencode(htmlspecialchars($page_name));
+
+		// current directory within the phpBB root (for example: adm)
+		$root_dirs = explode('/', str_replace('\\', '/', phpbb_realpath($root_path)));
+		$page_dirs = explode('/', str_replace('\\', '/', phpbb_realpath('./')));
+		$intersection = array_intersect_assoc($root_dirs, $page_dirs);
+
+		$root_dirs = array_diff_assoc($root_dirs, $intersection);
+		$page_dirs = array_diff_assoc($page_dirs, $intersection);
+
+		$page_dir = str_repeat('../', sizeof($root_dirs)) . implode('/', $page_dirs);
+
+		if ($page_dir && substr($page_dir, -1, 1) == '/')
+		{
+			$page_dir = substr($page_dir, 0, -1);
+		}
+
+		// Current page from phpBB root (for example: adm/index.php?i=10&b=2)
+		$page = (($page_dir) ? $page_dir . '/' : '') . $page_name . (($query_string) ? "?$query_string" : '');
+
+		// The script path from the webroot to the current directory (for example: /phpBB3/adm/) : always prefixed with / and ends in /
+		$script_path = trim(str_replace('\\', '/', dirname($script_name)));
+
+		// The script path from the webroot to the phpBB root (for example: /phpBB3/)
+		$script_dirs = explode('/', $script_path);
+		array_splice($script_dirs, -sizeof($page_dirs));
+		$root_script_path = implode('/', $script_dirs) . (sizeof($root_dirs) ? '/' . implode('/', $root_dirs) : '');
+
+		// We are on the base level (phpBB root == webroot), lets adjust the variables a bit...
+		if (!$root_script_path)
+		{
+			$root_script_path = ($page_dir) ? str_replace($page_dir, '', $script_path) : $script_path;
+		}
+
+		$script_path .= (substr($script_path, -1, 1) == '/') ? '' : '/';
+		$root_script_path .= (substr($root_script_path, -1, 1) == '/') ? '' : '/';
+
+		$page_array += array(
+			'page_name'			=> $page_name,
+			'page_dir'			=> $page_dir,
+
+			'query_string'		=> $query_string,
+			'script_path'		=> str_replace(' ', '%20', htmlspecialchars($script_path)),
+			'root_script_path'	=> str_replace(' ', '%20', htmlspecialchars($root_script_path)),
+
+			'page'				=> $page,
+			'forum'				=> request_var('f', 0),
+		);
+
+		return $page_array;
+	}
+
+	/**
+	* Get valid hostname/port. HTTP_HOST is used, SERVER_NAME if HTTP_HOST not present.
+	*/
+	function extract_current_hostname()
+	{
+		global $config, $request;
+
+		// Get hostname
+		$host = htmlspecialchars_decode($request->header('Host', $request->server('SERVER_NAME')));
+
+		// Should be a string and lowered
+		$host = (string) strtolower($host);
+
+		// If host is equal the cookie domain or the server name (if config is set), then we assume it is valid
+		if ((isset($config['cookie_domain']) && $host === $config['cookie_domain']) || (isset($config['server_name']) && $host === $config['server_name']))
+		{
+			return $host;
+		}
+
+		// Is the host actually a IP? If so, we use the IP... (IPv4)
+		if (long2ip(ip2long($host)) === $host)
+		{
+			return $host;
+		}
+
+		// Now return the hostname (this also removes any port definition). The http:// is prepended to construct a valid URL, hosts never have a scheme assigned
+		$host = @parse_url('http://' . $host);
+		$host = (!empty($host['host'])) ? $host['host'] : '';
+
+		// Remove any portions not removed by parse_url (#)
+		$host = str_replace('#', '', $host);
+
+		// If, by any means, the host is now empty, we will use a "best approach" way to guess one
+		if (empty($host))
+		{
+			if (!empty($config['server_name']))
+			{
+				$host = $config['server_name'];
+			}
+			else if (!empty($config['cookie_domain']))
+			{
+				$host = (strpos($config['cookie_domain'], '.') === 0) ? substr($config['cookie_domain'], 1) : $config['cookie_domain'];
+			}
+			else
+			{
+				// Set to OS hostname or localhost
+				$host = (function_exists('php_uname')) ? php_uname('n') : 'localhost';
+			}
+		}
+
+		// It may be still no valid host, but for sure only a hostname (we may further expand on the cookie domain... if set)
+		return $host;
+	}
+
+	/**
+	* Start session management
+	*
+	* This is where all session activity begins. We gather various pieces of
+	* information from the client and server. We test to see if a session already
+	* exists. If it does, fine and dandy. If it doesn't we'll go on to create a
+	* new one ... pretty logical heh? We also examine the system load (if we're
+	* running on a system which makes such information readily available) and
+	* halt if it's above an admin definable limit.
+	*
+	* @param bool $update_session_page if true the session page gets updated.
+	*			This can be set to circumvent certain scripts to update the users last visited page.
+	*/
+	function session_begin($update_session_page = true)
+	{
+		global $phpEx, $SID, $_SID, $_EXTRA_URL, $db, $config, $phpbb_root_path;
+		global $request, $phpbb_container;
+
+		// Give us some basic information
+		$this->time_now				= time();
+		$this->cookie_data			= array('u' => 0, 'k' => '');
+		$this->update_session_page	= $update_session_page;
+		$this->browser				= $request->header('User-Agent');
+		$this->referer				= $request->header('Referer');
+		$this->forwarded_for		= $request->header('X-Forwarded-For');
+
+		$this->host					= $this->extract_current_hostname();
+		$this->page					= $this->extract_current_page($phpbb_root_path);
+
+		// if the forwarded for header shall be checked we have to validate its contents
+		if ($config['forwarded_for_check'])
+		{
+			$this->forwarded_for = preg_replace('# {2,}#', ' ', str_replace(',', ' ', $this->forwarded_for));
+
+			// split the list of IPs
+			$ips = explode(' ', $this->forwarded_for);
+			foreach ($ips as $ip)
+			{
+				// check IPv4 first, the IPv6 is hopefully only going to be used very seldomly
+				if (!empty($ip) && !preg_match(get_preg_expression('ipv4'), $ip) && !preg_match(get_preg_expression('ipv6'), $ip))
+				{
+					// contains invalid data, don't use the forwarded for header
+					$this->forwarded_for = '';
+					break;
+				}
+			}
+		}
+		else
+		{
+			$this->forwarded_for = '';
+		}
+
+		if ($request->is_set($config['cookie_name'] . '_sid', phpbb_request_interface::COOKIE) || $request->is_set($config['cookie_name'] . '_u', phpbb_request_interface::COOKIE))
+		{
+			$this->cookie_data['u'] = request_var($config['cookie_name'] . '_u', 0, false, true);
+			$this->cookie_data['k'] = request_var($config['cookie_name'] . '_k', '', false, true);
+			$this->session_id 		= request_var($config['cookie_name'] . '_sid', '', false, true);
+
+			$SID = (defined('NEED_SID')) ? '?sid=' . $this->session_id : '?sid=';
+			$_SID = (defined('NEED_SID')) ? $this->session_id : '';
+
+			if (empty($this->session_id))
+			{
+				$this->session_id = $_SID = request_var('sid', '');
+				$SID = '?sid=' . $this->session_id;
+				$this->cookie_data = array('u' => 0, 'k' => '');
+			}
+		}
+		else
+		{
+			$this->session_id = $_SID = request_var('sid', '');
+			$SID = '?sid=' . $this->session_id;
+		}
+
+		$_EXTRA_URL = array();
+
+		// Why no forwarded_for et al? Well, too easily spoofed. With the results of my recent requests
+		// it's pretty clear that in the majority of cases you'll at least be left with a proxy/cache ip.
+		$this->ip = htmlspecialchars_decode($request->server('REMOTE_ADDR'));
+		$this->ip = preg_replace('# {2,}#', ' ', str_replace(',', ' ', $this->ip));
+
+		// split the list of IPs
+		$ips = explode(' ', trim($this->ip));
+
+		// Default IP if REMOTE_ADDR is invalid
+		$this->ip = '127.0.0.1';
+
+		foreach ($ips as $ip)
+		{
+			if (function_exists('phpbb_ip_normalise'))
+			{
+				// Normalise IP address
+				$ip = phpbb_ip_normalise($ip);
+
+				if (empty($ip))
+				{
+					// IP address is invalid.
+					break;
+				}
+
+				// IP address is valid.
+				$this->ip = $ip;
+
+				// Skip legacy code.
+				continue;
+			}
+
+			if (preg_match(get_preg_expression('ipv4'), $ip))
+			{
+				$this->ip = $ip;
+			}
+			else if (preg_match(get_preg_expression('ipv6'), $ip))
+			{
+				// Quick check for IPv4-mapped address in IPv6
+				if (stripos($ip, '::ffff:') === 0)
+				{
+					$ipv4 = substr($ip, 7);
+
+					if (preg_match(get_preg_expression('ipv4'), $ipv4))
+					{
+						$ip = $ipv4;
+					}
+				}
+
+				$this->ip = $ip;
+			}
+			else
+			{
+				// We want to use the last valid address in the chain
+				// Leave foreach loop when address is invalid
+				break;
+			}
+		}
+
+		$this->load = false;
+
+		// Load limit check (if applicable)
+		if ($config['limit_load'] || $config['limit_search_load'])
+		{
+			if ((function_exists('sys_getloadavg') && $load = sys_getloadavg()) || ($load = explode(' ', @file_get_contents('/proc/loadavg'))))
+			{
+				$this->load = array_slice($load, 0, 1);
+				$this->load = floatval($this->load[0]);
+			}
+			else
+			{
+				set_config('limit_load', '0');
+				set_config('limit_search_load', '0');
+			}
+		}
+
+		// if no session id is set, redirect to index.php
+		$session_id = $request->variable('sid', '');
+		if (defined('NEED_SID') && (empty($session_id) || $this->session_id !== $session_id))
+		{
+			send_status_line(401, 'Unauthorized');
+			redirect(append_sid("{$phpbb_root_path}index.$phpEx"));
+		}
+
+		// if session id is set
+		if (!empty($this->session_id))
+		{
+			$sql = 'SELECT u.*, s.*
+				FROM ' . SESSIONS_TABLE . ' s, ' . USERS_TABLE . " u
+				WHERE s.session_id = '" . $db->sql_escape($this->session_id) . "'
+					AND u.user_id = s.session_user_id";
+			$result = $db->sql_query($sql);
+			$this->data = $db->sql_fetchrow($result);
+			$db->sql_freeresult($result);
+
+			// Did the session exist in the DB?
+			if (isset($this->data['user_id']))
+			{
+				// Validate IP length according to admin ... enforces an IP
+				// check on bots if admin requires this
+//				$quadcheck = ($config['ip_check_bot'] && $this->data['user_type'] & USER_BOT) ? 4 : $config['ip_check'];
+
+				if (strpos($this->ip, ':') !== false && strpos($this->data['session_ip'], ':') !== false)
+				{
+					$s_ip = short_ipv6($this->data['session_ip'], $config['ip_check']);
+					$u_ip = short_ipv6($this->ip, $config['ip_check']);
+				}
+				else
+				{
+					$s_ip = implode('.', array_slice(explode('.', $this->data['session_ip']), 0, $config['ip_check']));
+					$u_ip = implode('.', array_slice(explode('.', $this->ip), 0, $config['ip_check']));
+				}
+
+				$s_browser = ($config['browser_check']) ? trim(strtolower(substr($this->data['session_browser'], 0, 149))) : '';
+				$u_browser = ($config['browser_check']) ? trim(strtolower(substr($this->browser, 0, 149))) : '';
+
+				$s_forwarded_for = ($config['forwarded_for_check']) ? substr($this->data['session_forwarded_for'], 0, 254) : '';
+				$u_forwarded_for = ($config['forwarded_for_check']) ? substr($this->forwarded_for, 0, 254) : '';
+
+				// referer checks
+				// The @ before $config['referer_validation'] suppresses notices present while running the updater
+				$check_referer_path = (@$config['referer_validation'] == REFERER_VALIDATE_PATH);
+				$referer_valid = true;
+
+				// we assume HEAD and TRACE to be foul play and thus only whitelist GET
+				if (@$config['referer_validation'] && strtolower($request->server('REQUEST_METHOD')) !== 'get')
+				{
+					$referer_valid = $this->validate_referer($check_referer_path);
+				}
+
+				if ($u_ip === $s_ip && $s_browser === $u_browser && $s_forwarded_for === $u_forwarded_for && $referer_valid)
+				{
+					$session_expired = false;
+
+					// Check whether the session is still valid if we have one
+					$method = basename(trim($config['auth_method']));
+
+					$provider = $phpbb_container->get('auth.provider.' . $method);
+
+					if (!($provider instanceof phpbb_auth_provider_interface))
+					{
+						throw new \RuntimeException($provider . ' must implement phpbb_auth_provider_interface');
+					}
+
+					$ret = $provider->validate_session($this->data);
+					if ($ret !== null && !$ret)
+					{
+						$session_expired = true;
+					}
+
+					if (!$session_expired)
+					{
+						// Check the session length timeframe if autologin is not enabled.
+						// Else check the autologin length... and also removing those having autologin enabled but no longer allowed board-wide.
+						if (!$this->data['session_autologin'])
+						{
+							if ($this->data['session_time'] < $this->time_now - ($config['session_length'] + 60))
+							{
+								$session_expired = true;
+							}
+						}
+						else if (!$config['allow_autologin'] || ($config['max_autologin_time'] && $this->data['session_time'] < $this->time_now - (86400 * (int) $config['max_autologin_time']) + 60))
+						{
+							$session_expired = true;
+						}
+					}
+
+					if (!$session_expired)
+					{
+						// Only update session DB a minute or so after last update or if page changes
+						if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
+						{
+							$sql_ary = array('session_time' => $this->time_now);
+
+							if ($this->update_session_page)
+							{
+								$sql_ary['session_page'] = substr($this->page['page'], 0, 199);
+								$sql_ary['session_forum_id'] = $this->page['forum'];
+							}
+
+							$db->sql_return_on_error(true);
+
+							$this->update_session($sql_ary);
+
+							$db->sql_return_on_error(false);
+
+							// If the database is not yet updated, there will be an error due to the session_forum_id
+							// @todo REMOVE for 3.0.2
+							if ($result === false)
+							{
+								unset($sql_ary['session_forum_id']);
+
+								$this->update_session($sql_ary);
+							}
+
+							if ($this->data['user_id'] != ANONYMOUS && !empty($config['new_member_post_limit']) && $this->data['user_new'] && $config['new_member_post_limit'] <= $this->data['user_posts'])
+							{
+								$this->leave_newly_registered();
+							}
+						}
+
+						$this->data['is_registered'] = ($this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;
+						$this->data['is_bot'] = (!$this->data['is_registered'] && $this->data['user_id'] != ANONYMOUS) ? true : false;
+						$this->data['user_lang'] = basename($this->data['user_lang']);
+
+						return true;
+					}
+				}
+				else
+				{
+					// Added logging temporarly to help debug bugs...
+					if (defined('DEBUG') && $this->data['user_id'] != ANONYMOUS)
+					{
+						if ($referer_valid)
+						{
+							add_log('critical', 'LOG_IP_BROWSER_FORWARDED_CHECK', $u_ip, $s_ip, $u_browser, $s_browser, htmlspecialchars($u_forwarded_for), htmlspecialchars($s_forwarded_for));
+						}
+						else
+						{
+							add_log('critical', 'LOG_REFERER_INVALID', $this->referer);
+						}
+					}
+				}
+			}
+		}
+
+		// If we reach here then no (valid) session exists. So we'll create a new one
+		return $this->session_create();
+	}
+
+	/**
+	* Create a new session
+	*
+	* If upon trying to start a session we discover there is nothing existing we
+	* jump here. Additionally this method is called directly during login to regenerate
+	* the session for the specific user. In this method we carry out a number of tasks;
+	* garbage collection, (search)bot checking, banned user comparison. Basically
+	* though this method will result in a new session for a specific user.
+	*/
+	function session_create($user_id = false, $set_admin = false, $persist_login = false, $viewonline = true)
+	{
+		global $SID, $_SID, $db, $config, $cache, $phpbb_root_path, $phpEx, $phpbb_container;
+
+		$this->data = array();
+
+		/* Garbage collection ... remove old sessions updating user information
+		// if necessary. It means (potentially) 11 queries but only infrequently
+		if ($this->time_now > $config['session_last_gc'] + $config['session_gc'])
+		{
+			$this->session_gc();
+		}*/
+
+		// Do we allow autologin on this board? No? Then override anything
+		// that may be requested here
+		if (!$config['allow_autologin'])
+		{
+			$this->cookie_data['k'] = $persist_login = false;
+		}
+
+		/**
+		* Here we do a bot check, oh er saucy! No, not that kind of bot
+		* check. We loop through the list of bots defined by the admin and
+		* see if we have any useragent and/or IP matches. If we do, this is a
+		* bot, act accordingly
+		*/
+		$bot = false;
+		$active_bots = $cache->obtain_bots();
+
+		foreach ($active_bots as $row)
+		{
+			if ($row['bot_agent'] && preg_match('#' . str_replace('\*', '.*?', preg_quote($row['bot_agent'], '#')) . '#i', $this->browser))
+			{
+				$bot = $row['user_id'];
+			}
+
+			// If ip is supplied, we will make sure the ip is matching too...
+			if ($row['bot_ip'] && ($bot || !$row['bot_agent']))
+			{
+				// Set bot to false, then we only have to set it to true if it is matching
+				$bot = false;
+
+				foreach (explode(',', $row['bot_ip']) as $bot_ip)
+				{
+					$bot_ip = trim($bot_ip);
+
+					if (!$bot_ip)
+					{
+						continue;
+					}
+
+					if (strpos($this->ip, $bot_ip) === 0)
+					{
+						$bot = (int) $row['user_id'];
+						break;
+					}
+				}
+			}
+
+			if ($bot)
+			{
+				break;
+			}
+		}
+
+		$method = basename(trim($config['auth_method']));
+
+		$provider = $phpbb_container->get('auth.provider.' . $method);
+		$this->data = $provider->autologin();
+
+		if (sizeof($this->data))
+		{
+			$this->cookie_data['k'] = '';
+			$this->cookie_data['u'] = $this->data['user_id'];
+		}
+
+		// If we're presented with an autologin key we'll join against it.
+		// Else if we've been passed a user_id we'll grab data based on that
+		if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data))
+		{
+			$sql = 'SELECT u.*
+				FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k
+				WHERE u.user_id = ' . (int) $this->cookie_data['u'] . '
+					AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ")
+					AND k.user_id = u.user_id
+					AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'";
+			$result = $db->sql_query($sql);
+			$this->data = $db->sql_fetchrow($result);
+			$db->sql_freeresult($result);
+			$bot = false;
+		}
+		else if ($user_id !== false && !sizeof($this->data))
+		{
+			$this->cookie_data['k'] = '';
+			$this->cookie_data['u'] = $user_id;
+
+			$sql = 'SELECT *
+				FROM ' . USERS_TABLE . '
+				WHERE user_id = ' . (int) $this->cookie_data['u'] . '
+					AND user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ')';
+			$result = $db->sql_query($sql);
+			$this->data = $db->sql_fetchrow($result);
+			$db->sql_freeresult($result);
+			$bot = false;
+		}
+
+		// Bot user, if they have a SID in the Request URI we need to get rid of it
+		// otherwise they'll index this page with the SID, duplicate content oh my!
+		if ($bot && isset($_GET['sid']))
+		{
+			send_status_line(301, 'Moved Permanently');
+			redirect(build_url(array('sid')));
+		}
+
+		// If no data was returned one or more of the following occurred:
+		// Key didn't match one in the DB
+		// User does not exist
+		// User is inactive
+		// User is bot
+		if (!sizeof($this->data) || !is_array($this->data))
+		{
+			$this->cookie_data['k'] = '';
+			$this->cookie_data['u'] = ($bot) ? $bot : ANONYMOUS;
+
+			if (!$bot)
+			{
+				$sql = 'SELECT *
+					FROM ' . USERS_TABLE . '
+					WHERE user_id = ' . (int) $this->cookie_data['u'];
+			}
+			else
+			{
+				// We give bots always the same session if it is not yet expired.
+				$sql = 'SELECT u.*, s.*
+					FROM ' . USERS_TABLE . ' u
+					LEFT JOIN ' . SESSIONS_TABLE . ' s ON (s.session_user_id = u.user_id)
+					WHERE u.user_id = ' . (int) $bot;
+			}
+
+			$result = $db->sql_query($sql);
+			$this->data = $db->sql_fetchrow($result);
+			$db->sql_freeresult($result);
+		}
+
+		if ($this->data['user_id'] != ANONYMOUS && !$bot)
+		{
+			$this->data['session_last_visit'] = (isset($this->data['session_time']) && $this->data['session_time']) ? $this->data['session_time'] : (($this->data['user_lastvisit']) ? $this->data['user_lastvisit'] : time());
+		}
+		else
+		{
+			$this->data['session_last_visit'] = $this->time_now;
+		}
+
+		// Force user id to be integer...
+		$this->data['user_id'] = (int) $this->data['user_id'];
+
+		// At this stage we should have a filled data array, defined cookie u and k data.
+		// data array should contain recent session info if we're a real user and a recent
+		// session exists in which case session_id will also be set
+
+		// Is user banned? Are they excluded? Won't return on ban, exists within method
+		if ($this->data['user_type'] != USER_FOUNDER)
+		{
+			if (!$config['forwarded_for_check'])
+			{
+				$this->check_ban($this->data['user_id'], $this->ip);
+			}
+			else
+			{
+				$ips = explode(' ', $this->forwarded_for);
+				$ips[] = $this->ip;
+				$this->check_ban($this->data['user_id'], $ips);
+			}
+		}
+
+		$this->data['is_registered'] = (!$bot && $this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;
+		$this->data['is_bot'] = ($bot) ? true : false;
+
+		// If our friend is a bot, we re-assign a previously assigned session
+		if ($this->data['is_bot'] && $bot == $this->data['user_id'] && $this->data['session_id'])
+		{
+			// Only assign the current session if the ip, browser and forwarded_for match...
+			if (strpos($this->ip, ':') !== false && strpos($this->data['session_ip'], ':') !== false)
+			{
+				$s_ip = short_ipv6($this->data['session_ip'], $config['ip_check']);
+				$u_ip = short_ipv6($this->ip, $config['ip_check']);
+			}
+			else
+			{
+				$s_ip = implode('.', array_slice(explode('.', $this->data['session_ip']), 0, $config['ip_check']));
+				$u_ip = implode('.', array_slice(explode('.', $this->ip), 0, $config['ip_check']));
+			}
+
+			$s_browser = ($config['browser_check']) ? trim(strtolower(substr($this->data['session_browser'], 0, 149))) : '';
+			$u_browser = ($config['browser_check']) ? trim(strtolower(substr($this->browser, 0, 149))) : '';
+
+			$s_forwarded_for = ($config['forwarded_for_check']) ? substr($this->data['session_forwarded_for'], 0, 254) : '';
+			$u_forwarded_for = ($config['forwarded_for_check']) ? substr($this->forwarded_for, 0, 254) : '';
+
+			if ($u_ip === $s_ip && $s_browser === $u_browser && $s_forwarded_for === $u_forwarded_for)
+			{
+				$this->session_id = $this->data['session_id'];
+
+				// Only update session DB a minute or so after last update or if page changes
+				if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
+				{
+					$this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now;
+
+					$sql_ary = array('session_time' => $this->time_now, 'session_last_visit' => $this->time_now, 'session_admin' => 0);
+
+					if ($this->update_session_page)
+					{
+						$sql_ary['session_page'] = substr($this->page['page'], 0, 199);
+						$sql_ary['session_forum_id'] = $this->page['forum'];
+					}
+
+					$this->update_session($sql_ary);
+
+					// Update the last visit time
+					$sql = 'UPDATE ' . USERS_TABLE . '
+						SET user_lastvisit = ' . (int) $this->data['session_time'] . '
+						WHERE user_id = ' . (int) $this->data['user_id'];
+					$db->sql_query($sql);
+				}
+
+				$SID = '?sid=';
+				$_SID = '';
+				return true;
+			}
+			else
+			{
+				// If the ip and browser does not match make sure we only have one bot assigned to one session
+				$db->sql_query('DELETE FROM ' . SESSIONS_TABLE . ' WHERE session_user_id = ' . $this->data['user_id']);
+			}
+		}
+
+		$session_autologin = (($this->cookie_data['k'] || $persist_login) && $this->data['is_registered']) ? true : false;
+		$set_admin = ($set_admin && $this->data['is_registered']) ? true : false;
+
+		// Create or update the session
+		$sql_ary = array(
+			'session_user_id'		=> (int) $this->data['user_id'],
+			'session_start'			=> (int) $this->time_now,
+			'session_last_visit'	=> (int) $this->data['session_last_visit'],
+			'session_time'			=> (int) $this->time_now,
+			'session_browser'		=> (string) trim(substr($this->browser, 0, 149)),
+			'session_forwarded_for'	=> (string) $this->forwarded_for,
+			'session_ip'			=> (string) $this->ip,
+			'session_autologin'		=> ($session_autologin) ? 1 : 0,
+			'session_admin'			=> ($set_admin) ? 1 : 0,
+			'session_viewonline'	=> ($viewonline) ? 1 : 0,
+		);
+
+		if ($this->update_session_page)
+		{
+			$sql_ary['session_page'] = (string) substr($this->page['page'], 0, 199);
+			$sql_ary['session_forum_id'] = $this->page['forum'];
+		}
+
+		$db->sql_return_on_error(true);
+
+		$sql = 'DELETE
+			FROM ' . SESSIONS_TABLE . '
+			WHERE session_id = \'' . $db->sql_escape($this->session_id) . '\'
+				AND session_user_id = ' . ANONYMOUS;
+
+		if (!defined('IN_ERROR_HANDLER') && (!$this->session_id || !$db->sql_query($sql) || !$db->sql_affectedrows()))
+		{
+			// Limit new sessions in 1 minute period (if required)
+			if (empty($this->data['session_time']) && $config['active_sessions'])
+			{
+//				$db->sql_return_on_error(false);
+
+				$sql = 'SELECT COUNT(session_id) AS sessions
+					FROM ' . SESSIONS_TABLE . '
+					WHERE session_time >= ' . ($this->time_now - 60);
+				$result = $db->sql_query($sql);
+				$row = $db->sql_fetchrow($result);
+				$db->sql_freeresult($result);
+
+				if ((int) $row['sessions'] > (int) $config['active_sessions'])
+				{
+					send_status_line(503, 'Service Unavailable');
+					trigger_error('BOARD_UNAVAILABLE');
+				}
+			}
+		}
+
+		// Since we re-create the session id here, the inserted row must be unique. Therefore, we display potential errors.
+		// Commented out because it will not allow forums to update correctly
+//		$db->sql_return_on_error(false);
+
+		// Something quite important: session_page always holds the *last* page visited, except for the *first* visit.
+		// We are not able to simply have an empty session_page btw, therefore we need to tell phpBB how to detect this special case.
+		// If the session id is empty, we have a completely new one and will set an "identifier" here. This identifier is able to be checked later.
+		if (empty($this->data['session_id']))
+		{
+			// This is a temporary variable, only set for the very first visit
+			$this->data['session_created'] = true;
+		}
+
+		$this->session_id = $this->data['session_id'] = md5(unique_id());
+
+		$sql_ary['session_id'] = (string) $this->session_id;
+		$sql_ary['session_page'] = (string) substr($this->page['page'], 0, 199);
+		$sql_ary['session_forum_id'] = $this->page['forum'];
+
+		$sql = 'INSERT INTO ' . SESSIONS_TABLE . ' ' . $db->sql_build_array('INSERT', $sql_ary);
+		$db->sql_query($sql);
+
+		$db->sql_return_on_error(false);
+
+		// Regenerate autologin/persistent login key
+		if ($session_autologin)
+		{
+			$this->set_login_key();
+		}
+
+		// refresh data
+		$SID = '?sid=' . $this->session_id;
+		$_SID = $this->session_id;
+		$this->data = array_merge($this->data, $sql_ary);
+
+		if (!$bot)
+		{
+			$cookie_expire = $this->time_now + (($config['max_autologin_time']) ? 86400 * (int) $config['max_autologin_time'] : 31536000);
+
+			$this->set_cookie('u', $this->cookie_data['u'], $cookie_expire);
+			$this->set_cookie('k', $this->cookie_data['k'], $cookie_expire);
+			$this->set_cookie('sid', $this->session_id, $cookie_expire);
+
+			unset($cookie_expire);
+
+			$sql = 'SELECT COUNT(session_id) AS sessions
+					FROM ' . SESSIONS_TABLE . '
+					WHERE session_user_id = ' . (int) $this->data['user_id'] . '
+					AND session_time >= ' . (int) ($this->time_now - (max($config['session_length'], $config['form_token_lifetime'])));
+			$result = $db->sql_query($sql);
+			$row = $db->sql_fetchrow($result);
+			$db->sql_freeresult($result);
+
+			if ((int) $row['sessions'] <= 1 || empty($this->data['user_form_salt']))
+			{
+				$this->data['user_form_salt'] = unique_id();
+				// Update the form key
+				$sql = 'UPDATE ' . USERS_TABLE . '
+					SET user_form_salt = \'' . $db->sql_escape($this->data['user_form_salt']) . '\'
+					WHERE user_id = ' . (int) $this->data['user_id'];
+				$db->sql_query($sql);
+			}
+		}
+		else
+		{
+			$this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now;
+
+			// Update the last visit time
+			$sql = 'UPDATE ' . USERS_TABLE . '
+				SET user_lastvisit = ' . (int) $this->data['session_time'] . '
+				WHERE user_id = ' . (int) $this->data['user_id'];
+			$db->sql_query($sql);
+
+			$SID = '?sid=';
+			$_SID = '';
+		}
+
+		return true;
+	}
+
+	/**
+	* Kills a session
+	*
+	* This method does what it says on the tin. It will delete a pre-existing session.
+	* It resets cookie information (destroying any autologin key within that cookie data)
+	* and update the users information from the relevant session data. It will then
+	* grab guest user information.
+	*/
+	function session_kill($new_session = true)
+	{
+		global $SID, $_SID, $db, $config, $phpbb_root_path, $phpEx, $phpbb_container;
+
+		$sql = 'DELETE FROM ' . SESSIONS_TABLE . "
+			WHERE session_id = '" . $db->sql_escape($this->session_id) . "'
+				AND session_user_id = " . (int) $this->data['user_id'];
+		$db->sql_query($sql);
+
+		// Allow connecting logout with external auth method logout
+		$method = basename(trim($config['auth_method']));
+
+		$provider = $phpbb_container->get('auth.provider.' . $method);
+		$provider->logout($this->data, $new_session);
+
+		if ($this->data['user_id'] != ANONYMOUS)
+		{
+			// Delete existing session, update last visit info first!
+			if (!isset($this->data['session_time']))
+			{
+				$this->data['session_time'] = time();
+			}
+
+			$sql = 'UPDATE ' . USERS_TABLE . '
+				SET user_lastvisit = ' . (int) $this->data['session_time'] . '
+				WHERE user_id = ' . (int) $this->data['user_id'];
+			$db->sql_query($sql);
+
+			if ($this->cookie_data['k'])
+			{
+				$sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
+					WHERE user_id = ' . (int) $this->data['user_id'] . "
+						AND key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'";
+				$db->sql_query($sql);
+			}
+
+			// Reset the data array
+			$this->data = array();
+
+			$sql = 'SELECT *
+				FROM ' . USERS_TABLE . '
+				WHERE user_id = ' . ANONYMOUS;
+			$result = $db->sql_query($sql);
+			$this->data = $db->sql_fetchrow($result);
+			$db->sql_freeresult($result);
+		}
+
+		$cookie_expire = $this->time_now - 31536000;
+		$this->set_cookie('u', '', $cookie_expire);
+		$this->set_cookie('k', '', $cookie_expire);
+		$this->set_cookie('sid', '', $cookie_expire);
+		unset($cookie_expire);
+
+		$SID = '?sid=';
+		$this->session_id = $_SID = '';
+
+		// To make sure a valid session is created we create one for the anonymous user
+		if ($new_session)
+		{
+			$this->session_create(ANONYMOUS);
+		}
+
+		return true;
+	}
+
+	/**
+	* Session garbage collection
+	*
+	* This looks a lot more complex than it really is. Effectively we are
+	* deleting any sessions older than an admin definable limit. Due to the
+	* way in which we maintain session data we have to ensure we update user
+	* data before those sessions are destroyed. In addition this method
+	* removes autologin key information that is older than an admin defined
+	* limit.
+	*/
+	function session_gc()
+	{
+		global $db, $config, $phpbb_root_path, $phpEx;
+
+		$batch_size = 10;
+
+		if (!$this->time_now)
+		{
+			$this->time_now = time();
+		}
+
+		// Firstly, delete guest sessions
+		$sql = 'DELETE FROM ' . SESSIONS_TABLE . '
+			WHERE session_user_id = ' . ANONYMOUS . '
+				AND session_time < ' . (int) ($this->time_now - $config['session_length']);
+		$db->sql_query($sql);
+
+		// Get expired sessions, only most recent for each user
+		$sql = 'SELECT session_user_id, session_page, MAX(session_time) AS recent_time
+			FROM ' . SESSIONS_TABLE . '
+			WHERE session_time < ' . ($this->time_now - $config['session_length']) . '
+			GROUP BY session_user_id, session_page';
+		$result = $db->sql_query_limit($sql, $batch_size);
+
+		$del_user_id = array();
+		$del_sessions = 0;
+
+		while ($row = $db->sql_fetchrow($result))
+		{
+			$sql = 'UPDATE ' . USERS_TABLE . '
+				SET user_lastvisit = ' . (int) $row['recent_time'] . ", user_lastpage = '" . $db->sql_escape($row['session_page']) . "'
+				WHERE user_id = " . (int) $row['session_user_id'];
+			$db->sql_query($sql);
+
+			$del_user_id[] = (int) $row['session_user_id'];
+			$del_sessions++;
+		}
+		$db->sql_freeresult($result);
+
+		if (sizeof($del_user_id))
+		{
+			// Delete expired sessions
+			$sql = 'DELETE FROM ' . SESSIONS_TABLE . '
+				WHERE ' . $db->sql_in_set('session_user_id', $del_user_id) . '
+					AND session_time < ' . ($this->time_now - $config['session_length']);
+			$db->sql_query($sql);
+		}
+
+		if ($del_sessions < $batch_size)
+		{
+			// Less than 10 users, update gc timer ... else we want gc
+			// called again to delete other sessions
+			set_config('session_last_gc', $this->time_now, true);
+
+			if ($config['max_autologin_time'])
+			{
+				$sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
+					WHERE last_login < ' . (time() - (86400 * (int) $config['max_autologin_time']));
+				$db->sql_query($sql);
+			}
+
+			// only called from CRON; should be a safe workaround until the infrastructure gets going
+			if (!class_exists('phpbb_captcha_factory', false))
+			{
+				include($phpbb_root_path . "includes/captcha/captcha_factory." . $phpEx);
+			}
+			phpbb_captcha_factory::garbage_collect($config['captcha_plugin']);
+
+			$sql = 'DELETE FROM ' . LOGIN_ATTEMPT_TABLE . '
+				WHERE attempt_time < ' . (time() - (int) $config['ip_login_limit_time']);
+			$db->sql_query($sql);
+		}
+
+		return;
+	}
+
+	/**
+	* Sets a cookie
+	*
+	* Sets a cookie of the given name with the specified data for the given length of time. If no time is specified, a session cookie will be set.
+	*
+	* @param string $name		Name of the cookie, will be automatically prefixed with the phpBB cookie name. track becomes [cookie_name]_track then.
+	* @param string $cookiedata	The data to hold within the cookie
+	* @param int $cookietime	The expiration time as UNIX timestamp. If 0 is provided, a session cookie is set.
+	*/
+	function set_cookie($name, $cookiedata, $cookietime)
+	{
+		global $config;
+
+		$name_data = rawurlencode($config['cookie_name'] . '_' . $name) . '=' . rawurlencode($cookiedata);
+		$expire = gmdate('D, d-M-Y H:i:s \\G\\M\\T', $cookietime);
+		$domain = (!$config['cookie_domain'] || $config['cookie_domain'] == 'localhost' || $config['cookie_domain'] == '127.0.0.1') ? '' : '; domain=' . $config['cookie_domain'];
+
+		header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . $config['cookie_path'] . $domain . ((!$config['cookie_secure']) ? '' : '; secure') . '; HttpOnly', false);
+	}
+
+	/**
+	* Check for banned user
+	*
+	* Checks whether the supplied user is banned by id, ip or email. If no parameters
+	* are passed to the method pre-existing session data is used. If $return is false
+	* this routine does not return on finding a banned user, it outputs a relevant
+	* message and stops execution.
+	*
+	* @param string|array	$user_ips	Can contain a string with one IP or an array of multiple IPs
+	*/
+	function check_ban($user_id = false, $user_ips = false, $user_email = false, $return = false)
+	{
+		global $config, $db;
+
+		if (defined('IN_CHECK_BAN'))
+		{
+			return;
+		}
+
+		$banned = false;
+		$cache_ttl = 3600;
+		$where_sql = array();
+
+		$sql = 'SELECT ban_ip, ban_userid, ban_email, ban_exclude, ban_give_reason, ban_end
+			FROM ' . BANLIST_TABLE . '
+			WHERE ';
+
+		// Determine which entries to check, only return those
+		if ($user_email === false)
+		{
+			$where_sql[] = "ban_email = ''";
+		}
+
+		if ($user_ips === false)
+		{
+			$where_sql[] = "(ban_ip = '' OR ban_exclude = 1)";
+		}
+
+		if ($user_id === false)
+		{
+			$where_sql[] = '(ban_userid = 0 OR ban_exclude = 1)';
+		}
+		else
+		{
+			$cache_ttl = ($user_id == ANONYMOUS) ? 3600 : 0;
+			$_sql = '(ban_userid = ' . $user_id;
+
+			if ($user_email !== false)
+			{
+				$_sql .= " OR ban_email <> ''";
+			}
+
+			if ($user_ips !== false)
+			{
+				$_sql .= " OR ban_ip <> ''";
+			}
+
+			$_sql .= ')';
+
+			$where_sql[] = $_sql;
+		}
+
+		$sql .= (sizeof($where_sql)) ? implode(' AND ', $where_sql) : '';
+		$result = $db->sql_query($sql, $cache_ttl);
+
+		$ban_triggered_by = 'user';
+		while ($row = $db->sql_fetchrow($result))
+		{
+			if ($row['ban_end'] && $row['ban_end'] < time())
+			{
+				continue;
+			}
+
+			$ip_banned = false;
+			if (!empty($row['ban_ip']))
+			{
+				if (!is_array($user_ips))
+				{
+					$ip_banned = preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_ip'], '#')) . '$#i', $user_ips);
+				}
+				else
+				{
+					foreach ($user_ips as $user_ip)
+					{
+						if (preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_ip'], '#')) . '$#i', $user_ip))
+						{
+							$ip_banned = true;
+							break;
+						}
+					}
+				}
+			}
+
+			if ((!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id) ||
+				$ip_banned ||
+				(!empty($row['ban_email']) && preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_email'], '#')) . '$#i', $user_email)))
+			{
+				if (!empty($row['ban_exclude']))
+				{
+					$banned = false;
+					break;
+				}
+				else
+				{
+					$banned = true;
+					$ban_row = $row;
+
+					if (!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id)
+					{
+						$ban_triggered_by = 'user';
+					}
+					else if ($ip_banned)
+					{
+						$ban_triggered_by = 'ip';
+					}
+					else
+					{
+						$ban_triggered_by = 'email';
+					}
+
+					// Don't break. Check if there is an exclude rule for this user
+				}
+			}
+		}
+		$db->sql_freeresult($result);
+
+		if ($banned && !$return)
+		{
+			global $template;
+
+			// If the session is empty we need to create a valid one...
+			if (empty($this->session_id))
+			{
+				// This seems to be no longer needed? - #14971
+//				$this->session_create(ANONYMOUS);
+			}
+
+			// Initiate environment ... since it won't be set at this stage
+			$this->setup();
+
+			// Logout the user, banned users are unable to use the normal 'logout' link
+			if ($this->data['user_id'] != ANONYMOUS)
+			{
+				$this->session_kill();
+			}
+
+			// We show a login box here to allow founders accessing the board if banned by IP
+			if (defined('IN_LOGIN') && $this->data['user_id'] == ANONYMOUS)
+			{
+				global $phpEx;
+
+				$this->setup('ucp');
+				$this->data['is_registered'] = $this->data['is_bot'] = false;
+
+				// Set as a precaution to allow login_box() handling this case correctly as well as this function not being executed again.
+				define('IN_CHECK_BAN', 1);
+
+				login_box("index.$phpEx");
+
+				// The false here is needed, else the user is able to circumvent the ban.
+				$this->session_kill(false);
+			}
+
+			// Ok, we catch the case of an empty session id for the anonymous user...
+			// This can happen if the user is logging in, banned by username and the login_box() being called "again".
+			if (empty($this->session_id) && defined('IN_CHECK_BAN'))
+			{
+				$this->session_create(ANONYMOUS);
+			}
+
+
+			// Determine which message to output
+			$till_date = ($ban_row['ban_end']) ? $this->format_date($ban_row['ban_end']) : '';
+			$message = ($ban_row['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
+
+			$message = sprintf($this->lang[$message], $till_date, '<a href="mailto:' . $config['board_contact'] . '">', '</a>');
+			$message .= ($ban_row['ban_give_reason']) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_give_reason']) : '';
+			$message .= '<br /><br /><em>' . $this->lang['BAN_TRIGGERED_BY_' . strtoupper($ban_triggered_by)] . '</em>';
+
+			// To circumvent session_begin returning a valid value and the check_ban() not called on second page view, we kill the session again
+			$this->session_kill(false);
+
+			// A very special case... we are within the cron script which is not supposed to print out the ban message... show blank page
+			if (defined('IN_CRON'))
+			{
+				garbage_collection();
+				exit_handler();
+				exit;
+			}
+
+			trigger_error($message);
+		}
+
+		return ($banned && $ban_row['ban_give_reason']) ? $ban_row['ban_give_reason'] : $banned;
+	}
+
+	/**
+	* Check if ip is blacklisted
+	* This should be called only where absolutly necessary
+	*
+	* Only IPv4 (rbldns does not support AAAA records/IPv6 lookups)
+	*
+	* @author satmd (from the php manual)
+	* @param string $mode register/post - spamcop for example is ommitted for posting
+	* @return false if ip is not blacklisted, else an array([checked server], [lookup])
+	*/
+	function check_dnsbl($mode, $ip = false)
+	{
+		if ($ip === false)
+		{
+			$ip = $this->ip;
+		}
+
+		// Neither Spamhaus nor Spamcop supports IPv6 addresses.
+		if (strpos($ip, ':') !== false)
+		{
+			return false;
+		}
+
+		$dnsbl_check = array(
+			'sbl.spamhaus.org'	=> 'http://www.spamhaus.org/query/bl?ip=',
+		);
+
+		if ($mode == 'register')
+		{
+			$dnsbl_check['bl.spamcop.net'] = 'http://spamcop.net/bl.shtml?';
+		}
+
+		if ($ip)
+		{
+			$quads = explode('.', $ip);
+			$reverse_ip = $quads[3] . '.' . $quads[2] . '.' . $quads[1] . '.' . $quads[0];
+
+			// Need to be listed on all servers...
+			$listed = true;
+			$info = array();
+
+			foreach ($dnsbl_check as $dnsbl => $lookup)
+			{
+				if (phpbb_checkdnsrr($reverse_ip . '.' . $dnsbl . '.', 'A') === true)
+				{
+					$info = array($dnsbl, $lookup . $ip);
+				}
+				else
+				{
+					$listed = false;
+				}
+			}
+
+			if ($listed)
+			{
+				return $info;
+			}
+		}
+
+		return false;
+	}
+
+	/**
+	* Check if URI is blacklisted
+	* This should be called only where absolutly necessary, for example on the submitted website field
+	* This function is not in use at the moment and is only included for testing purposes, it may not work at all!
+	* This means it is untested at the moment and therefore commented out
+	*
+	* @param string $uri URI to check
+	* @return true if uri is on blacklist, else false. Only blacklist is checked (~zero FP), no grey lists
+	function check_uribl($uri)
+	{
+		// Normally parse_url() is not intended to parse uris
+		// We need to get the top-level domain name anyway... change.
+		$uri = parse_url($uri);
+
+		if ($uri === false || empty($uri['host']))
+		{
+			return false;
+		}
+
+		$uri = trim($uri['host']);
+
+		if ($uri)
+		{
+			// One problem here... the return parameter for the "windows" method is different from what
+			// we expect... this may render this check useless...
+			if (phpbb_checkdnsrr($uri . '.multi.uribl.com.', 'A') === true)
+			{
+				return true;
+			}
+		}
+
+		return false;
+	}
+	*/
+
+	/**
+	* Set/Update a persistent login key
+	*
+	* This method creates or updates a persistent session key. When a user makes
+	* use of persistent (formerly auto-) logins a key is generated and stored in the
+	* DB. When they revisit with the same key it's automatically updated in both the
+	* DB and cookie. Multiple keys may exist for each user representing different
+	* browsers or locations. As with _any_ non-secure-socket no passphrase login this
+	* remains vulnerable to exploit.
+	*/
+	function set_login_key($user_id = false, $key = false, $user_ip = false)
+	{
+		global $config, $db;
+
+		$user_id = ($user_id === false) ? $this->data['user_id'] : $user_id;
+		$user_ip = ($user_ip === false) ? $this->ip : $user_ip;
+		$key = ($key === false) ? (($this->cookie_data['k']) ? $this->cookie_data['k'] : false) : $key;
+
+		$key_id = unique_id(hexdec(substr($this->session_id, 0, 8)));
+
+		$sql_ary = array(
+			'key_id'		=> (string) md5($key_id),
+			'last_ip'		=> (string) $this->ip,
+			'last_login'	=> (int) time()
+		);
+
+		if (!$key)
+		{
+			$sql_ary += array(
+				'user_id'	=> (int) $user_id
+			);
+		}
+
+		if ($key)
+		{
+			$sql = 'UPDATE ' . SESSIONS_KEYS_TABLE . '
+				SET ' . $db->sql_build_array('UPDATE', $sql_ary) . '
+				WHERE user_id = ' . (int) $user_id . "
+					AND key_id = '" . $db->sql_escape(md5($key)) . "'";
+		}
+		else
+		{
+			$sql = 'INSERT INTO ' . SESSIONS_KEYS_TABLE . ' ' . $db->sql_build_array('INSERT', $sql_ary);
+		}
+		$db->sql_query($sql);
+
+		$this->cookie_data['k'] = $key_id;
+
+		return false;
+	}
+
+	/**
+	* Reset all login keys for the specified user
+	*
+	* This method removes all current login keys for a specified (or the current)
+	* user. It will be called on password change to render old keys unusable
+	*/
+	function reset_login_keys($user_id = false)
+	{
+		global $config, $db;
+
+		$user_id = ($user_id === false) ? (int) $this->data['user_id'] : (int) $user_id;
+
+		$sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
+			WHERE user_id = ' . (int) $user_id;
+		$db->sql_query($sql);
+
+		// If the user is logged in, update last visit info first before deleting sessions
+		$sql = 'SELECT session_time, session_page
+			FROM ' . SESSIONS_TABLE . '
+			WHERE session_user_id = ' . (int) $user_id . '
+			ORDER BY session_time DESC';
+		$result = $db->sql_query_limit($sql, 1);
+		$row = $db->sql_fetchrow($result);
+		$db->sql_freeresult($result);
+
+		if ($row)
+		{
+			$sql = 'UPDATE ' . USERS_TABLE . '
+				SET user_lastvisit = ' . (int) $row['session_time'] . ", user_lastpage = '" . $db->sql_escape($row['session_page']) . "'
+				WHERE user_id = " . (int) $user_id;
+			$db->sql_query($sql);
+		}
+
+		// Let's also clear any current sessions for the specified user_id
+		// If it's the current user then we'll leave this session intact
+		$sql_where = 'session_user_id = ' . (int) $user_id;
+		$sql_where .= ($user_id === (int) $this->data['user_id']) ? " AND session_id <> '" . $db->sql_escape($this->session_id) . "'" : '';
+
+		$sql = 'DELETE FROM ' . SESSIONS_TABLE . "
+			WHERE $sql_where";
+		$db->sql_query($sql);
+
+		// We're changing the password of the current user and they have a key
+		// Lets regenerate it to be safe
+		if ($user_id === (int) $this->data['user_id'] && $this->cookie_data['k'])
+		{
+			$this->set_login_key($user_id);
+		}
+	}
+
+
+	/**
+	* Check if the request originated from the same page.
+	* @param bool $check_script_path If true, the path will be checked as well
+	*/
+	function validate_referer($check_script_path = false)
+	{
+		global $config, $request;
+
+		// no referer - nothing to validate, user's fault for turning it off (we only check on POST; so meta can't be the reason)
+		if (empty($this->referer) || empty($this->host))
+		{
+			return true;
+		}
+
+		$host = htmlspecialchars($this->host);
+		$ref = substr($this->referer, strpos($this->referer, '://') + 3);
+
+		if (!(stripos($ref, $host) === 0) && (!$config['force_server_vars'] || !(stripos($ref, $config['server_name']) === 0)))
+		{
+			return false;
+		}
+		else if ($check_script_path && rtrim($this->page['root_script_path'], '/') !== '')
+		{
+			$ref = substr($ref, strlen($host));
+			$server_port = $request->server('SERVER_PORT', 0);
+
+			if ($server_port !== 80 && $server_port !== 443 && stripos($ref, ":$server_port") === 0)
+			{
+				$ref = substr($ref, strlen(":$server_port"));
+			}
+
+			if (!(stripos(rtrim($ref, '/'), rtrim($this->page['root_script_path'], '/')) === 0))
+			{
+				return false;
+			}
+		}
+
+		return true;
+	}
+
+
+	function unset_admin()
+	{
+		global $db;
+		$sql = 'UPDATE ' . SESSIONS_TABLE . '
+			SET session_admin = 0
+			WHERE session_id = \'' . $db->sql_escape($this->session_id) . '\'';
+		$db->sql_query($sql);
+	}
+
+	/**
+	* Update the session data
+	*
+	* @param array $session_data associative array of session keys to be updated
+	* @param string $session_id optional session_id, defaults to current user's session_id
+	*/
+	public function update_session($session_data, $session_id = null)
+	{
+		global $db;
+
+		$session_id = ($session_id) ? $session_id : $this->session_id;
+
+		$sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $session_data) . "
+			WHERE session_id = '" . $db->sql_escape($session_id) . "'";
+		$db->sql_query($sql);
+	}
+}
-- 
cgit v1.2.1


From da2752e4004b296ae5acdd08b7c0a758d8f61e9d Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Sun, 14 Jul 2013 13:30:52 -0400
Subject: [ticket/11700] Modify all code to use the new interface names

PHPBB3-11700
---
 phpBB/phpbb/session.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index e0585b1523..3bff91e275 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -243,7 +243,7 @@ class phpbb_session
 			$this->forwarded_for = '';
 		}
 
-		if ($request->is_set($config['cookie_name'] . '_sid', phpbb_request_interface::COOKIE) || $request->is_set($config['cookie_name'] . '_u', phpbb_request_interface::COOKIE))
+		if ($request->is_set($config['cookie_name'] . '_sid', phpbb_request_request_interface::COOKIE) || $request->is_set($config['cookie_name'] . '_u', phpbb_request_request_interface::COOKIE))
 		{
 			$this->cookie_data['u'] = request_var($config['cookie_name'] . '_u', 0, false, true);
 			$this->cookie_data['k'] = request_var($config['cookie_name'] . '_k', '', false, true);
@@ -405,9 +405,9 @@ class phpbb_session
 
 					$provider = $phpbb_container->get('auth.provider.' . $method);
 
-					if (!($provider instanceof phpbb_auth_provider_interface))
+					if (!($provider instanceof phpbb_auth_provider_provider_interface))
 					{
-						throw new \RuntimeException($provider . ' must implement phpbb_auth_provider_interface');
+						throw new \RuntimeException($provider . ' must implement phpbb_auth_provider_provider_interface');
 					}
 
 					$ret = $provider->validate_session($this->data);
-- 
cgit v1.2.1


From 80f81dd0d2d4aaef0b9c770d6071526aaca79e06 Mon Sep 17 00:00:00 2001
From: Andy Chase <asperous2@gmail.com>
Date: Mon, 22 Jul 2013 15:04:30 -0700
Subject: [ticket/11731] Remove static calls to captcha garbage collector

PHPBB3-11731
---
 phpBB/phpbb/session.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index e0585b1523..dc33786666 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1022,7 +1022,8 @@ class phpbb_session
 			{
 				include($phpbb_root_path . "includes/captcha/captcha_factory." . $phpEx);
 			}
-			phpbb_captcha_factory::garbage_collect($config['captcha_plugin']);
+			$captcha_factory = new phpbb_captcha_factory();
+			$captcha_factory->garbage_collect($config['captcha_plugin']);
 
 			$sql = 'DELETE FROM ' . LOGIN_ATTEMPT_TABLE . '
 				WHERE attempt_time < ' . (time() - (int) $config['ip_login_limit_time']);
-- 
cgit v1.2.1


From b95fdacdd378877d277e261465da73deb06e50da Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Tue, 10 Sep 2013 14:01:09 +0200
Subject: [ticket/11700] Move all recent code to namespaces

PHPBB3-11700
---
 phpBB/phpbb/session.php | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 3bff91e275..782ef60c52 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -7,6 +7,8 @@
 *
 */
 
+namespace phpbb;
+
 /**
 * @ignore
 */
@@ -19,7 +21,7 @@ if (!defined('IN_PHPBB'))
 * Session class
 * @package phpBB3
 */
-class phpbb_session
+class session
 {
 	var $cookie_data = array();
 	var $page = array();
@@ -197,7 +199,7 @@ class phpbb_session
 	* This is where all session activity begins. We gather various pieces of
 	* information from the client and server. We test to see if a session already
 	* exists. If it does, fine and dandy. If it doesn't we'll go on to create a
-	* new one ... pretty logical heh? We also examine the system load (if we're
+	* new \one ... pretty logical heh? We also examine the system load (if we're
 	* running on a system which makes such information readily available) and
 	* halt if it's above an admin definable limit.
 	*
@@ -243,7 +245,7 @@ class phpbb_session
 			$this->forwarded_for = '';
 		}
 
-		if ($request->is_set($config['cookie_name'] . '_sid', phpbb_request_request_interface::COOKIE) || $request->is_set($config['cookie_name'] . '_u', phpbb_request_request_interface::COOKIE))
+		if ($request->is_set($config['cookie_name'] . '_sid', \phpbb\request\request_interface::COOKIE) || $request->is_set($config['cookie_name'] . '_u', \phpbb\request\request_interface::COOKIE))
 		{
 			$this->cookie_data['u'] = request_var($config['cookie_name'] . '_u', 0, false, true);
 			$this->cookie_data['k'] = request_var($config['cookie_name'] . '_k', '', false, true);
@@ -401,13 +403,13 @@ class phpbb_session
 					$session_expired = false;
 
 					// Check whether the session is still valid if we have one
-					$method = basename(trim($config['auth_method']));
+                    $method = basename(trim($config['auth_method']));
 
 					$provider = $phpbb_container->get('auth.provider.' . $method);
 
-					if (!($provider instanceof phpbb_auth_provider_provider_interface))
+					if (!($provider instanceof \phpbb\auth\provider\provider_interface))
 					{
-						throw new \RuntimeException($provider . ' must implement phpbb_auth_provider_provider_interface');
+						throw new \RuntimeException($provider . ' must implement \phpbb\auth\provider\provider_interface');
 					}
 
 					$ret = $provider->validate_session($this->data);
@@ -492,18 +494,18 @@ class phpbb_session
 			}
 		}
 
-		// If we reach here then no (valid) session exists. So we'll create a new one
+		// If we reach here then no (valid) session exists. So we'll create a new \one
 		return $this->session_create();
 	}
 
 	/**
-	* Create a new session
+	* Create a new \session
 	*
 	* If upon trying to start a session we discover there is nothing existing we
 	* jump here. Additionally this method is called directly during login to regenerate
 	* the session for the specific user. In this method we carry out a number of tasks;
 	* garbage collection, (search)bot checking, banned user comparison. Basically
-	* though this method will result in a new session for a specific user.
+	* though this method will result in a new \session for a specific user.
 	*/
 	function session_create($user_id = false, $set_admin = false, $persist_login = false, $viewonline = true)
 	{
@@ -773,7 +775,7 @@ class phpbb_session
 
 		if (!defined('IN_ERROR_HANDLER') && (!$this->session_id || !$db->sql_query($sql) || !$db->sql_affectedrows()))
 		{
-			// Limit new sessions in 1 minute period (if required)
+			// Limit new \sessions in 1 minute period (if required)
 			if (empty($this->data['session_time']) && $config['active_sessions'])
 			{
 //				$db->sql_return_on_error(false);
@@ -799,7 +801,7 @@ class phpbb_session
 
 		// Something quite important: session_page always holds the *last* page visited, except for the *first* visit.
 		// We are not able to simply have an empty session_page btw, therefore we need to tell phpBB how to detect this special case.
-		// If the session id is empty, we have a completely new one and will set an "identifier" here. This identifier is able to be checked later.
+		// If the session id is empty, we have a completely new \one and will set an "identifier" here. This identifier is able to be checked later.
 		if (empty($this->data['session_id']))
 		{
 			// This is a temporary variable, only set for the very first visit
@@ -1022,7 +1024,7 @@ class phpbb_session
 			{
 				include($phpbb_root_path . "includes/captcha/captcha_factory." . $phpEx);
 			}
-			phpbb_captcha_factory::garbage_collect($config['captcha_plugin']);
+			\phpbb_captcha_factory::garbage_collect($config['captcha_plugin']);
 
 			$sql = 'DELETE FROM ' . LOGIN_ATTEMPT_TABLE . '
 				WHERE attempt_time < ' . (time() - (int) $config['ip_login_limit_time']);
-- 
cgit v1.2.1


From 3860b37741c21576dae2f02e3754aa322c24567f Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Mon, 16 Sep 2013 03:50:47 +0200
Subject: [ticket/11700] Actually "one" in comments is not a class

PHPBB3-11700
---
 phpBB/phpbb/session.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 6925ebbc6a..2bfa55334d 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -199,7 +199,7 @@ class session
 	* This is where all session activity begins. We gather various pieces of
 	* information from the client and server. We test to see if a session already
 	* exists. If it does, fine and dandy. If it doesn't we'll go on to create a
-	* new \one ... pretty logical heh? We also examine the system load (if we're
+	* new one ... pretty logical heh? We also examine the system load (if we're
 	* running on a system which makes such information readily available) and
 	* halt if it's above an admin definable limit.
 	*
@@ -494,7 +494,7 @@ class session
 			}
 		}
 
-		// If we reach here then no (valid) session exists. So we'll create a new \one
+		// If we reach here then no (valid) session exists. So we'll create a new one
 		return $this->session_create();
 	}
 
@@ -801,7 +801,7 @@ class session
 
 		// Something quite important: session_page always holds the *last* page visited, except for the *first* visit.
 		// We are not able to simply have an empty session_page btw, therefore we need to tell phpBB how to detect this special case.
-		// If the session id is empty, we have a completely new \one and will set an "identifier" here. This identifier is able to be checked later.
+		// If the session id is empty, we have a completely new one and will set an "identifier" here. This identifier is able to be checked later.
 		if (empty($this->data['session_id']))
 		{
 			// This is a temporary variable, only set for the very first visit
-- 
cgit v1.2.1


From 390dc86344c23b658085bae4a719399e5eb579f0 Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Mon, 16 Sep 2013 05:00:18 +0200
Subject: [ticket/11700] And some last comments with backslashes

PHPBB3-11700
---
 phpBB/phpbb/session.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 2bfa55334d..543369a3ab 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -499,13 +499,13 @@ class session
 	}
 
 	/**
-	* Create a new \session
+	* Create a new session
 	*
 	* If upon trying to start a session we discover there is nothing existing we
 	* jump here. Additionally this method is called directly during login to regenerate
 	* the session for the specific user. In this method we carry out a number of tasks;
 	* garbage collection, (search)bot checking, banned user comparison. Basically
-	* though this method will result in a new \session for a specific user.
+	* though this method will result in a new session for a specific user.
 	*/
 	function session_create($user_id = false, $set_admin = false, $persist_login = false, $viewonline = true)
 	{
@@ -775,7 +775,7 @@ class session
 
 		if (!defined('IN_ERROR_HANDLER') && (!$this->session_id || !$db->sql_query($sql) || !$db->sql_affectedrows()))
 		{
-			// Limit new \sessions in 1 minute period (if required)
+			// Limit new sessions in 1 minute period (if required)
 			if (empty($this->data['session_time']) && $config['active_sessions'])
 			{
 //				$db->sql_return_on_error(false);
-- 
cgit v1.2.1


From 1d7f8f81935157867539d4c3991c5922afec8b55 Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Tue, 17 Sep 2013 18:10:58 +0200
Subject: [ticket/11700] Get functional tests running after develop merge

PHPBB3-11700
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 543369a3ab..2baf61043d 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -403,7 +403,7 @@ class session
 					$session_expired = false;
 
 					// Check whether the session is still valid if we have one
-                    $method = basename(trim($config['auth_method']));
+					$method = basename(trim($config['auth_method']));
 
 					$provider = $phpbb_container->get('auth.provider.' . $method);
 
-- 
cgit v1.2.1


From f4317bc864f9c19a15de83ea30cb46a04c95a295 Mon Sep 17 00:00:00 2001
From: Nathan Guse <nathaniel.guse@gmail.com>
Date: Tue, 17 Sep 2013 11:41:46 -0500
Subject: [ticket/11850] Fix $user->page on pages through the controller

PHPBB3-11850
---
 phpBB/phpbb/session.php | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index dc33786666..52f621dbf6 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -40,13 +40,13 @@ class phpbb_session
 	*/
 	static function extract_current_page($root_path)
 	{
-		global $request;
+		global $request, $symfony_request, $phpbb_filesystem;
 
 		$page_array = array();
 
 		// First of all, get the request uri...
-		$script_name = htmlspecialchars_decode($request->server('PHP_SELF'));
-		$args = explode('&', htmlspecialchars_decode($request->server('QUERY_STRING')));
+		$script_name = $symfony_request->getScriptName();
+		$args = explode('&', $symfony_request->getQueryString());
 
 		// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
 		if (!$script_name)
@@ -103,10 +103,19 @@ class phpbb_session
 		}
 
 		// Current page from phpBB root (for example: adm/index.php?i=10&b=2)
-		$page = (($page_dir) ? $page_dir . '/' : '') . $page_name . (($query_string) ? "?$query_string" : '');
+		$symfony_request_path = $phpbb_filesystem->clean_path($symfony_request->getPathInfo());
+		$page = (($page_dir) ? $page_dir . '/' : '') . $page_name;
+		if ($symfony_request_path !== '/')
+		{
+			$page .= $symfony_request_path;
+		}
+		if ($query_string)
+		{
+			$page .= '?' . $query_string;
+		}
 
 		// The script path from the webroot to the current directory (for example: /phpBB3/adm/) : always prefixed with / and ends in /
-		$script_path = trim(str_replace('\\', '/', dirname($script_name)));
+		$script_path = $symfony_request->getBasePath();
 
 		// The script path from the webroot to the phpBB root (for example: /phpBB3/)
 		$script_dirs = explode('/', $script_path);
-- 
cgit v1.2.1


From 9c535da52888d60aecef9799062974e375f22f82 Mon Sep 17 00:00:00 2001
From: Nathan Guse <nathaniel.guse@gmail.com>
Date: Tue, 17 Sep 2013 22:00:06 -0500
Subject: [ticket/11850] page_name contains controller request rather than
 query string

Fixing tests

PHPBB3-11850
---
 phpBB/phpbb/session.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 52f621dbf6..1752291cf2 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -87,6 +87,12 @@ class phpbb_session
 		$page_name = (substr($script_name, -1, 1) == '/') ? '' : basename($script_name);
 		$page_name = urlencode(htmlspecialchars($page_name));
 
+		$symfony_request_path = $phpbb_filesystem->clean_path($symfony_request->getPathInfo());
+		if ($symfony_request_path !== '/')
+		{
+			$page_name .= $symfony_request_path;
+		}
+
 		// current directory within the phpBB root (for example: adm)
 		$root_dirs = explode('/', str_replace('\\', '/', phpbb_realpath($root_path)));
 		$page_dirs = explode('/', str_replace('\\', '/', phpbb_realpath('./')));
@@ -103,12 +109,7 @@ class phpbb_session
 		}
 
 		// Current page from phpBB root (for example: adm/index.php?i=10&b=2)
-		$symfony_request_path = $phpbb_filesystem->clean_path($symfony_request->getPathInfo());
 		$page = (($page_dir) ? $page_dir . '/' : '') . $page_name;
-		if ($symfony_request_path !== '/')
-		{
-			$page .= $symfony_request_path;
-		}
 		if ($query_string)
 		{
 			$page .= '?' . $query_string;
-- 
cgit v1.2.1


From 7f58a4572eaca75aecff2da889e67ea151616011 Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Mon, 28 Oct 2013 22:27:25 +0100
Subject: [ticket/11981] Fix code sniffer complaints

PHPBB3-11981
---
 phpBB/phpbb/session.php | 1 -
 1 file changed, 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 5e4380bfc8..214ab8fd33 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1235,7 +1235,6 @@ class session
 				$this->session_create(ANONYMOUS);
 			}
 
-
 			// Determine which message to output
 			$till_date = ($ban_row['ban_end']) ? $this->format_date($ban_row['ban_end']) : '';
 			$message = ($ban_row['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
-- 
cgit v1.2.1


From 7aa8f6461f1e85cf91931f56b95384e54fec07c2 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Wed, 30 Oct 2013 13:05:28 +0100
Subject: [task/code-sniffer] Remove the IN_PHPBB check side-effect from class
 files.

PHPBB3-11980
---
 phpBB/phpbb/session.php | 8 --------
 1 file changed, 8 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 214ab8fd33..f530d30f1f 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -9,14 +9,6 @@
 
 namespace phpbb;
 
-/**
-* @ignore
-*/
-if (!defined('IN_PHPBB'))
-{
-	exit;
-}
-
 /**
 * Session class
 * @package phpBB3
-- 
cgit v1.2.1


From 257ff46659cb2f35514b21a5345dd68b666e6994 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Fri, 2 May 2014 14:22:59 -0700
Subject: [ticket/10521] Allow language switching by URL parameter

PHPBB3-10521
---
 phpBB/phpbb/session.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index f530d30f1f..c9e04e1401 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1045,8 +1045,9 @@ class session
 	* @param string $name		Name of the cookie, will be automatically prefixed with the phpBB cookie name. track becomes [cookie_name]_track then.
 	* @param string $cookiedata	The data to hold within the cookie
 	* @param int $cookietime	The expiration time as UNIX timestamp. If 0 is provided, a session cookie is set.
+	* @param int $httponly		Use HttpOnly. Defaults to true. Use false to make cookie accessible by client-side scripts.
 	*/
-	function set_cookie($name, $cookiedata, $cookietime)
+	function set_cookie($name, $cookiedata, $cookietime, $httponly = true)
 	{
 		global $config;
 
@@ -1054,7 +1055,7 @@ class session
 		$expire = gmdate('D, d-M-Y H:i:s \\G\\M\\T', $cookietime);
 		$domain = (!$config['cookie_domain'] || $config['cookie_domain'] == 'localhost' || $config['cookie_domain'] == '127.0.0.1') ? '' : '; domain=' . $config['cookie_domain'];
 
-		header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . $config['cookie_path'] . $domain . ((!$config['cookie_secure']) ? '' : '; secure') . '; HttpOnly', false);
+		header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . $config['cookie_path'] . $domain . ((!$config['cookie_secure']) ? '' : '; secure') . ';' . (($httponly) ? ' HttpOnly' : ''), false);
 	}
 
 	/**
-- 
cgit v1.2.1


From 6d71f7d7ba282d128f69ef2441a9292e3d3f7e4b Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Fri, 2 May 2014 15:57:39 -0700
Subject: [ticket/10521] Update docblock of set_cookie for new HttpOnly param

PHPBB3-10521
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index c9e04e1401..ea421ffcf3 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1045,7 +1045,7 @@ class session
 	* @param string $name		Name of the cookie, will be automatically prefixed with the phpBB cookie name. track becomes [cookie_name]_track then.
 	* @param string $cookiedata	The data to hold within the cookie
 	* @param int $cookietime	The expiration time as UNIX timestamp. If 0 is provided, a session cookie is set.
-	* @param int $httponly		Use HttpOnly. Defaults to true. Use false to make cookie accessible by client-side scripts.
+	* @param bool $httponly		Use HttpOnly. Defaults to true. Use false to make cookie accessible by client-side scripts.
 	*/
 	function set_cookie($name, $cookiedata, $cookietime, $httponly = true)
 	{
-- 
cgit v1.2.1


From a759704b39fc1c1353f865a633759b1369589b67 Mon Sep 17 00:00:00 2001
From: Yuriy Rusko <github@rusko.net>
Date: Tue, 27 May 2014 20:18:06 +0200
Subject: [ticket/12594] Remove @package tags and update file headers

PHPBB3-12594
---
 phpBB/phpbb/session.php | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index ea421ffcf3..d286dc9cfc 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1,9 +1,13 @@
 <?php
 /**
 *
-* @package phpBB3
-* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
 *
 */
 
@@ -11,7 +15,6 @@ namespace phpbb;
 
 /**
 * Session class
-* @package phpBB3
 */
 class session
 {
-- 
cgit v1.2.1


From d52f34f5ec5d006ec7e610e1c72266df21e70ac7 Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Sun, 5 Jun 2011 09:40:43 +0200
Subject: [ticket/10073] Add a contact administrators page and refactor email
 forms.

The message to be displayed on top of the email form cannot be configured yet.

PHPBB3-10073
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index d286dc9cfc..cfcb8e10a2 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1075,7 +1075,7 @@ class session
 	{
 		global $config, $db;
 
-		if (defined('IN_CHECK_BAN'))
+		if (defined('IN_CHECK_BAN') || defined('SKIP_CHECK_BAN'))
 		{
 			return;
 		}
-- 
cgit v1.2.1


From 389bc0b8dd5594a9f66c1026df408dfe73eb65b0 Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Tue, 7 Jun 2011 03:46:38 +0200
Subject: [ticket/10073] Replace board_contact mail with links to contact page

Error pages still contain the email address.

PHPBB3-10073
---
 phpBB/phpbb/session.php | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index cfcb8e10a2..c35caf5047 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1189,7 +1189,7 @@ class session
 
 		if ($banned && !$return)
 		{
-			global $template;
+			global $template, $phpbb_root_path, $phpEx;
 
 			// If the session is empty we need to create a valid one...
 			if (empty($this->session_id))
@@ -1210,8 +1210,6 @@ class session
 			// We show a login box here to allow founders accessing the board if banned by IP
 			if (defined('IN_LOGIN') && $this->data['user_id'] == ANONYMOUS)
 			{
-				global $phpEx;
-
 				$this->setup('ucp');
 				$this->data['is_registered'] = $this->data['is_bot'] = false;
 
@@ -1235,7 +1233,7 @@ class session
 			$till_date = ($ban_row['ban_end']) ? $this->format_date($ban_row['ban_end']) : '';
 			$message = ($ban_row['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
 
-			$message = sprintf($this->lang[$message], $till_date, '<a href="mailto:' . $config['board_contact'] . '">', '</a>');
+			$message = sprintf($this->lang[$message], $till_date, '<a href="' . append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=contactadmin') . '">', '</a>');
 			$message .= ($ban_row['ban_give_reason']) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_give_reason']) : '';
 			$message .= '<br /><br /><em>' . $this->lang['BAN_TRIGGERED_BY_' . strtoupper($ban_triggered_by)] . '</em>';
 
-- 
cgit v1.2.1


From ed8c16bf0ddb8fc8723aa870607f255d80aab55b Mon Sep 17 00:00:00 2001
From: Joas Schilling <nickvergessen@gmx.de>
Date: Sat, 3 May 2014 16:34:25 +0200
Subject: [ticket/10073] Fallback to board_contact when contact page is
 disabled

PHPBB3-10073
---
 phpBB/phpbb/session.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index c35caf5047..093c013e42 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1233,7 +1233,15 @@ class session
 			$till_date = ($ban_row['ban_end']) ? $this->format_date($ban_row['ban_end']) : '';
 			$message = ($ban_row['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
 
-			$message = sprintf($this->lang[$message], $till_date, '<a href="' . append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=contactadmin') . '">', '</a>');
+			if ($config['contact_admin_form_enable'])
+			{
+				$contact_link = append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=contactadmin');
+			}
+			else
+			{
+				$contact_link = 'mailto:' . htmlspecialchars($config['board_contact']);
+			}
+			$message = sprintf($this->lang[$message], $till_date, '<a href="' . $contact_link . '">', '</a>');
 			$message .= ($ban_row['ban_give_reason']) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_give_reason']) : '';
 			$message .= '<br /><br /><em>' . $this->lang['BAN_TRIGGERED_BY_' . strtoupper($ban_triggered_by)] . '</em>';
 
-- 
cgit v1.2.1


From f01e0a2eef0604367620e8b9aa323f3feb86ea3c Mon Sep 17 00:00:00 2001
From: Joas Schilling <nickvergessen@gmx.de>
Date: Sat, 3 May 2014 16:57:04 +0200
Subject: [ticket/10073] Deduplicate the if statement

PHPBB3-10073
---
 phpBB/phpbb/session.php | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 093c013e42..c2669ea6cc 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1233,14 +1233,7 @@ class session
 			$till_date = ($ban_row['ban_end']) ? $this->format_date($ban_row['ban_end']) : '';
 			$message = ($ban_row['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
 
-			if ($config['contact_admin_form_enable'])
-			{
-				$contact_link = append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=contactadmin');
-			}
-			else
-			{
-				$contact_link = 'mailto:' . htmlspecialchars($config['board_contact']);
-			}
+			$contact_link = phpbb_get_board_contact_link($config, $phpbb_root_path, $phpEx);
 			$message = sprintf($this->lang[$message], $till_date, '<a href="' . $contact_link . '">', '</a>');
 			$message .= ($ban_row['ban_give_reason']) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_give_reason']) : '';
 			$message .= '<br /><br /><em>' . $this->lang['BAN_TRIGGERED_BY_' . strtoupper($ban_triggered_by)] . '</em>';
-- 
cgit v1.2.1


From ed1d4fe4a03c55bbc997f11afa11a87b4fe78c4d Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Thu, 1 May 2014 14:23:39 +0200
Subject: [ticket/12352] Revert to db auth provider if default does not exist

This will make sure that we will not encounter a non-existing auth provider.
We will revert to the default db auth provider if the one set in the config
does not exist in our auth provider collection.

PHPBB3-12352
---
 phpBB/phpbb/session.php | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index d286dc9cfc..c663977882 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -410,7 +410,14 @@ class session
 					// Check whether the session is still valid if we have one
 					$method = basename(trim($config['auth_method']));
 
-					$provider = $phpbb_container->get('auth.provider.' . $method);
+					$provider_collection = $phpbb_container->get('auth.provider_collection');
+
+					// Revert to db auth provider if selected method does not exist
+					if (!isset($provider_collection['auth.provider.' . $method]))
+					{
+						$method = 'db';
+					}
+					$provider = $provider_collection['auth.provider.' . $method];
 
 					if (!($provider instanceof \phpbb\auth\provider\provider_interface))
 					{
@@ -579,7 +586,14 @@ class session
 
 		$method = basename(trim($config['auth_method']));
 
-		$provider = $phpbb_container->get('auth.provider.' . $method);
+		$provider_collection = $phpbb_container->get('auth.provider_collection');
+
+		// Revert to db auth provider if selected method does not exist
+		if (!isset($provider_collection['auth.provider.' . $method]))
+		{
+			$method = 'db';
+		}
+		$provider = $provider_collection['auth.provider.' . $method];
 		$this->data = $provider->autologin();
 
 		if (sizeof($this->data))
-- 
cgit v1.2.1


From 6f5f0d6d8d5d3afcabccaa9da7c64108af5d4ab7 Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Sat, 31 May 2014 22:43:07 +0200
Subject: [ticket/12352] Use custom provider collection for auth providers

Using this custom provider collection, we can properly check whether the
configured auth provider does exist. The method get_provider() has been added
for returning the default auth provider or the standard db auth provider if
the specified one does not exist.
Additionally, the method get_provider() will throw an RuntimeException if
none of the above exist.

PHPBB3-12352
---
 phpBB/phpbb/session.php | 25 ++++---------------------
 1 file changed, 4 insertions(+), 21 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index c663977882..ad6759a3e2 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -408,16 +408,8 @@ class session
 					$session_expired = false;
 
 					// Check whether the session is still valid if we have one
-					$method = basename(trim($config['auth_method']));
-
 					$provider_collection = $phpbb_container->get('auth.provider_collection');
-
-					// Revert to db auth provider if selected method does not exist
-					if (!isset($provider_collection['auth.provider.' . $method]))
-					{
-						$method = 'db';
-					}
-					$provider = $provider_collection['auth.provider.' . $method];
+					$provider = $provider_collection->get_provider();
 
 					if (!($provider instanceof \phpbb\auth\provider\provider_interface))
 					{
@@ -584,16 +576,8 @@ class session
 			}
 		}
 
-		$method = basename(trim($config['auth_method']));
-
 		$provider_collection = $phpbb_container->get('auth.provider_collection');
-
-		// Revert to db auth provider if selected method does not exist
-		if (!isset($provider_collection['auth.provider.' . $method]))
-		{
-			$method = 'db';
-		}
-		$provider = $provider_collection['auth.provider.' . $method];
+		$provider = $provider_collection->get_provider();
 		$this->data = $provider->autologin();
 
 		if (sizeof($this->data))
@@ -912,9 +896,8 @@ class session
 		$db->sql_query($sql);
 
 		// Allow connecting logout with external auth method logout
-		$method = basename(trim($config['auth_method']));
-
-		$provider = $phpbb_container->get('auth.provider.' . $method);
+		$provider_collection = $phpbb_container->get('auth.provider_collection');
+		$provider = $provider_collection->get_provider();
 		$provider->logout($this->data, $new_session);
 
 		if ($this->data['user_id'] != ANONYMOUS)
-- 
cgit v1.2.1


From 19b9df7e630031e3bdf0640a91f7025da3a00257 Mon Sep 17 00:00:00 2001
From: n-aleha <nick_aleha@myway.com>
Date: Sat, 17 May 2014 03:43:34 +0300
Subject: [ticket/12557] Fix doc block errors found by Sami

PHPBB3-12557
---
 phpBB/phpbb/session.php | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 59b7ec2029..bfcd3368fa 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1062,11 +1062,13 @@ class session
 	* Check for banned user
 	*
 	* Checks whether the supplied user is banned by id, ip or email. If no parameters
-	* are passed to the method pre-existing session data is used. If $return is false
-	* this routine does not return on finding a banned user, it outputs a relevant
-	* message and stops execution.
+	* are passed to the method pre-existing session data is used.
 	*
-	* @param string|array	$user_ips	Can contain a string with one IP or an array of multiple IPs
+	* @param int|false				$user_id		The user id
+	* @param string|array|false		$user_ips		Can contain a string with one IP or an array of multiple IPs
+	* @param string|false			$user_email		The user email
+	* @param bool					$return			If $return is false this routine does not return on finding a banned user,
+	*	it outputs a relevant message and stops execution.
 	*/
 	function check_ban($user_id = false, $user_ips = false, $user_email = false, $return = false)
 	{
@@ -1254,12 +1256,14 @@ class session
 
 	/**
 	* Check if ip is blacklisted
-	* This should be called only where absolutly necessary
+	* This should be called only where absolutely necessary
 	*
 	* Only IPv4 (rbldns does not support AAAA records/IPv6 lookups)
 	*
 	* @author satmd (from the php manual)
-	* @param string $mode register/post - spamcop for example is ommitted for posting
+	* @param string 		$mode	register/post - spamcop for example is ommitted for posting
+	* @param string|false	$ip		the IPv4 address to check
+	*
 	* @return false if ip is not blacklisted, else an array([checked server], [lookup])
 	*/
 	function check_dnsbl($mode, $ip = false)
-- 
cgit v1.2.1


From 95ec9590dfd2e93a75383745f385aaa3493ed857 Mon Sep 17 00:00:00 2001
From: n-aleha <nick_aleha@myway.com>
Date: Sat, 24 May 2014 16:55:52 +0300
Subject: [ticket/12557] Fix doc block errors found by Sami

PHPBB3-12557
---
 phpBB/phpbb/session.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index bfcd3368fa..5a0d7c0031 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1064,10 +1064,10 @@ class session
 	* Checks whether the supplied user is banned by id, ip or email. If no parameters
 	* are passed to the method pre-existing session data is used.
 	*
-	* @param int|false				$user_id		The user id
-	* @param string|array|false		$user_ips		Can contain a string with one IP or an array of multiple IPs
-	* @param string|false			$user_email		The user email
-	* @param bool					$return			If $return is false this routine does not return on finding a banned user,
+	* @param int|false		$user_id		The user id
+	* @param mixed			$user_ips		Can contain a string with one IP or an array of multiple IPs
+	* @param string|false	$user_email		The user email
+	* @param bool			$return			If $return is false this routine does not return on finding a banned user,
 	*	it outputs a relevant message and stops execution.
 	*/
 	function check_ban($user_id = false, $user_ips = false, $user_email = false, $return = false)
-- 
cgit v1.2.1


From 160ff7b912243dc14d871b820213ddcd20dd06f4 Mon Sep 17 00:00:00 2001
From: Tristan Darricau <github@nicofuma.fr>
Date: Fri, 8 Aug 2014 18:02:03 +0200
Subject: [ticket/11854] Move captcha stuff to phpbb/ and use DI for plugins

PHPBB3-11854
---
 phpBB/phpbb/session.php | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 5a0d7c0031..a9dde5bbaa 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -962,7 +962,7 @@ class session
 	*/
 	function session_gc()
 	{
-		global $db, $config, $phpbb_root_path, $phpEx;
+		global $db, $config, $phpbb_root_path, $phpEx, $phpbb_container;
 
 		$batch_size = 10;
 
@@ -1022,11 +1022,7 @@ class session
 			}
 
 			// only called from CRON; should be a safe workaround until the infrastructure gets going
-			if (!class_exists('phpbb_captcha_factory', false))
-			{
-				include($phpbb_root_path . "includes/captcha/captcha_factory." . $phpEx);
-			}
-			$captcha_factory = new \phpbb_captcha_factory();
+			$captcha_factory = $phpbb_container->get('captchas.factory');
 			$captcha_factory->garbage_collect($config['captcha_plugin']);
 
 			$sql = 'DELETE FROM ' . LOGIN_ATTEMPT_TABLE . '
-- 
cgit v1.2.1


From b91abf1a0bd751da640219596a94019f70086c0b Mon Sep 17 00:00:00 2001
From: Tristan Darricau <github@nicofuma.fr>
Date: Sat, 9 Aug 2014 15:57:01 +0200
Subject: [ticket/11854] Rename captchas.factory service to captcha.factory

PHPBB3-11854
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index a9dde5bbaa..7d564742af 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1022,7 +1022,7 @@ class session
 			}
 
 			// only called from CRON; should be a safe workaround until the infrastructure gets going
-			$captcha_factory = $phpbb_container->get('captchas.factory');
+			$captcha_factory = $phpbb_container->get('captcha.factory');
 			$captcha_factory->garbage_collect($config['captcha_plugin']);
 
 			$sql = 'DELETE FROM ' . LOGIN_ATTEMPT_TABLE . '
-- 
cgit v1.2.1


From b218f3ad43cbcd713087516c431944d0378c064c Mon Sep 17 00:00:00 2001
From: Jakub Senko <jakubsenko@gmail.com>
Date: Sun, 7 Sep 2014 10:15:51 +0200
Subject: [ticket/13048] Only update session_page if request is not ajax

PHPBB3-13048
---
 phpBB/phpbb/session.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 7d564742af..30b364821d 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -441,8 +441,8 @@ class session
 
 					if (!$session_expired)
 					{
-						// Only update session DB a minute or so after last update or if page changes
-						if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
+						// Only update session DB a minute or so after last update or if page changes and is not ajax request
+						if (($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page'])) && !$request->is_ajax())
 						{
 							$sql_ary = array('session_time' => $this->time_now);
 
-- 
cgit v1.2.1


From 820db008ffc24fcad1c36e9c736847f5d5a0254d Mon Sep 17 00:00:00 2001
From: Joas Schilling <nickvergessen@gmx.de>
Date: Tue, 23 Sep 2014 15:25:40 +0200
Subject: [ticket/13048] Only do not update the session page for ajax requests

The session time still needs to be updated, so e.g. long upload times
with PLupload stop the session from timing out.

PHPBB3-13048
---
 phpBB/phpbb/session.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 30b364821d..da8b848fa5 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -441,12 +441,13 @@ class session
 
 					if (!$session_expired)
 					{
-						// Only update session DB a minute or so after last update or if page changes and is not ajax request
-						if (($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page'])) && !$request->is_ajax())
+						// Only update session DB a minute or so after last update or if page changes
+						if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
 						{
 							$sql_ary = array('session_time' => $this->time_now);
 
-							if ($this->update_session_page)
+							// Do not update the session page for ajax requests, so the view online still works as intended
+							if ($this->update_session_page && !$request->is_ajax())
 							{
 								$sql_ary['session_page'] = substr($this->page['page'], 0, 199);
 								$sql_ary['session_forum_id'] = $this->page['forum'];
-- 
cgit v1.2.1


From 3472b6c5bc44b3ca13b6bb3fadc7aef7d7b41f1e Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Mon, 27 Oct 2014 19:57:53 -0700
Subject: [ticket/13234-2] Never allow autologin/remember me to modify the
 userid

Ascraeus version of 64d97d0787a63b3c646f89237574ac566ed89c50 commit

PHPBB3-13234
---
 phpBB/phpbb/session.php | 67 ++++++++++++++++++++++++++++---------------------
 1 file changed, 38 insertions(+), 29 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index cf8ea1877e..c787247b44 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -577,6 +577,43 @@ class session
 			}
 		}
 
+		$provider_collection = $phpbb_container->get('auth.provider_collection');
+		$provider = $provider_collection->get_provider();
+		$this->data = $provider->autologin();
+
+		if ($user_id !== false && sizeof($this->data) && $this->data['user_id'] != $user_id)
+		{
+			$this->data = array();
+		}
+
+		if (sizeof($this->data))
+		{
+			$this->cookie_data['k'] = '';
+			$this->cookie_data['u'] = $this->data['user_id'];
+		}
+
+		// If we're presented with an autologin key we'll join against it.
+		// Else if we've been passed a user_id we'll grab data based on that
+		if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data))
+		{
+			$sql = 'SELECT u.*
+				FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k
+				WHERE u.user_id = ' . (int) $this->cookie_data['u'] . '
+					AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ")
+					AND k.user_id = u.user_id
+					AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'";
+			$result = $db->sql_query($sql);
+			$user_data = $db->sql_fetchrow($result);
+
+			if ($user_id === false || $user_id == $user_data['user_id'])
+			{
+				$this->data = $user_data;
+				$bot = false;
+			}
+
+			$db->sql_freeresult($result);
+		}
+
 		if ($user_id !== false && !sizeof($this->data))
 		{
 			$this->cookie_data['k'] = '';
@@ -591,34 +628,6 @@ class session
 			$db->sql_freeresult($result);
 			$bot = false;
 		}
-		else if (!$bot)
-		{
-			$provider_collection = $phpbb_container->get('auth.provider_collection');
-			$provider = $provider_collection->get_provider();
-			$this->data = $provider->autologin();
-
-			if (sizeof($this->data))
-			{
-				$this->cookie_data['k'] = '';
-				$this->cookie_data['u'] = $this->data['user_id'];
-			}
-
-			// If we're presented with an autologin key we'll join against it.
-			// Else if we've been passed a user_id we'll grab data based on that
-			if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data))
-			{
-				$sql = 'SELECT u.*
-					FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k
-					WHERE u.user_id = ' . (int) $this->cookie_data['u'] . '
-						AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ")
-						AND k.user_id = u.user_id
-						AND k.key_id = '" . $db->sql_escape(md5($this->cookie_data['k'])) . "'";
-				$result = $db->sql_query($sql);
-				$this->data = $db->sql_fetchrow($result);
-				$db->sql_freeresult($result);
-				$bot = false;
-			}
-		}
 
 		// Bot user, if they have a SID in the Request URI we need to get rid of it
 		// otherwise they'll index this page with the SID, duplicate content oh my!
@@ -926,7 +935,7 @@ class session
 			}
 
 			// Reset the data array
-			$this->data = array();
+			$this->data = false;
 
 			$sql = 'SELECT *
 				FROM ' . USERS_TABLE . '
-- 
cgit v1.2.1


From 087a5363bba7228f29d6075deb2a099cf9d25630 Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Mon, 27 Oct 2014 23:56:20 -0700
Subject: [ticket/13234-2] Correctly verify that user_id is set in user data
 array

PHPBB3-13234-2
---
 phpBB/phpbb/session.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index c787247b44..477e91efd6 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -605,7 +605,7 @@ class session
 			$result = $db->sql_query($sql);
 			$user_data = $db->sql_fetchrow($result);
 
-			if ($user_id === false || $user_id == $user_data['user_id'])
+			if ($user_id === false || (isset($user_data['user_id']) && $user_id == $user_data['user_id']))
 			{
 				$this->data = $user_data;
 				$bot = false;
@@ -935,7 +935,7 @@ class session
 			}
 
 			// Reset the data array
-			$this->data = false;
+			$this->data = array();
 
 			$sql = 'SELECT *
 				FROM ' . USERS_TABLE . '
-- 
cgit v1.2.1


From f534503a66fc81e7bbe589b883167d2343871134 Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Sat, 1 Nov 2014 22:02:47 +0100
Subject: [ticket/security-164] Correctly format page_name

SECURITY-164
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 477e91efd6..14b4c63207 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -87,7 +87,7 @@ class session
 		$symfony_request_path = $phpbb_filesystem->clean_path($symfony_request->getPathInfo());
 		if ($symfony_request_path !== '/')
 		{
-			$page_name .= $symfony_request_path;
+			$page_name .= str_replace('%2F', '/', urlencode($symfony_request_path));
 		}
 
 		// current directory within the phpBB root (for example: adm)
-- 
cgit v1.2.1


From 6cc7da0c9c0fc8515aad780fba5de5b3860e5d56 Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Mon, 3 Nov 2014 16:07:32 +0100
Subject: [ticket/13280] Properly format the current page and add sanitizer to
 tests

PHPBB3-13280
---
 phpBB/phpbb/session.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 14b4c63207..a06ff9c594 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -43,7 +43,7 @@ class session
 
 		// First of all, get the request uri...
 		$script_name = $symfony_request->getScriptName();
-		$args = explode('&', $symfony_request->getQueryString());
+		$args = explode('&amp;', $symfony_request->getQueryString());
 
 		// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
 		if (!$script_name)
@@ -61,8 +61,8 @@ class session
 
 		// Since some browser do not encode correctly we need to do this with some "special" characters...
 		// " -> %22, ' => %27, < -> %3C, > -> %3E
-		$find = array('"', "'", '<', '>');
-		$replace = array('%22', '%27', '%3C', '%3E');
+		$find = array('"', "'", '<', '>', '&quot;', '&lt;', '&gt;');
+		$replace = array('%22', '%27', '%3C', '%3E', '%22', '%3C', '%3E');
 
 		foreach ($args as $key => $argument)
 		{
-- 
cgit v1.2.1


From 6d533d2f8630d5bed2bfdbfd09cc9c689fbad1b5 Mon Sep 17 00:00:00 2001
From: Tristan Darricau <github@nicofuma.fr>
Date: Wed, 12 Nov 2014 10:30:27 +0100
Subject: [ticket/13280] Revert "Merge pull request #3107 from
 marc1706/ticket/13280"

This reverts commit a1b58d05d158ff7afd789c1b27821e17198f8d58, reversing
changes made to 0e772afb9db640e54e84cfccaddcf74f3edbb3fb.

PHPBB3-13280
---
 phpBB/phpbb/session.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index a06ff9c594..14b4c63207 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -43,7 +43,7 @@ class session
 
 		// First of all, get the request uri...
 		$script_name = $symfony_request->getScriptName();
-		$args = explode('&amp;', $symfony_request->getQueryString());
+		$args = explode('&', $symfony_request->getQueryString());
 
 		// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
 		if (!$script_name)
@@ -61,8 +61,8 @@ class session
 
 		// Since some browser do not encode correctly we need to do this with some "special" characters...
 		// " -> %22, ' => %27, < -> %3C, > -> %3E
-		$find = array('"', "'", '<', '>', '&quot;', '&lt;', '&gt;');
-		$replace = array('%22', '%27', '%3C', '%3E', '%22', '%3C', '%3E');
+		$find = array('"', "'", '<', '>');
+		$replace = array('%22', '%27', '%3C', '%3E');
 
 		foreach ($args as $key => $argument)
 		{
-- 
cgit v1.2.1


From 0dfe1d0d8b007ec7b7cae0715cfb2e5f4e33bad4 Mon Sep 17 00:00:00 2001
From: Tristan Darricau <github@nicofuma.fr>
Date: Wed, 12 Nov 2014 11:44:56 +0100
Subject: [ticket/13280] Output escaping for the symfony request object

PHPBB3-13280
---
 phpBB/phpbb/session.php | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 14b4c63207..dc90d942c3 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -31,10 +31,11 @@ class session
 	var $update_session_page = true;
 
 	/**
-	* Extract current session page
-	*
-	* @param string $root_path current root path (phpbb_root_path)
-	*/
+	 * Extract current session page
+	 *
+	 * @param string $root_path current root path (phpbb_root_path)
+	 * @return array
+	 */
 	static function extract_current_page($root_path)
 	{
 		global $request, $symfony_request, $phpbb_filesystem;
@@ -42,8 +43,8 @@ class session
 		$page_array = array();
 
 		// First of all, get the request uri...
-		$script_name = $symfony_request->getScriptName();
-		$args = explode('&', $symfony_request->getQueryString());
+		$script_name = $request->escape($symfony_request->getScriptName(), true);
+		$args = $request->escape(explode('&', $symfony_request->getQueryString()), true);
 
 		// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
 		if (!$script_name)
@@ -61,8 +62,8 @@ class session
 
 		// Since some browser do not encode correctly we need to do this with some "special" characters...
 		// " -> %22, ' => %27, < -> %3C, > -> %3E
-		$find = array('"', "'", '<', '>');
-		$replace = array('%22', '%27', '%3C', '%3E');
+		$find = array('"', "'", '<', '>', '&quot;', '&lt;', '&gt;');
+		$replace = array('%22', '%27', '%3C', '%3E', '%22', '%3C', '%3E');
 
 		foreach ($args as $key => $argument)
 		{
-- 
cgit v1.2.1


From 30f292f5a2b3db5a1feb86790da1a3685b2f5fb3 Mon Sep 17 00:00:00 2001
From: Jakub Senko <jakubsenko@gmail.com>
Date: Sun, 26 Oct 2014 21:17:37 +0100
Subject: [ticket/11613] Allow cookies to work on netbios domains

PHPBB3-11613
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index cf8ea1877e..098c69c636 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1053,7 +1053,7 @@ class session
 
 		$name_data = rawurlencode($config['cookie_name'] . '_' . $name) . '=' . rawurlencode($cookiedata);
 		$expire = gmdate('D, d-M-Y H:i:s \\G\\M\\T', $cookietime);
-		$domain = (!$config['cookie_domain'] || $config['cookie_domain'] == 'localhost' || $config['cookie_domain'] == '127.0.0.1') ? '' : '; domain=' . $config['cookie_domain'];
+		$domain = (!$config['cookie_domain'] || $config['cookie_domain'] == '127.0.0.1' || strpos($config['cookie_domain'], '.') === false) ? '' : '; domain=' . $config['cookie_domain'];
 
 		header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . $config['cookie_path'] . $domain . ((!$config['cookie_secure']) ? '' : '; secure') . ';' . (($httponly) ? ' HttpOnly' : ''), false);
 	}
-- 
cgit v1.2.1


From 566510769b37f093542bfe18834ce2e4771eaf77 Mon Sep 17 00:00:00 2001
From: MasterShredder <immortalshredder@gmail.com>
Date: Sun, 7 Dec 2014 05:57:07 +0400
Subject: [ticket/13422] Add new event core.session_check_user_session

PHPBB3-13422
---
 phpBB/phpbb/session.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 691d0d5bef..ef177ed072 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -215,7 +215,7 @@ class session
 	function session_begin($update_session_page = true)
 	{
 		global $phpEx, $SID, $_SID, $_EXTRA_URL, $db, $config, $phpbb_root_path;
-		global $request, $phpbb_container;
+		global $request, $phpbb_container, $phpbb_dispatcher;
 
 		// Give us some basic information
 		$this->time_now				= time();
@@ -372,6 +372,14 @@ class session
 			// Did the session exist in the DB?
 			if (isset($this->data['user_id']))
 			{
+				/**
+				* Event to check user session
+				*
+				* @event core.session_check_user_session
+				* @since 3.1.3-RC1
+				*/
+				$phpbb_dispatcher->dispatch('core.session_check_user_session');
+
 				// Validate IP length according to admin ... enforces an IP
 				// check on bots if admin requires this
 //				$quadcheck = ($config['ip_check_bot'] && $this->data['user_type'] & USER_BOT) ? 4 : $config['ip_check'];
-- 
cgit v1.2.1


From 1896825f39225368e1843a28479818f2bf195da2 Mon Sep 17 00:00:00 2001
From: MasterShredder <immortalshredder@gmail.com>
Date: Sun, 7 Dec 2014 05:59:20 +0400
Subject: [ticket/13422] Add new event core.session_set_custom_ban

PHPBB3-13422
---
 phpBB/phpbb/session.php | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index ef177ed072..35df71b92e 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1090,7 +1090,7 @@ class session
 	*/
 	function check_ban($user_id = false, $user_ips = false, $user_email = false, $return = false)
 	{
-		global $config, $db;
+		global $config, $db, $phpbb_dispatcher;
 
 		if (defined('IN_CHECK_BAN') || defined('SKIP_CHECK_BAN'))
 		{
@@ -1204,6 +1204,20 @@ class session
 		}
 		$db->sql_freeresult($result);
 
+		/**
+		* Event to set custom ban type
+		*
+		* @event core.session_set_custom_ban
+		* @var bool	return			If $return is false this routine does not return on finding a banned user, it outputs a relevant message and stops execution
+		* @var bool	banned			Check if user already banned
+		* @var array	ban_row			Ban data
+		* @var string	ban_triggered_by	Custom ban type
+		* @since 3.1.3-RC1
+		*/
+		$ban_row = isset($ban_row) ? $ban_row : false;
+		$vars = array('return', 'banned', 'ban_row', 'ban_triggered_by');
+		extract($phpbb_dispatcher->trigger_event('core.session_set_custom_ban', compact($vars)));
+
 		if ($banned && !$return)
 		{
 			global $template, $phpbb_root_path, $phpEx;
-- 
cgit v1.2.1


From fda5d8d637661dba083dc168745058628d38e5fd Mon Sep 17 00:00:00 2001
From: MasterShredder <immortalshredder@gmail.com>
Date: Mon, 8 Dec 2014 08:50:05 +0400
Subject: [ticket/13422] Deleted event core.session_check_user_session

---
 phpBB/phpbb/session.php | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 35df71b92e..2a948fd885 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -215,7 +215,7 @@ class session
 	function session_begin($update_session_page = true)
 	{
 		global $phpEx, $SID, $_SID, $_EXTRA_URL, $db, $config, $phpbb_root_path;
-		global $request, $phpbb_container, $phpbb_dispatcher;
+		global $request, $phpbb_container;
 
 		// Give us some basic information
 		$this->time_now				= time();
@@ -372,14 +372,6 @@ class session
 			// Did the session exist in the DB?
 			if (isset($this->data['user_id']))
 			{
-				/**
-				* Event to check user session
-				*
-				* @event core.session_check_user_session
-				* @since 3.1.3-RC1
-				*/
-				$phpbb_dispatcher->dispatch('core.session_check_user_session');
-
 				// Validate IP length according to admin ... enforces an IP
 				// check on bots if admin requires this
 //				$quadcheck = ($config['ip_check_bot'] && $this->data['user_type'] & USER_BOT) ? 4 : $config['ip_check'];
-- 
cgit v1.2.1


From 3f88be65273a9eeba15f822b24a7940c1e58872f Mon Sep 17 00:00:00 2001
From: MasterShredder <immortalshredder@gmail.com>
Date: Sun, 28 Dec 2014 03:35:21 +0400
Subject: [ticket/13422] Changed variable descriptions

PHPBB3-13422
---
 phpBB/phpbb/session.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 2a948fd885..0a6a18ffbe 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1200,10 +1200,10 @@ class session
 		* Event to set custom ban type
 		*
 		* @event core.session_set_custom_ban
-		* @var bool	return			If $return is false this routine does not return on finding a banned user, it outputs a relevant message and stops execution
-		* @var bool	banned			Check if user already banned
-		* @var array	ban_row			Ban data
-		* @var string	ban_triggered_by	Custom ban type
+		* @var	bool		return				If $return is false this routine does not return on finding a banned user, it outputs a relevant message and stops execution
+		* @var	bool		banned				Check if user already banned
+		* @var	array|false	ban_row				Ban data
+		* @var	string		ban_triggered_by	Method that caused ban, can be your custom method
 		* @since 3.1.3-RC1
 		*/
 		$ban_row = isset($ban_row) ? $ban_row : false;
-- 
cgit v1.2.1


From c5a15c0635ecd164ec27ace93309440d7f1eb87d Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Wed, 25 Feb 2015 16:58:38 +0100
Subject: [ticket/13617] Use request->variable instead of request_var

PHPBB3-13617
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 0bbb869593..a51baf2f29 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -130,7 +130,7 @@ class session
 		$script_path .= (substr($script_path, -1, 1) == '/') ? '' : '/';
 		$root_script_path .= (substr($root_script_path, -1, 1) == '/') ? '' : '/';
 
-		$forum_id = request_var('f', 0);
+		$forum_id = $request->variable('f', 0);
 		$forum_id = ($forum_id > 0 && $forum_id < 16777215) ? $forum_id : 0;
 
 		$page_array += array(
-- 
cgit v1.2.1


From 106bc1c232dd7c68b66ed99745635a8efaae8f2f Mon Sep 17 00:00:00 2001
From: Nils Adermann <naderman@naderman.de>
Date: Wed, 25 Feb 2015 17:00:22 +0100
Subject: [ticket/13617] Document magic number for forum_id

PHPBB3-13617
---
 phpBB/phpbb/session.php | 1 +
 1 file changed, 1 insertion(+)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index a51baf2f29..bedd581725 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -131,6 +131,7 @@ class session
 		$root_script_path .= (substr($root_script_path, -1, 1) == '/') ? '' : '/';
 
 		$forum_id = $request->variable('f', 0);
+		// maximum forum id value is maximum value of mediumint unsigned column
 		$forum_id = ($forum_id > 0 && $forum_id < 16777215) ? $forum_id : 0;
 
 		$page_array += array(
-- 
cgit v1.2.1


From 4a1f617473c982af4c25fe23a42ea544d5e95c78 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Tue, 5 May 2015 01:50:10 +0300
Subject: [ticket/13817] Add core.update_session event

Add core.update_session event in \phpbb\session.php

PHPBB3-13817
---
 phpBB/phpbb/session.php | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index bedd581725..1a15e171c4 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1541,12 +1541,23 @@ class session
 	*/
 	public function update_session($session_data, $session_id = null)
 	{
-		global $db;
+		global $db, $phpbb_dispatcher;
 
 		$session_id = ($session_id) ? $session_id : $this->session_id;
 
 		$sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $session_data) . "
 			WHERE session_id = '" . $db->sql_escape($session_id) . "'";
 		$db->sql_query($sql);
+
+		/**
+		* Event to send session information to extension
+		*
+		* @event core.update_session
+		* @var	array		session_data				Associative array of session keys to be updated
+		* @var	array		session_id				current user's session_id
+		* @since 3.1.4
+		*/
+		$vars = array('session_data', 'session_id');
+		extract($phpbb_dispatcher->trigger_event('core.update_session', compact($vars)));
 	}
 }
-- 
cgit v1.2.1


From 798490bf1d4d4e204d3458e86a6f8a0a8cd150c2 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Fri, 29 May 2015 04:28:36 +0300
Subject: [ticket/13817] Change since

As requested by nickvergessen

PHPBB3-13817
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 1a15e171c4..f611b0900c 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1555,7 +1555,7 @@ class session
 		* @event core.update_session
 		* @var	array		session_data				Associative array of session keys to be updated
 		* @var	array		session_id				current user's session_id
-		* @since 3.1.4
+		* @since 3.1.5-RC1
 		*/
 		$vars = array('session_data', 'session_id');
 		extract($phpbb_dispatcher->trigger_event('core.update_session', compact($vars)));
-- 
cgit v1.2.1


From bbbf122d05ef77a2b03f2e092f6a0ebc2ca58ee1 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Sun, 31 May 2015 15:05:13 +0300
Subject: [ticket/13817] Add session_kill and session_gc

Ticket was changed to add few more session related events

core.session_kill - send user_id and session_id
core.session_gc - just triger event

PHPBB3-13817
---
 phpBB/phpbb/session.php | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index f611b0900c..dab75666ac 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -913,6 +913,19 @@ class session
 				AND session_user_id = " . (int) $this->data['user_id'];
 		$db->sql_query($sql);
 
+		/**
+		* Event to send session kill information to extension
+		*
+		* @event core.session_kill
+		* @var	int		user_id				user_id of the session user.
+		* @var	string		session_id				current user's session_id
+		* @since 3.1.5-RC1
+		*/
+		$user_id = (int) $this->data['user_id'];
+		$session_id = $this->session_id;
+		$vars = array('user_id', 'session_id');
+		extract($phpbb_dispatcher->trigger_event('core.session_kill', compact($vars)));
+
 		// Allow connecting logout with external auth method logout
 		$provider_collection = $phpbb_container->get('auth.provider_collection');
 		$provider = $provider_collection->get_provider();
@@ -1048,6 +1061,15 @@ class session
 			$db->sql_query($sql);
 		}
 
+		/**
+		* Event to trigger extension on session_gc
+		*
+		* @event core.session_gc
+		* @since 3.1.5-RC1
+		*/
+		$vars = array();
+		extract($phpbb_dispatcher->trigger_event('core.session_gc', compact($vars)));
+
 		return;
 	}
 
@@ -1550,11 +1572,11 @@ class session
 		$db->sql_query($sql);
 
 		/**
-		* Event to send session information to extension
+		* Event to send update session information to extension
 		*
 		* @event core.update_session
 		* @var	array		session_data				Associative array of session keys to be updated
-		* @var	array		session_id				current user's session_id
+		* @var	string		session_id				current user's session_id
 		* @since 3.1.5-RC1
 		*/
 		$vars = array('session_data', 'session_id');
-- 
cgit v1.2.1


From 76f7175fc485f75eda89e8f2cc01a7c5da2b52bf Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Sun, 31 May 2015 19:20:45 +0300
Subject: [ticket/13817] Fix missing phpbb_dispatcher

Fix missing phpbb_dispatcher and add event to session_create

PHPBB3-13817
---
 phpBB/phpbb/session.php | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index dab75666ac..93070dae09 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -519,7 +519,7 @@ class session
 	*/
 	function session_create($user_id = false, $set_admin = false, $persist_login = false, $viewonline = true)
 	{
-		global $SID, $_SID, $db, $config, $cache, $phpbb_root_path, $phpEx, $phpbb_container;
+		global $SID, $_SID, $db, $config, $cache, $phpbb_root_path, $phpEx, $phpbb_container, $phpbb_dispatcher;
 
 		$this->data = array();
 
@@ -851,6 +851,18 @@ class session
 		$_SID = $this->session_id;
 		$this->data = array_merge($this->data, $sql_ary);
 
+		/**
+		* Event to send new session data to extension
+		*
+		* @event core.session_create
+		* @var	array		session_data				Associative array of session keys to be updated
+		* @since 3.1.5-RC1
+		*/
+		$session_data = $this->data;
+		$vars = array('session_data');
+		extract($phpbb_dispatcher->trigger_event('core.session_create', compact($vars)));
+		unset($session_data);
+
 		if (!$bot)
 		{
 			$cookie_expire = $this->time_now + (($config['max_autologin_time']) ? 86400 * (int) $config['max_autologin_time'] : 31536000);
@@ -906,7 +918,7 @@ class session
 	*/
 	function session_kill($new_session = true)
 	{
-		global $SID, $_SID, $db, $config, $phpbb_root_path, $phpEx, $phpbb_container;
+		global $SID, $_SID, $db, $config, $phpbb_root_path, $phpEx, $phpbb_container, $phpbb_dispatcher;
 
 		$sql = 'DELETE FROM ' . SESSIONS_TABLE . "
 			WHERE session_id = '" . $db->sql_escape($this->session_id) . "'
@@ -925,6 +937,8 @@ class session
 		$session_id = $this->session_id;
 		$vars = array('user_id', 'session_id');
 		extract($phpbb_dispatcher->trigger_event('core.session_kill', compact($vars)));
+		unset($user_id);
+		unset($session_id);
 
 		// Allow connecting logout with external auth method logout
 		$provider_collection = $phpbb_container->get('auth.provider_collection');
@@ -993,7 +1007,7 @@ class session
 	*/
 	function session_gc()
 	{
-		global $db, $config, $phpbb_root_path, $phpEx, $phpbb_container;
+		global $db, $config, $phpbb_root_path, $phpEx, $phpbb_container, $phpbb_dispatcher;
 
 		$batch_size = 10;
 
-- 
cgit v1.2.1


From af7f62505e848098f702107c680bdfac73cdc134 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Sun, 31 May 2015 19:53:09 +0300
Subject: [ticket/13817] Fix empty vars array

PHPBB3-13817
---
 phpBB/phpbb/session.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 93070dae09..b8a28ae164 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1081,8 +1081,7 @@ class session
 		* @event core.session_gc
 		* @since 3.1.5-RC1
 		*/
-		$vars = array();
-		extract($phpbb_dispatcher->trigger_event('core.session_gc', compact($vars)));
+		extract($phpbb_dispatcher->trigger_event('core.session_gc'));
 
 		return;
 	}
-- 
cgit v1.2.1


From 57fa7435ada8e2437c9015f74cb5f156a8f8dbc4 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Sun, 31 May 2015 22:59:33 +0300
Subject: [ticket/13817] Fix empty event

Try adding event with no parameters

PHPBB3-13817
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index b8a28ae164..4d0ab44ae6 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1081,7 +1081,7 @@ class session
 		* @event core.session_gc
 		* @since 3.1.5-RC1
 		*/
-		extract($phpbb_dispatcher->trigger_event('core.session_gc'));
+		$phpbb_dispatcher->trigger_event('core.session_gc');
 
 		return;
 	}
-- 
cgit v1.2.1


From afa4c07a13c43d9e4c9fd6b4a56e6f53d3540b71 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Sun, 31 May 2015 23:11:32 +0300
Subject: [ticket/13817] Change trgger_event to dispatch

Fix no event parameters

PHPBB3-13817
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 4d0ab44ae6..de9bd808b4 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1081,7 +1081,7 @@ class session
 		* @event core.session_gc
 		* @since 3.1.5-RC1
 		*/
-		$phpbb_dispatcher->trigger_event('core.session_gc');
+		$phpbb_dispatcher->dispatch('core.session_gc');
 
 		return;
 	}
-- 
cgit v1.2.1


From 7d24510d68338e10f670cea1ea64131602d05e57 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Thu, 4 Jun 2015 19:57:45 +0300
Subject: [ticket/13817] Add _after

As requested events are named *_after

core.session_start_after is moved after
USERS_TABLE update to prevent returning
session data from extensions

PHPBB3-13817
---
 phpBB/phpbb/session.php | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index de9bd808b4..5bd56ca0ec 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -851,18 +851,6 @@ class session
 		$_SID = $this->session_id;
 		$this->data = array_merge($this->data, $sql_ary);
 
-		/**
-		* Event to send new session data to extension
-		*
-		* @event core.session_create
-		* @var	array		session_data				Associative array of session keys to be updated
-		* @since 3.1.5-RC1
-		*/
-		$session_data = $this->data;
-		$vars = array('session_data');
-		extract($phpbb_dispatcher->trigger_event('core.session_create', compact($vars)));
-		unset($session_data);
-
 		if (!$bot)
 		{
 			$cookie_expire = $this->time_now + (($config['max_autologin_time']) ? 86400 * (int) $config['max_autologin_time'] : 31536000);
@@ -905,6 +893,18 @@ class session
 			$_SID = '';
 		}
 
+		$session_data = $this->data;
+		/**
+		* Event to send new session data to extension
+		*
+		* @event core.session_create_after
+		* @var	array		session_data				Associative array of session keys to be updated
+		* @since 3.1.5-RC1
+		*/
+		$vars = array('session_data');
+		extract($phpbb_dispatcher->trigger_event('core.session_create_after', compact($vars)));
+		unset($session_data);
+
 		return true;
 	}
 
@@ -925,18 +925,18 @@ class session
 				AND session_user_id = " . (int) $this->data['user_id'];
 		$db->sql_query($sql);
 
+		$user_id = (int) $this->data['user_id'];
+		$session_id = $this->session_id;
 		/**
 		* Event to send session kill information to extension
 		*
-		* @event core.session_kill
+		* @event core.session_kill_after
 		* @var	int		user_id				user_id of the session user.
 		* @var	string		session_id				current user's session_id
 		* @since 3.1.5-RC1
 		*/
-		$user_id = (int) $this->data['user_id'];
-		$session_id = $this->session_id;
-		$vars = array('user_id', 'session_id');
-		extract($phpbb_dispatcher->trigger_event('core.session_kill', compact($vars)));
+		$vars = array('user_id', 'session_id', 'new_session');
+		extract($phpbb_dispatcher->trigger_event('core.session_kill_after', compact($vars)));
 		unset($user_id);
 		unset($session_id);
 
@@ -1078,10 +1078,10 @@ class session
 		/**
 		* Event to trigger extension on session_gc
 		*
-		* @event core.session_gc
+		* @event core.session_gc_after
 		* @since 3.1.5-RC1
 		*/
-		$phpbb_dispatcher->dispatch('core.session_gc');
+		$phpbb_dispatcher->dispatch('core.session_gc_after');
 
 		return;
 	}
-- 
cgit v1.2.1


From de947d31f61792209e7a6178ea1814033fb88d84 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Thu, 4 Jun 2015 23:07:58 +0300
Subject: [ticket/13817] Fix missing var names

Var names in doc block

PHPBB3-13817
---
 phpBB/phpbb/session.php | 1 +
 1 file changed, 1 insertion(+)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 5bd56ca0ec..81054663ea 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -933,6 +933,7 @@ class session
 		* @event core.session_kill_after
 		* @var	int		user_id				user_id of the session user.
 		* @var	string		session_id				current user's session_id
+		* @var	bool	new_session 	should we create new session for user
 		* @since 3.1.5-RC1
 		*/
 		$vars = array('user_id', 'session_id', 'new_session');
-- 
cgit v1.2.1


From c0449d31d6650936979e58ddb86f19e819903c46 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Mon, 8 Jun 2015 19:55:59 +0300
Subject: [ticket/13817] Add read-only notes to events

PHPBB3-13817
---
 phpBB/phpbb/session.php | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 81054663ea..f5318c7f7f 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -896,6 +896,7 @@ class session
 		$session_data = $this->data;
 		/**
 		* Event to send new session data to extension
+		* Read-only event
 		*
 		* @event core.session_create_after
 		* @var	array		session_data				Associative array of session keys to be updated
@@ -929,6 +930,7 @@ class session
 		$session_id = $this->session_id;
 		/**
 		* Event to send session kill information to extension
+		* Read-only event
 		*
 		* @event core.session_kill_after
 		* @var	int		user_id				user_id of the session user.
@@ -1587,6 +1589,7 @@ class session
 
 		/**
 		* Event to send update session information to extension
+		* Read-only event
 		*
 		* @event core.update_session
 		* @var	array		session_data				Associative array of session keys to be updated
-- 
cgit v1.2.1


From 82bc9baa24f4d2e482218699d12fb3ea90fb42bd Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Wed, 24 Jun 2015 04:34:34 +0300
Subject: [ticket/13817] fix after for session_update

Fix wrong variables passed to create session event

PHPBB3-13817
---
 phpBB/phpbb/session.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index f5318c7f7f..3dc4dfd429 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -893,7 +893,7 @@ class session
 			$_SID = '';
 		}
 
-		$session_data = $this->data;
+		$session_data = $sql_ary;
 		/**
 		* Event to send new session data to extension
 		* Read-only event
@@ -1591,12 +1591,12 @@ class session
 		* Event to send update session information to extension
 		* Read-only event
 		*
-		* @event core.update_session
+		* @event core.update_session_after
 		* @var	array		session_data				Associative array of session keys to be updated
 		* @var	string		session_id				current user's session_id
 		* @since 3.1.5-RC1
 		*/
 		$vars = array('session_data', 'session_id');
-		extract($phpbb_dispatcher->trigger_event('core.update_session', compact($vars)));
+		extract($phpbb_dispatcher->trigger_event('core.update_session_after', compact($vars)));
 	}
 }
-- 
cgit v1.2.1


From 0d7f8ba8afdbc7d46d585d37f35497a1098f9033 Mon Sep 17 00:00:00 2001
From: Stanislav Atanasov <lucifer@anavaro.com>
Date: Sun, 12 Jul 2015 19:28:45 +0300
Subject: [ticket/13817] Fix target version

PHPBB3-13817
---
 phpBB/phpbb/session.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 3dc4dfd429..a5c8f264e0 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -900,7 +900,7 @@ class session
 		*
 		* @event core.session_create_after
 		* @var	array		session_data				Associative array of session keys to be updated
-		* @since 3.1.5-RC1
+		* @since 3.1.6-RC1
 		*/
 		$vars = array('session_data');
 		extract($phpbb_dispatcher->trigger_event('core.session_create_after', compact($vars)));
@@ -936,7 +936,7 @@ class session
 		* @var	int		user_id				user_id of the session user.
 		* @var	string		session_id				current user's session_id
 		* @var	bool	new_session 	should we create new session for user
-		* @since 3.1.5-RC1
+		* @since 3.1.6-RC1
 		*/
 		$vars = array('user_id', 'session_id', 'new_session');
 		extract($phpbb_dispatcher->trigger_event('core.session_kill_after', compact($vars)));
@@ -1082,7 +1082,7 @@ class session
 		* Event to trigger extension on session_gc
 		*
 		* @event core.session_gc_after
-		* @since 3.1.5-RC1
+		* @since 3.1.6-RC1
 		*/
 		$phpbb_dispatcher->dispatch('core.session_gc_after');
 
@@ -1594,7 +1594,7 @@ class session
 		* @event core.update_session_after
 		* @var	array		session_data				Associative array of session keys to be updated
 		* @var	string		session_id				current user's session_id
-		* @since 3.1.5-RC1
+		* @since 3.1.6-RC1
 		*/
 		$vars = array('session_data', 'session_id');
 		extract($phpbb_dispatcher->trigger_event('core.update_session_after', compact($vars)));
-- 
cgit v1.2.1


From 88dd8a4849915b3b5962118885b574a37e596a00 Mon Sep 17 00:00:00 2001
From: Zoddo <zoddo.ino@gmail.com>
Date: Tue, 27 Oct 2015 16:45:14 +0100
Subject: [ticket/14261] Move the update of session informations to
 page_footer()

Currently, the unique way to disable the update of session_page is to pass
"false" to the parameter of session_begin(). This method is directly
called in app.php, so pages served from the routing system can't disable
the update of session informations.

By moving the update to page_footer, we can allow controllers to tell to
the session manager that we don't want to update the session infos.

PHPBB3-14261
---
 phpBB/phpbb/session.php | 89 ++++++++++++++++++++++++-------------------------
 1 file changed, 44 insertions(+), 45 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index a5c8f264e0..f9550b1a5e 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -446,39 +446,6 @@ class session
 
 					if (!$session_expired)
 					{
-						// Only update session DB a minute or so after last update or if page changes
-						if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
-						{
-							$sql_ary = array('session_time' => $this->time_now);
-
-							// Do not update the session page for ajax requests, so the view online still works as intended
-							if ($this->update_session_page && !$request->is_ajax())
-							{
-								$sql_ary['session_page'] = substr($this->page['page'], 0, 199);
-								$sql_ary['session_forum_id'] = $this->page['forum'];
-							}
-
-							$db->sql_return_on_error(true);
-
-							$this->update_session($sql_ary);
-
-							$db->sql_return_on_error(false);
-
-							// If the database is not yet updated, there will be an error due to the session_forum_id
-							// @todo REMOVE for 3.0.2
-							if ($result === false)
-							{
-								unset($sql_ary['session_forum_id']);
-
-								$this->update_session($sql_ary);
-							}
-
-							if ($this->data['user_id'] != ANONYMOUS && !empty($config['new_member_post_limit']) && $this->data['user_new'] && $config['new_member_post_limit'] <= $this->data['user_posts'])
-							{
-								$this->leave_newly_registered();
-							}
-						}
-
 						$this->data['is_registered'] = ($this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;
 						$this->data['is_bot'] = (!$this->data['is_registered'] && $this->data['user_id'] != ANONYMOUS) ? true : false;
 						$this->data['user_lang'] = basename($this->data['user_lang']);
@@ -734,18 +701,6 @@ class session
 				// Only update session DB a minute or so after last update or if page changes
 				if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
 				{
-					$this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now;
-
-					$sql_ary = array('session_time' => $this->time_now, 'session_last_visit' => $this->time_now, 'session_admin' => 0);
-
-					if ($this->update_session_page)
-					{
-						$sql_ary['session_page'] = substr($this->page['page'], 0, 199);
-						$sql_ary['session_forum_id'] = $this->page['forum'];
-					}
-
-					$this->update_session($sql_ary);
-
 					// Update the last visit time
 					$sql = 'UPDATE ' . USERS_TABLE . '
 						SET user_lastvisit = ' . (int) $this->data['session_time'] . '
@@ -1599,4 +1554,48 @@ class session
 		$vars = array('session_data', 'session_id');
 		extract($phpbb_dispatcher->trigger_event('core.update_session_after', compact($vars)));
 	}
+
+	public function update_session_infos()
+	{
+		global $db, $request;
+
+		// No need to update if it's a new session. Informations are already inserted by session_create()
+		if (isset($this->data['session_created']) && $this->data['session_created'])
+		{
+			return;
+		}
+
+		// Only update session DB a minute or so after last update or if page changes
+		if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
+		{
+			$sql_ary = array('session_time' => $this->time_now);
+
+			// Do not update the session page for ajax requests, so the view online still works as intended
+			if ($this->update_session_page && !$request->is_ajax())
+			{
+				$sql_ary['session_page'] = substr($this->page['page'], 0, 199);
+				$sql_ary['session_forum_id'] = $this->page['forum'];
+			}
+
+			$db->sql_return_on_error(true);
+
+			$this->update_session($sql_ary);
+
+			$db->sql_return_on_error(false);
+
+			// If the database is not yet updated, there will be an error due to the session_forum_id
+			// @todo REMOVE for 3.0.2
+			if ($result === false)
+			{
+				unset($sql_ary['session_forum_id']);
+
+				$this->update_session($sql_ary);
+			}
+
+			if ($this->data['user_id'] != ANONYMOUS && !empty($config['new_member_post_limit']) && $this->data['user_new'] && $config['new_member_post_limit'] <= $this->data['user_posts'])
+			{
+				$this->leave_newly_registered();
+			}
+		}
+	}
 }
-- 
cgit v1.2.1


From fbacd1df16dfe15bb4aa2d69d9c743e7a5e7b893 Mon Sep 17 00:00:00 2001
From: Zoddo <zoddo.ino@gmail.com>
Date: Wed, 28 Oct 2015 12:29:46 +0100
Subject: [ticket/14261] Fix tests by removing old code.

This will obselete GH-4007

PHPBB3-14261
PHPBB3-13202
---
 phpBB/phpbb/session.php | 9 ---------
 1 file changed, 9 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index f9550b1a5e..999d9e58ad 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1583,15 +1583,6 @@ class session
 
 			$db->sql_return_on_error(false);
 
-			// If the database is not yet updated, there will be an error due to the session_forum_id
-			// @todo REMOVE for 3.0.2
-			if ($result === false)
-			{
-				unset($sql_ary['session_forum_id']);
-
-				$this->update_session($sql_ary);
-			}
-
 			if ($this->data['user_id'] != ANONYMOUS && !empty($config['new_member_post_limit']) && $this->data['user_new'] && $config['new_member_post_limit'] <= $this->data['user_posts'])
 			{
 				$this->leave_newly_registered();
-- 
cgit v1.2.1


From fff6907a22867e004df8e397c8c4332398926821 Mon Sep 17 00:00:00 2001
From: Zoddo <zoddo.ino@gmail.com>
Date: Wed, 13 Jan 2016 08:28:30 +0100
Subject: [ticket/14407] Fix removing users from Newly Registered Users group

PHPBB3-14407
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 999d9e58ad..6cff75c62c 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1557,7 +1557,7 @@ class session
 
 	public function update_session_infos()
 	{
-		global $db, $request;
+		global $config, $db, $request;
 
 		// No need to update if it's a new session. Informations are already inserted by session_create()
 		if (isset($this->data['session_created']) && $this->data['session_created'])
-- 
cgit v1.2.1


From 1bd4895d7ac933257ccad48d01245025e663c197 Mon Sep 17 00:00:00 2001
From: Oliver Schramm <oliver.schramm97@gmail.com>
Date: Sat, 13 Feb 2016 14:57:04 +0100
Subject: [ticket/14409] Update session page info before displaying online list

PHPBB3-14409
---
 phpBB/phpbb/session.php | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 6cff75c62c..83e87b7704 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1583,6 +1583,8 @@ class session
 
 			$db->sql_return_on_error(false);
 
+			$this->data = array_merge($this->data, $sql_ary);
+
 			if ($this->data['user_id'] != ANONYMOUS && !empty($config['new_member_post_limit']) && $this->data['user_new'] && $config['new_member_post_limit'] <= $this->data['user_posts'])
 			{
 				$this->leave_newly_registered();
-- 
cgit v1.2.1


From 559325fbd674aedf681272d13fe81b34d39d3763 Mon Sep 17 00:00:00 2001
From: Oliver Schramm <oliver.schramm97@gmail.com>
Date: Tue, 17 May 2016 16:56:42 +0200
Subject: [ticket/12230] Remove users from new users group when post limit is 0

PHPBB3-12230
---
 phpBB/phpbb/session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 83e87b7704..33d8df9cb8 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -1585,7 +1585,7 @@ class session
 
 			$this->data = array_merge($this->data, $sql_ary);
 
-			if ($this->data['user_id'] != ANONYMOUS && !empty($config['new_member_post_limit']) && $this->data['user_new'] && $config['new_member_post_limit'] <= $this->data['user_posts'])
+			if ($this->data['user_id'] != ANONYMOUS && isset($config['new_member_post_limit']) && $this->data['user_new'] && $config['new_member_post_limit'] <= $this->data['user_posts'])
 			{
 				$this->leave_newly_registered();
 			}
-- 
cgit v1.2.1


From abb01946bd9195648c84c6e6b24854a0214a0caf Mon Sep 17 00:00:00 2001
From: Jakub Senko <jakubsenko@gmail.com>
Date: Fri, 2 Sep 2016 09:42:38 +0200
Subject: [ticket/14762] Add core event to session.php

PHPBB3-14762
---
 phpBB/phpbb/session.php | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index 33d8df9cb8..eb5543b50b 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -219,7 +219,7 @@ class session
 	function session_begin($update_session_page = true)
 	{
 		global $phpEx, $SID, $_SID, $_EXTRA_URL, $db, $config, $phpbb_root_path;
-		global $request, $phpbb_container;
+		global $request, $phpbb_container, $phpbb_dispatcher;
 
 		// Give us some basic information
 		$this->time_now				= time();
@@ -281,11 +281,21 @@ class session
 
 		// Why no forwarded_for et al? Well, too easily spoofed. With the results of my recent requests
 		// it's pretty clear that in the majority of cases you'll at least be left with a proxy/cache ip.
-		$this->ip = htmlspecialchars_decode($request->server('REMOTE_ADDR'));
-		$this->ip = preg_replace('# {2,}#', ' ', str_replace(',', ' ', $this->ip));
+		$ip = htmlspecialchars_decode($request->server('REMOTE_ADDR'));
+		$ip = preg_replace('# {2,}#', ' ', str_replace(',', ' ', $ip));
+
+		/**
+		* Event to alter user IP address
+		*
+		* @event core.session_ip_after
+		* @var	string	ip	REMOTE_ADDR
+		* @since 3.1.10-RC1
+		*/
+		$vars = array('ip');
+		extract($phpbb_dispatcher->trigger_event('core.session_ip_after', compact($vars)));
 
 		// split the list of IPs
-		$ips = explode(' ', trim($this->ip));
+		$ips = explode(' ', trim($ip));
 
 		// Default IP if REMOTE_ADDR is invalid
 		$this->ip = '127.0.0.1';
-- 
cgit v1.2.1


From cc556122f36ec8f5723aa4cd70b7848c9b897c41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Col=C3=B3n?= <david@davidiq.com>
Date: Thu, 2 Mar 2017 01:29:20 -0500
Subject: [ticket/14982] Always do a ban check except on contact me form

PHPBB3-14982
---
 phpBB/phpbb/session.php | 47 ++++++++++++++++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 17 deletions(-)

(limited to 'phpBB/phpbb/session.php')

diff --git a/phpBB/phpbb/session.php b/phpBB/phpbb/session.php
index eb5543b50b..45e82df591 100644
--- a/phpBB/phpbb/session.php
+++ b/phpBB/phpbb/session.php
@@ -460,6 +460,9 @@ class session
 						$this->data['is_bot'] = (!$this->data['is_registered'] && $this->data['user_id'] != ANONYMOUS) ? true : false;
 						$this->data['user_lang'] = basename($this->data['user_lang']);
 
+						// Is user banned? Are they excluded? Won't return on ban, exists within method
+						$this->check_ban_for_current_session($config);
+
 						return true;
 					}
 				}
@@ -666,19 +669,7 @@ class session
 		// session exists in which case session_id will also be set
 
 		// Is user banned? Are they excluded? Won't return on ban, exists within method
-		if ($this->data['user_type'] != USER_FOUNDER)
-		{
-			if (!$config['forwarded_for_check'])
-			{
-				$this->check_ban($this->data['user_id'], $this->ip);
-			}
-			else
-			{
-				$ips = explode(' ', $this->forwarded_for);
-				$ips[] = $this->ip;
-				$this->check_ban($this->data['user_id'], $ips);
-			}
-		}
+		$this->check_ban_for_current_session($config);
 
 		$this->data['is_registered'] = (!$bot && $this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == USER_NORMAL || $this->data['user_type'] == USER_FOUNDER)) ? true : false;
 		$this->data['is_bot'] = ($bot) ? true : false;
@@ -1268,9 +1259,6 @@ class session
 			$message .= ($ban_row['ban_give_reason']) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_give_reason']) : '';
 			$message .= '<br /><br /><em>' . $this->lang['BAN_TRIGGERED_BY_' . strtoupper($ban_triggered_by)] . '</em>';
 
-			// To circumvent session_begin returning a valid value and the check_ban() not called on second page view, we kill the session again
-			$this->session_kill(false);
-
 			// A very special case... we are within the cron script which is not supposed to print out the ban message... show blank page
 			if (defined('IN_CRON'))
 			{
@@ -1279,12 +1267,37 @@ class session
 				exit;
 			}
 
+			// To circumvent session_begin returning a valid value and the check_ban() not called on second page view, we kill the session again
+			$this->session_kill(false);
+
 			trigger_error($message);
 		}
 
 		return ($banned && $ban_row['ban_give_reason']) ? $ban_row['ban_give_reason'] : $banned;
 	}
 
+	/**
+	 * Check the current session for bans
+	 *
+	 * @return true if session user is banned.
+	 */
+	protected function check_ban_for_current_session($config)
+	{
+		if (!defined('SKIP_CHECK_BAN') && $this->data['user_type'] != USER_FOUNDER)
+		{
+			if (!$config['forwarded_for_check'])
+			{
+				$this->check_ban($this->data['user_id'], $this->ip);
+			}
+			else
+			{
+				$ips = explode(' ', $this->forwarded_for);
+				$ips[] = $this->ip;
+				$this->check_ban($this->data['user_id'], $ips);
+			}
+		}
+	}
+
 	/**
 	* Check if ip is blacklisted
 	* This should be called only where absolutely necessary
@@ -1576,7 +1589,7 @@ class session
 		}
 
 		// Only update session DB a minute or so after last update or if page changes
-		if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
+		if ($this->time_now - ((isset($this->data['session_time'])) ? $this->data['session_time'] : 0) > 60 || ($this->update_session_page && $this->data['session_page'] != $this->page['page']))
 		{
 			$sql_ary = array('session_time' => $this->time_now);
 
-- 
cgit v1.2.1