session.php

Go to the documentation of this file.

<?php
class Session {
    private $enabled;       
    private $id_area;       
    private $svprefix;      
    function __construct() {
        global $cfg;
        $this->id_area = $cfg->getAreaId();
        $this->svprefix = $cfg->getConfig("SVPREFIX");

        session_start();

        $this->enabled = (isset($_COOKIE[session_name()]));
        if (!$this->enabled) { return; }                        // unsupported cookies

        /* garbage collection: remove all expired sessions from table `sessions` */
        mysql_query("DELETE FROM sessions WHERE (id_area = " . $this->id_area . ") " .
                    "AND (date_lastused < " . (time() - $cfg->getConfig("SESSION_LIFETIME") * 60) . ")");

        /* all sessions in table `sessions` are now supposed to be active */
        /* check session consistency */
        $res = mysql_query("SELECT remote_ip FROM sessions " .
                           "WHERE (" . $this->id_area . ") ".
                           "AND (id = '" . session_id() . "')");
        if (mysql_num_rows($res) > 0) {
            $line = mysql_fetch_assoc($res);
            if ($line['remote_ip'] == $_SERVER['REMOTE_ADDR']) {        // TODO also check cookie? and how?
                mysql_query("UPDATE sessions SET date_lastused = " . time() .
                            " WHERE (id_area = " . $this->id_area . ") " .
                            "AND (id = '" . session_id() . "')");
            } else {    // not the original IP!
                if (session_regenerate_id()) {  // ok: create a new one!
                    $this->registerSession();
                } else {
                    return;
                }
            }
        } else {    // create a new session
            session_unset();
            $_SESSION = array();
            $this->registerSession();
        }
        mysql_free_result($res);
    }

    private function registerSession() {
        mysql_query("INSERT INTO sessions (id, id_area, remote_ip, date_lastused, id_user) " .
                    "VALUES ('" . session_id() . "', " . $this->id_area . ", '" . $_SERVER['REMOTE_ADDR'] . "', " . time() . ", 0)");
    }

    public function setUseridInSession($uid) {
        mysql_query("UPDATE sessions SET id_user = " . $uid .
                    " WHERE (id_area = " . $this->id_area . ") " .
                    "AND (id = '" . session_id() . "')");
    }

    public function setValue($varname, $value) {
        if ($this->enabled) {
            $_SESSION[$this->svprefix . $varname] = $value;
        }
    }

    function getValue($varname) {
        if ($this->enabled && isset($_SESSION[$this->svprefix . $varname])) {
            return $_SESSION[$this->svprefix . $varname];
        }
    }

    function destroy() {
        if ($this->enabled) {
            /* calling session_destroy() modifies session id, so do the following one before all */
            mysql_query("DELETE FROM sessions WHERE id = '" . session_id() . "'");  // no need to filter by area id: more secure

            $_SESSION = array();    // better than unset()

            if (isset($_COOKIE[session_name()])) {
                setcookie(session_name(), "", time() - 86400, "/");
            }

            session_destroy();
        }
    }
}
?>

---