1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
|
<?php
/**
* @file
* User session handling functions.
*/
function sess_open($save_path, $session_name) {
return TRUE;
}
function sess_close() {
return TRUE;
}
/**
* Reads an entire session from the database (internal use only).
*
* Also initializes the $user object for the user associated with the session.
* This function is registered with session_set_save_handler() to support
* database-backed sessions. It is called on every page load when PHP sets
* up the $_SESSION superglobal.
*
* This function is an internal function and must not be called directly.
* Doing so may result in logging out the current user, corrupting session data
* or other unexpected behavior. Session data must always be accessed via the
* $_SESSION superglobal.
*
* @param $key
* The session ID of the session to retrieve.
*
* @return
* The user's session, or an empty string if no session exists.
*/
function sess_read($key) {
global $user;
// Write and Close handlers are called after destructing objects since PHP 5.0.5
// Thus destructors can use sessions but session handler can't use objects.
// So we are moving session closure before destructing objects.
register_shutdown_function('session_write_close');
// Handle the case of first time visitors and clients that don't store cookies (eg. web crawlers).
if (empty($key) || !isset($_COOKIE[session_name()])) {
$user = drupal_anonymous_user();
return '';
}
// Otherwise, if the session is still active, we have a record of the client's session in the database.
$user = db_fetch_object(db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = '%s'", $key));
// We found the client's session record and they are an authenticated,
// active user.
if ($user && $user->uid > 0 && $user->status == 1) {
// This is done to unserialize the data member of $user
$user = drupal_unpack($user);
// Add roles element to $user
$user->roles = array();
$user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';
$result = db_query("SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = %d", $user->uid);
while ($role = db_fetch_object($result)) {
$user->roles[$role->rid] = $role->name;
}
}
// We didn't find the client's record (session has expired), or they are
// blocked, or they are an anonymous user.
else {
$session = isset($user->session) ? $user->session : '';
$user = drupal_anonymous_user($session);
}
return $user->session;
}
/**
* Writes an entire session to the database (internal use only).
*
* This function is registered with session_set_save_handler() to support
* database-backed sessions.
*
* This function is an internal function and must not be called directly.
* Doing so may result in corrupted session data or other unexpected behavior.
* Session data must always be accessed via the $_SESSION superglobal.
*
* @param $key
* The session ID of the session to write to.
* @param $value
* Session data to write as a serialized string.
*
* @return
* Always returns TRUE.
*/
function sess_write($key, $value) {
global $user;
// If saving of session data is disabled or if the client doesn't have a session,
// and one isn't being created ($value), do nothing. This keeps crawlers out of
// the session table. This reduces memory and server load, and gives more useful
// statistics. We can't eliminate anonymous session table rows without breaking
// the throttle module and the "Who's Online" block.
if (!session_save_session() || ($user->uid == 0 && empty($_COOKIE[session_name()]) && empty($value))) {
return TRUE;
}
db_query("UPDATE {sessions} SET uid = %d, cache = %d, hostname = '%s', session = '%s', timestamp = %d WHERE sid = '%s'", $user->uid, isset($user->cache) ? $user->cache : '', ip_address(), $value, time(), $key);
if (db_affected_rows()) {
// Last access time is updated no more frequently than once every 180 seconds.
// This reduces contention in the users table.
if ($user->uid && time() - $user->access > variable_get('session_write_interval', 180)) {
db_query("UPDATE {users} SET access = %d WHERE uid = %d", time(), $user->uid);
}
}
else {
// If this query fails, another parallel request probably got here first.
// In that case, any session data generated in this request is discarded.
@db_query("INSERT INTO {sessions} (sid, uid, cache, hostname, session, timestamp) VALUES ('%s', %d, %d, '%s', '%s', %d)", $key, $user->uid, isset($user->cache) ? $user->cache : '', ip_address(), $value, time());
}
return TRUE;
}
/**
* Called when an anonymous user becomes authenticated or vice-versa.
*/
function sess_regenerate() {
$old_session_id = session_id();
// We code around http://bugs.php.net/bug.php?id=32802 by destroying
// the session cookie by setting expiration in the past (a negative
// value). This issue only arises in PHP versions before 4.4.0,
// regardless of the Drupal configuration.
// TODO: remove this when we require at least PHP 4.4.0
if (isset($_COOKIE[session_name()])) {
setcookie(session_name(), '', time() - 42000, '/');
}
session_regenerate_id();
db_query("UPDATE {sessions} SET sid = '%s' WHERE sid = '%s'", session_id(), $old_session_id);
}
/**
* Counts how many users have sessions. Can count either anonymous sessions or authenticated sessions.
*
* @param int $timestamp
* A Unix timestamp representing a point of time in the past.
* The default is 0, which counts all existing sessions.
* @param boolean $anonymous
* TRUE counts only anonymous users.
* FALSE counts only authenticated users.
* @return int
* The number of users with sessions.
*/
function sess_count($timestamp = 0, $anonymous = true) {
$query = $anonymous ? ' AND uid = 0' : ' AND uid > 0';
return db_result(db_query('SELECT COUNT(sid) AS count FROM {sessions} WHERE timestamp >= %d'. $query, $timestamp));
}
/**
* Called by PHP session handling with the PHP session ID to end a user's session.
*
* @param string $sid
* the session id
*/
function sess_destroy_sid($sid) {
db_query("DELETE FROM {sessions} WHERE sid = '%s'", $sid);
}
/**
* End a specific user's session
*
* @param string $uid
* the user id
*/
function sess_destroy_uid($uid) {
db_query('DELETE FROM {sessions} WHERE uid = %d', $uid);
}
function sess_gc($lifetime) {
// Be sure to adjust 'php_value session.gc_maxlifetime' to a large enough
// value. For example, if you want user sessions to stay in your database
// for three weeks before deleting them, you need to set gc_maxlifetime
// to '1814400'. At that value, only after a user doesn't log in after
// three weeks (1814400 seconds) will his/her session be removed.
db_query("DELETE FROM {sessions} WHERE timestamp < %d", time() - $lifetime);
return TRUE;
}
/**
* Determine whether to save session data of the current request.
*
* This function allows the caller to temporarily disable writing of session data,
* should the request end while performing potentially dangerous operations, such as
* manipulating the global $user object. See http://drupal.org/node/218104 for usage
*
* @param $status
* Disables writing of session data when FALSE, (re-)enables writing when TRUE.
* @return
* FALSE if writing session data has been disabled. Otherwise, TRUE.
*/
function session_save_session($status = NULL) {
static $save_session = TRUE;
if (isset($status)) {
$save_session = $status;
}
return ($save_session);
}
|
