source: trunk/include/functions_session.inc.php @ 1007

Last change on this file since 1007 was 1007, checked in by nikrou, 19 years ago

bug fix 261: improve security of sessions (next to svn:1004):

  • improve presentation code style
  • add upgrade database file
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 3.6 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | PhpWebGallery - a PHP based picture gallery                           |
4// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
5// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net |
6// +-----------------------------------------------------------------------+
7// | branch        : BSF (Best So Far)
8// | file          : $RCSfile$
9// | last update   : $Date: 2006-01-18 15:16:30 +0000 (Wed, 18 Jan 2006) $
10// | last modifier : $Author: nikrou $
11// | revision      : $Revision: 1007 $
12// +-----------------------------------------------------------------------+
13// | This program is free software; you can redistribute it and/or modify  |
14// | it under the terms of the GNU General Public License as published by  |
15// | the Free Software Foundation                                          |
16// |                                                                       |
17// | This program is distributed in the hope that it will be useful, but   |
18// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
19// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
20// | General Public License for more details.                              |
21// |                                                                       |
22// | You should have received a copy of the GNU General Public License     |
23// | along with this program; if not, write to the Free Software           |
24// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
25// | USA.                                                                  |
26// +-----------------------------------------------------------------------+
27
28if (isset($conf['session_save_handler']) 
29  and ($conf['session_save_handler'] == 'db')) 
30{
31  session_set_save_handler('pwg_session_open', 
32    'pwg_session_close',
33    'pwg_session_read',
34    'pwg_session_write',
35    'pwg_session_destroy',
36    'pwg_session_gc'
37  );
38}
39if (isset($conf['session_use_cookies'])) 
40{ 
41  ini_set('session.use_cookies', $conf['session_use_cookies']);
42}
43if (isset($conf['session_use_only_cookies']))
44{
45  ini_set('session.use_only_cookies', $conf['session_use_only_cookies']);
46}
47if (isset($conf['session_use_trans_sid']))
48{
49  ini_set('session.use_trans_sid', intval($conf['session_use_trans_sid']));
50}
51if (isset($conf['session_name']))
52{
53  ini_set('session.name', $conf['session_name']);
54}
55
56function pwg_session_open($path, $name) 
57{
58  return true;
59}
60
61function pwg_session_close() 
62{
63  pwg_session_gc();
64  return true;
65}
66
67function pwg_session_read($session_id) 
68{
69  $query = '
70SELECT data FROM '.SESSIONS_TABLE.'
71  WHERE id = \''.$session_id.'\'';
72  $result = pwg_query($query);
73  if ($result) 
74  {
75    $row = mysql_fetch_assoc($result);
76    return $row['data'];
77  } 
78  else 
79  {
80    return '';
81  }
82}
83
84function pwg_session_write($session_id, $data) 
85{
86  $query = '
87SELECT id FROM '.SESSIONS_TABLE.'
88  WHERE id = \''.$session_id.'\'';
89  $result = pwg_query($query);
90  if (mysql_num_rows($result)) 
91  {
92    $query = '
93UPDATE '.SESSIONS_TABLE.' SET expiration = now()
94  WHERE id = \''.$session_id.'\'';   
95    pwg_query($query);
96  } 
97  else 
98  {
99    $query = '
100INSERT INTO '.SESSIONS_TABLE.'(id,data,expiration)
101  VALUES(\''.$session_id.'\',\''.$data.'\',now())';
102    pwg_query($query);   
103  }
104  return true;
105}
106
107function pwg_session_destroy($session_id) 
108{
109  $query = '
110DELETE FROM '.SESSIONS_TABLE.'
111  WHERE id = '.$session_id;
112  pwg_query($query);
113  return true;
114}
115
116function pwg_session_gc() 
117{
118  global $conf;
119
120  $query = '
121DELETE FROM '.SESSIONS_TABLE.'
122  WHERE UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(expiration) > '
123  .$conf['session_length'];
124  pwg_query($query);
125  return true;
126}
127?>
Note: See TracBrowser for help on using the repository browser.