xref: /PHP-7.4/ext/session/tests/save_handler.inc (revision 1ad08256)
1<?php
2
3DEFINE("SESSION_FILE_PREFIX" ,"session_test_");
4
5/*
6 * == General Return Value Rule ==
7 *
8 * Returning FALSE indicates FATAL error.
9 * Exceptions are: gc(), validate_sid()
10 *
11 * == Session Data Lock ==
12 *
13 * Session data lock is mandatory. Lock must be exclusive. i.e. Block read also.
14 *
15 * == Collision Detection ==
16 *
17 * Collision detection is mandatory to reject attacker initialized session ID.
18 * Coolision detection is absolute requirement for secure session.
19 */
20
21
22/* Open session data database */
23function open($save_path, $session_name) {
24    // string $save_path - Directory path, connection strings, etc. Default: session.save_path
25    // string $session_name - Session ID cookie name. Default: session.name
26
27    global $session_save_path, $name;
28    $session_save_path = $save_path;
29    $name = $session_name;
30    echo "Open [${session_save_path},${session_name}]\n";
31
32    // MUST return bool. Return TRUE for success.
33    return true;
34}
35
36/* Close session data database */
37function close() {
38    // void parameter
39    // NOTE: This function should unlock session data, if write() does not unlock it.
40
41    global $session_save_path, $name;
42    echo "Close [${session_save_path},${name}]\n";
43
44    // MUST return bool. Return TRUE for success.
45    return true;
46}
47
48/* Read session data */
49function read($id) {
50    // string $id - Session ID string
51    // NOTE: All production session save handler MUST implement "exclusive" lock.
52    //       e.g. Use "serializable transaction isolation level" with RDBMS.
53    //       read() would be the best place for locking for most save handlers.
54
55    global $session_save_path, $name, $session_id;
56    $session_id = $id;
57    echo "Read [${session_save_path},${id}]\n";
58    $session_file = "$session_save_path/".SESSION_FILE_PREFIX.$id;
59    // read MUST create file. Otherwise, strict mode will not work
60    touch($session_file);
61
62    // MUST return STRING for successful read().
63    // Return FALSE only when there is error. i.e. Do not return FALSE
64    // for non-existing session data for the $id.
65    return (string) @file_get_contents($session_file);
66}
67
68/* Write session data */
69function write($id, $session_data) {
70    // string $id - Session ID string
71    // string $session_data - Session data string serialized by session serializer.
72    // NOTE: This function may unlock session data locked by read(). If write() is
73    //       is not suitable place your handler to unlock. Unlock data at close().
74
75    global $session_save_path, $name, $session_id;
76    $session_id = $id;
77    echo "Write [${session_save_path},${id},${session_data}]\n";
78    $session_file = "$session_save_path/".SESSION_FILE_PREFIX.$id;
79    if ($fp = fopen($session_file, "w")) {
80        $return = fwrite($fp, $session_data);
81        fclose($fp);
82        return $return === FALSE ? FALSE : TRUE;
83    }
84
85    // MUST return bool. Return TRUE for success.
86    return false;
87}
88
89/* Remove specified session */
90function destroy($id) {
91    // string $id - Session ID string
92
93    global $session_save_path, $name;
94    echo "Destroy [${session_save_path},${id}]\n";
95    $session_file = "$session_save_path/".SESSION_FILE_PREFIX.$id;
96    unlink($session_file);
97
98    // MUST return bool. Return TRUE for success.
99    // Return FALSE only when there is error. i.e. Do not return FALSE
100    // for non-existing session data for the $id.
101    return true;
102}
103
104/* Perform garbage collection */
105function gc($maxlifetime) {
106    // long $maxlifetime - GC TTL in seconds. Default: session.gc_maxlifetime
107
108    global $session_save_path, $name;
109    $gc_cnt = 0;
110    $directory = opendir($session_save_path."/");
111    $length = strlen(SESSION_FILE_PREFIX);
112    while (($file = readdir($directory)) !== FALSE) {
113        $qualified = ($session_save_path."/".$file);
114        if (is_file($qualified) === TRUE) {
115            if (substr($file, 0, $length) === SESSION_FILE_PREFIX && (filemtime($qualified) + $maxlifetime <= time() )) {
116                unlink($qualified);
117                $gc_cnt++;
118            }
119        }
120    }
121    closedir($directory);
122
123    // SHOULD return long (number of deleted sessions).
124    // Returning TRUE works also, but it will not report correct number of deleted sessions.
125    // Return negative value for error. FALSE does not work because it's the same as 0.
126    return $gc_cnt;
127}
128
129/* Create new secure session ID */
130function create_sid() {
131    // void parameter
132    // NOTE: Defining create_sid() is mandatory because validate_sid() is mandatory for
133    //       security reasons for production save handler.
134    //       PHP 7.1 has session_create_id() for secure session ID generation. Older PHPs
135    //       must generate secure session ID by yourself.
136    //       e.g. hash('sha2', random_bytes(64)) or use /dev/urandom
137
138    $id = ('PHPT-'.time());
139    echo "CreateID [${id}]\n";
140
141    // MUST return session ID string.
142    // Return FALSE for error.
143    return $id;
144}
145
146/* Check session ID collision */
147function validate_sid($id) {
148    // string $id - Session ID string
149
150    global $session_save_path, $name;
151    echo "ValidateID [${session_save_path},${id}]\n";
152    $session_file = "$session_save_path/".SESSION_FILE_PREFIX.$id;
153    $ret = file_exists($session_file);
154
155    // MUST return bool. Return TRUE for collision.
156    // NOTE: This handler is mandatory for session security.
157    //       All save handlers MUST implement this handler.
158    //       Check session ID collision, return TRUE when it collides.
159    //       Otherwise, return FALSE.
160    return $ret;
161}
162
163/* Update session data access time stamp WITHOUT writing $session_data */
164function update($id, $session_data) {
165    // string $id - Session ID string
166    // string $session_data - Session data serialized by session serializer
167    // NOTE: This handler is optional. If your session database cannot
168    //       support time stamp updating, you must not define this.
169
170    global $session_save_path, $name;
171    echo "Update [${session_save_path},${id}]\n";
172    $session_file = "$session_save_path/".SESSION_FILE_PREFIX.$id;
173    $ret = touch($session_file);
174
175    // MUST return bool. Return TRUE for success.
176    return $ret;
177}
178
179
180function feature() {
181    /* NOT IMPLEMENTED YET */
182    /* TYPES: gc, create_sid, use_strict_mode, minimzie_lock, lazy_write
183    /* VALUES: 0=unknown, 1=supported, 2=partially supported, 3=unsupported */
184    return array('gc'=>0,
185                 'create_sid'=>1,
186                 'use_strict_mode'=>2,
187                 'minimize_lock'=>3,
188                 'lazy_write'=>4,
189                 'invalid'=>5,
190                 'another invalid'=>6
191                 );
192}
193
194?>
195