|
1 | 1 | <?php |
2 | 2 | $defflip = (!cfip()) ? exit(header('HTTP/1.1 401 Unauthorized')) : 1; |
3 | 3 |
|
4 | | -class strict_session { |
5 | | - private $memcache = null; |
6 | | - private $validate_client = false; |
7 | | - private $validate_client_ip = false; |
8 | | - private $validate_client_ua = false; |
9 | | - private $validate_client_sid = false; |
10 | | - private $validate_client_num = 0; |
11 | | - private $valid_server = ''; |
12 | | - private $memcache_key = ''; |
13 | | - public function valid_session_id($id) { |
14 | | - return preg_match('#^[a-zA-Z0-9]{26}$#', $id); |
15 | | - } |
16 | | - public function session_delete_key($key) { |
17 | | - $read = $this->memcache->delete($key); |
18 | | - } |
19 | | - private $validation_misses = 0; |
20 | | - private $initial_ua; |
21 | | - public function create_or_update_client($client, $force=false, $login=false) { |
22 | | - $read = $this->memcache->get($client['key']); |
23 | | - // this needs to be available later |
24 | | - $update = array('key' => '','sid' => '','ua' => '','ip' => '','la' => 0,'hn' => 0,'hnl' => 0,'ha' => 0,'hal' => 0); |
25 | | - $update['sid'] = $client['sid']; |
26 | | - $update['ua'] = md5($this->initial_ua); |
27 | | - $update['ip'] = $client['ip']; |
28 | | - $update['la'] = time(); |
29 | | - $update['key'] = md5($this->memcache_key.$client['ip']); |
30 | | - $validation_misses = 0; |
31 | | - if ($read !== false) { |
32 | | - $read_model = array('key' => '','sid' => '','ua' => '','ip' => '','la' => 0,'hn' => 0,'hnl' => 0,'ha' => 0,'hal' => 0); |
33 | | - $read_model['sid'] = @$read['sid']; |
34 | | - $read_model['ip'] = @$read['ip']; |
35 | | - $read_model['ua'] = @$read['ua']; |
36 | | - $read_model['la'] = @$read['la']; |
37 | | - $read_model['key'] = md5($this->memcache_key.$read['ip']); |
38 | | - // key already exists, update |
39 | | - if ($this->validate_client) { |
40 | | - if ($this->verify_client($read_model, $update, $login)) { |
41 | | - $update_client = $this->memcache->set($update['key'], $update); |
42 | | - } |
43 | | - } |
44 | | - } else { |
45 | | - $update_client = $this->memcache->set($client['key'], $client); |
46 | | - if ($force && $login) { |
47 | | - $update_client = $this->memcache->set($update['key'], $update); |
48 | | - } |
49 | | - } |
50 | | - } |
51 | | - public function verify_client($client_model, $data, $login=false) { |
52 | | - $fails = 0; |
53 | | - $fails += ((count($client_model)) !== (count($data)) && $this->validate_client) ? 1 : 0; |
54 | | - $fails += ($client_model['ua'] !== $data['ua'] && $this->validate_client && $this->validate_client_ua) ? 1 : 0; |
55 | | - $fails += ($client_model['ip'] !== $data['ip'] && $this->validate_client && $this->validate_client_ip) ? 1 : 0; |
56 | | - $now = time(); |
57 | | - $this->validation_misses = $fails; |
58 | | - if ($fails > $this->validate_client_num && $login == false && $this->validate_client) { |
59 | | - // something changed |
60 | | - $port = ($_SERVER["SERVER_PORT"] == "80" || $_SERVER["SERVER_PORT"] == "443") ? "" : (":".$_SERVER["SERVER_PORT"]); |
61 | | - $location = (@$_SERVER['HTTPS'] == "on") ? 'https://' : 'http://'; |
62 | | - $location .= $_SERVER['SERVER_NAME'] . $port . $_SERVER['SCRIPT_NAME']; |
63 | | - $this->session_delete_key($client_model['key']); |
64 | | - $this->session_delete_key($data['key']); |
65 | | - @session_start(); |
66 | | - @session_regenerate_id(true); |
67 | | - $_SESSION = null; |
68 | | - $_SESSION['POPUP'][] = array('CONTENT' => "Session revoked due to a change in your client. You may have a plugin messing with your useragent, or your IP address may have changed.", 'TYPE' => 'warning'); |
69 | | - $location.= '?page=login'; |
70 | | - if (!headers_sent()) exit(header('Location: ' . $location)); |
71 | | - exit('<meta http-equiv="refresh" content="0; url=' . htmlspecialchars($location) . '"/>'); |
72 | | - } |
73 | | - return ($fails > 0) ? false : true; |
74 | | - } |
75 | | - public function read_if_client_exists($client_key) { |
76 | | - if ($this->memcache !== null) { |
77 | | - $exists = $this->memcache->get($client_key); |
78 | | - } |
79 | | - return ($exists !== null) ? $exists : false; |
80 | | - } |
81 | | - public function regen_session_id() { |
82 | | - $sidbefore = @session_id(); |
83 | | - @session_regenerate_id(true); |
84 | | - $sid = session_id(); |
85 | | - return $sid; |
86 | | - } |
87 | | - public function __construct($config, &$memcache) { |
88 | | - $this->initial_ua = $_SERVER['HTTP_USER_AGENT']; |
89 | | - $this->memcache = $memcache; |
90 | | - $this->memcache_key = $config['memcache']['keyprefix']; |
91 | | - if ($config['strict__verify_client']) { |
92 | | - $this->validate_client = true; |
93 | | - $this->validate_client_ip = $config['strict__verify_client_ip']; |
94 | | - $this->validate_client_ua = $config['strict__verify_client_useragent']; |
95 | | - $this->validate_client_sid = $config['strict__verify_client_sessionid']; |
96 | | - $this->validate_client_num = 0; |
97 | | - if ($config['strict__verify_server']) { |
98 | | - $proto = (@$_SERVER['HTTPS'] == "on") ? 'https' : 'http'; |
99 | | - $location = $proto."://".$_SERVER['SERVER_NAME'] . $_SERVER['SERVER_PORT']; |
100 | | - if ($config['strict__verify_server']) { |
101 | | - if ($config['strict__bind_protocol']."://".$config['strict__bind_host'].$config['strict__bind_port'] !== $location) { |
102 | | - return false; |
103 | | - } |
104 | | - } |
105 | | - } |
106 | | - $client = array('key' => '','sid' => '','ua' => '','ip' => '','la' => 0,'hn' => 0,'hnl' => 0,'ha' => 0,'hal' => 0); |
107 | | - $client['ua'] = md5($_SERVER['HTTP_USER_AGENT']); |
108 | | - $client['ip'] = md5($_SERVER['REMOTE_ADDR']); |
109 | | - $client['la'] = time(); |
110 | | - $client['key'] = md5($this->memcache_key.$client['ip']); |
111 | | - $read = $this->read_if_client_exists($client['key']); |
112 | | - } |
113 | | - session_set_cookie_params((time()+$config['cookie']['duration']), $config['cookie']['path'], $config['cookie']['domain'], false, true); |
114 | | - $session_start = @session_start(); |
115 | | - $client['sid'] = session_id(); |
116 | | - $valid_session_id = $this->valid_session_id($client['sid']); |
117 | | - if (!$valid_session_id || !$session_start) { |
118 | | - @session_destroy(); |
119 | | - $client['sid'] = $this->regen_session_id(); |
120 | | - session_start(); |
121 | | - } |
122 | | - if ($read !== null) { |
123 | | - // client exists, verify |
124 | | - $this->create_or_update_client($client, true, false); |
125 | | - |
126 | | - } else { |
127 | | - // doesn't exist |
128 | | - $this->create_or_update_client($client, true, true); |
129 | | - } |
130 | | - @setcookie(session_name(), $client['sid'], (time()+$config['cookie']['duration']), $config['cookie']['path'], $config['cookie']['domain'], false, true); |
131 | | - // post changes validate |
132 | | - if ($this->validate_client) { |
133 | | - $read_post = $this->read_if_client_exists($client['key']); |
134 | | - if ($read_post !== null) { |
135 | | - $this->verify_client($client, $read_post, true); |
136 | | - } |
137 | | - } |
138 | | - } |
139 | | -} |
140 | | - |
141 | 4 | class mysqli_strict extends mysqli { |
142 | 5 | public function bind_param($paramTypes) { |
143 | 6 | if (!is_string($paramTypes)) { |
|
0 commit comments