diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc index dfb61e1..3773c07 100644 --- a/core/includes/bootstrap.inc +++ b/core/includes/bootstrap.inc @@ -2468,6 +2468,17 @@ function drupal_container(Container $new_container = NULL, $rebuild = FALSE) { // Register the KeyValueStore factory. $container ->register('keyvalue', 'Drupal\Core\KeyValueStore\KeyValueFactory'); + + // Register the session service. + $container->register('session.storage.backend', 'Drupal\Core\Session\Handler\DatabaseSessionHandler'); + $container->register('session.storage.proxy', 'Drupal\Core\Session\Proxy\CookieOverrideProxy') + ->addArgument(new Reference('session.storage.backend')); + $container->setParameter('session.storage.options', array()); + $container->register('session.storage', 'Drupal\Core\Session\Storage\DrupalSessionStorage') + ->addArgument('%session.storage.options%') + ->addArgument(new Reference('session.storage.proxy')); + $container->register('session', 'Drupal\Core\Session\Session') + ->addArgument(new Reference('session.storage')); } return $container; } diff --git a/core/includes/common.inc b/core/includes/common.inc index 9601c76..cbed8b9 100644 --- a/core/includes/common.inc +++ b/core/includes/common.inc @@ -2362,8 +2362,8 @@ function drupal_exit($destination = NULL) { if (!defined('MAINTENANCE_MODE') || MAINTENANCE_MODE != 'update') { module_invoke_all('exit', $destination); } - drupal_session_commit(); } + drupal_session_commit(); exit; } @@ -5001,8 +5001,8 @@ function drupal_cron_run() { @ignore_user_abort(TRUE); // Prevent session information from being saved while cron is running. - $original_session_saving = drupal_save_session(); - drupal_save_session(FALSE); + $session = drupal_container()->get('session'); + $session->disableSave(); // Force the current user to anonymous to ensure consistent permissions on // cron runs. @@ -5068,7 +5068,7 @@ function drupal_cron_run() { } // Restore the user. $GLOBALS['user'] = $original_user; - drupal_save_session($original_session_saving); + $session->enableSave(); return $return; } diff --git a/core/includes/install.core.inc b/core/includes/install.core.inc index 3968682..ef46ac5 100644 --- a/core/includes/install.core.inc +++ b/core/includes/install.core.inc @@ -1500,6 +1500,10 @@ function install_bootstrap_full(&$install_state) { $kernel = new DrupalKernel('prod', FALSE, NULL); $kernel->boot(); drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); + + // During install session needs to be manually pulled and initialized: this + // will force it to be fully initialized so batches will work flawlessly. + drupal_container()->get('session')->get('uid'); } /** diff --git a/core/includes/session.inc b/core/includes/session.inc index b9b8fbc..dc6b08a 100644 --- a/core/includes/session.inc +++ b/core/includes/session.inc @@ -4,530 +4,149 @@ * @file * User session handling functions. * - * The user-level session storage handlers: - * - _drupal_session_open() - * - _drupal_session_close() - * - _drupal_session_read() - * - _drupal_session_write() - * - _drupal_session_destroy() - * - _drupal_session_garbage_collection() - * are assigned by session_set_save_handler() in bootstrap.inc and are called - * automatically by PHP. These functions should not be called directly. Session - * data should instead be accessed via the $_SESSION superglobal. + * This file is the first Symfony session usage test. */ /** - * Session handler assigned by session_set_save_handler(). - * - * This function is used to handle any initialization, such as file paths or - * database connections, that is needed before accessing session data. Drupal - * does not need to initialize anything in this function. - * - * This function should not be called directly. - * - * @return - * This function will always return TRUE. - */ -function _drupal_session_open() { - return TRUE; -} - -/** - * Session handler assigned by session_set_save_handler(). - * - * This function is used to close the current session. Because Drupal stores - * session data in the database immediately on write, this function does - * not need to do anything. - * - * This function should not be called directly. - * - * @return - * This function will always return TRUE. - */ -function _drupal_session_close() { - return TRUE; -} - -/** - * Reads an entire session from the database (internal use only). - * - * Also initializes the $user object for the user associated with the session. - * This function is registered with session_set_save_handler() to support - * database-backed sessions. It is called on every page load when PHP sets - * up the $_SESSION superglobal. - * - * This function is an internal function and must not be called directly. - * Doing so may result in logging out the current user, corrupting session data - * or other unexpected behavior. Session data must always be accessed via the - * $_SESSION superglobal. - * - * @param $sid - * The session ID of the session to retrieve. + * Initializes the session handler, starting a session if needed. * - * @return - * The user's session, or an empty string if no session exists. + * @todo Move this into a lazy user loading once Drupal will got a fully + * featured component registry (aKa DIC). */ -function _drupal_session_read($sid) { - global $user, $is_https; - - // Write and Close handlers are called after destructing objects - // since PHP 5.0.5. - // Thus destructors can use sessions but session handler can't use objects. - // So we are moving session closure before destructing objects. - drupal_register_shutdown_function('session_write_close'); - - // Handle the case of first time visitors and clients that don't store - // cookies (eg. web crawlers). - $insecure_session_name = substr(session_name(), 1); - if (!isset($_COOKIE[session_name()]) && !isset($_COOKIE[$insecure_session_name])) { - $user = drupal_anonymous_user(); - return ''; - } - - // Otherwise, if the session is still active, we have a record of the - // client's session in the database. If it's HTTPS then we are either have - // a HTTPS session or we are about to log in so we check the sessions table - // for an anonymous session with the non-HTTPS-only cookie. - if ($is_https) { - $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.ssid = :ssid", array(':ssid' => $sid))->fetchObject(); - if (!$user) { - if (isset($_COOKIE[$insecure_session_name])) { - $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = :sid AND s.uid = 0", array( - ':sid' => $_COOKIE[$insecure_session_name])) - ->fetchObject(); - } - } - } - else { - $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = :sid", array(':sid' => $sid))->fetchObject(); - } - - // We found the client's session record and they are an authenticated, - // active user. - if ($user && $user->uid > 0 && $user->status == 1) { - // This is done to unserialize the data member of $user. - $user->data = unserialize($user->data); - - // Add roles element to $user. - $user->roles = array(); - $user->roles[DRUPAL_AUTHENTICATED_RID] = DRUPAL_AUTHENTICATED_RID; - $user->roles += db_query("SELECT ur.rid FROM {users_roles} ur WHERE ur.uid = :uid", array(':uid' => $user->uid))->fetchAllKeyed(0, 0); - } - elseif ($user) { - // The user is anonymous or blocked. Only preserve two fields from the - // {sessions} table. - $account = drupal_anonymous_user(); - $account->session = $user->session; - $account->timestamp = $user->timestamp; - $user = $account; - } - else { - // The session has expired. - $user = drupal_anonymous_user(); - $user->session = ''; +function drupal_session_initialize() { + // Symfony does not want to do it by itself, so we need to manually load + // the SessionHandlerInterface file if PHP core is prior to 5.4.0 + // This is handled by the autoloader in Symfony, I don't know if this would + // be a good idea for us to do the same. + if (version_compare(phpversion(), '5.4.0', '<')) { + require_once DRUPAL_ROOT . '/core/vendor/symfony/http-foundation/Symfony/Component/HttpFoundation/Resources/stubs/SessionHandlerInterface.php'; } - // Store the session that was read for comparison in _drupal_session_write(). - $last_read = &drupal_static('drupal_session_last_read'); - $last_read = array( - 'sid' => $sid, - 'value' => $user->session, - ); - - return $user->session; + // Force user global to exists. + // @todo Set a user provider component somewhere in DIC instead. + _drupal_session_load_user(); } /** - * Writes an entire session to the database (internal use only). + * Load user using the uid the session actually holds. * - * This function is registered with session_set_save_handler() to support - * database-backed sessions. + * FIXME: Ideally this would be exported into the user module or any other + * system and the user would be lazy loaded on first access attempt, thus + * allowing real session lazy load for pages that don't do any user access + * checks. * - * This function is an internal function and must not be called directly. - * Doing so may result in corrupted session data or other unexpected behavior. - * Session data must always be accessed via the $_SESSION superglobal. + * @todo: Replace this with a container lazy initialization function instead. * - * @param $sid - * The session ID of the session to write to. - * @param $value - * Session data to write as a serialized string. + * @return object + * User account * - * @return - * Always returns TRUE. + * @see drupal_session_initialize() + * @deprecated */ -function _drupal_session_write($sid, $value) { - global $user, $is_https; - - // The exception handler is not active at this point, so we need to do it - // manually. - try { - if (!drupal_save_session()) { - // We don't have anything to do if we are not allowed to save the session. - return; +function _drupal_session_load_user() { + global $user; + + $session = drupal_container()->get('session'); + + // The Session::has() call will be the first session attribute get in the + // page workflow, as long as this is early called during bootstrap, and + // will trigger the session start. + if ($session->has('uid') && ($uid = $session->get('uid'))) { + + $user = db_select('users', 'u') + ->fields('u') + ->condition('u.uid', $session->get('uid')) + ->execute() + ->fetch(); + + if ($user && $user->uid > 0 && $user->status == 1) { + // We found the client's session record and there is an authenticated + // active user. + $user->data = unserialize($user->data); + $user->roles = array(); + $user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user'; + $user->roles += db_query("SELECT r.rid, r.name FROM {role} r INNER JOIN {users_roles} ur ON ur.rid = r.rid WHERE ur.uid = :uid", array(':uid' => $user->uid))->fetchAllKeyed(0, 1); + return $user; } - - // Check whether $_SESSION has been changed in this request. - $last_read = &drupal_static('drupal_session_last_read'); - $is_changed = !isset($last_read) || $last_read['sid'] != $sid || $last_read['value'] !== $value; - - // For performance reasons, do not update the sessions table, unless - // $_SESSION has changed or more than 180 has passed since the last update. - if ($is_changed || !isset($user->timestamp) || REQUEST_TIME - $user->timestamp > variable_get('session_write_interval', 180)) { - // Either ssid or sid or both will be added from $key below. - $fields = array( - 'uid' => $user->uid, - 'hostname' => ip_address(), - 'session' => $value, - 'timestamp' => REQUEST_TIME, - ); - - // Use the session ID as 'sid' and an empty string as 'ssid' by default. - // _drupal_session_read() does not allow empty strings so that's a safe - // default. - $key = array('sid' => $sid, 'ssid' => ''); - // On HTTPS connections, use the session ID as both 'sid' and 'ssid'. - if ($is_https) { - $key['ssid'] = $sid; - // The "secure pages" setting allows a site to simultaneously use both - // secure and insecure session cookies. If enabled and both cookies are - // presented then use both keys. - if (variable_get('https', FALSE)) { - $insecure_session_name = substr(session_name(), 1); - if (isset($_COOKIE[$insecure_session_name])) { - $key['sid'] = $_COOKIE[$insecure_session_name]; - } - } - } - elseif (variable_get('https', FALSE)) { - unset($key['ssid']); - } - - db_merge('sessions') - ->key($key) - ->fields($fields) - ->execute(); + elseif ($user) { + // The user is anonymous or blocked. + $user = drupal_anonymous_user(); } - - // Likewise, do not update access time more than once per 180 seconds. - if ($user->uid && REQUEST_TIME - $user->access > variable_get('session_write_interval', 180)) { - db_update('users') - ->fields(array( - 'access' => REQUEST_TIME - )) - ->condition('uid', $user->uid) - ->execute(); + else { + // User does not exists anymore or session data has expired. + $user = drupal_anonymous_user(); } - - return TRUE; } - catch (Exception $exception) { - require_once DRUPAL_ROOT . '/core/includes/errors.inc'; - // If we are displaying errors, then do so with no possibility of a further - // uncaught exception being thrown. - if (error_displayable()) { - print '

Uncaught exception thrown in session handler.

'; - print '

' . _drupal_render_exception_safe($exception) . '

'; - } - return FALSE; - } -} - -/** - * Initializes the session handler, starting a session if needed. - */ -function drupal_session_initialize() { - global $user, $is_https; - - session_set_save_handler('_drupal_session_open', '_drupal_session_close', '_drupal_session_read', '_drupal_session_write', '_drupal_session_destroy', '_drupal_session_garbage_collection'); - - // We use !empty() in the following check to ensure that blank session IDs - // are not valid. - if (!empty($_COOKIE[session_name()]) || ($is_https && variable_get('https', FALSE) && !empty($_COOKIE[substr(session_name(), 1)]))) { - // If a session cookie exists, initialize the session. Otherwise the - // session is only started on demand in drupal_session_commit(), making - // anonymous users not use a session cookie unless something is stored in - // $_SESSION. This allows HTTP proxies to cache anonymous pageviews. - drupal_session_start(); - if (!empty($user->uid) || !empty($_SESSION)) { - drupal_page_is_cacheable(FALSE); - } + // During install session must carry a user name in order for the session + // commit algorithm to send the cookie headers due to the lazy cookie + // sending algorithm. + else if (defined('MAINTENANCE_MODE') && MAINTENANCE_MODE === 'install') { + $user = (object)array( + 'uid' => 1, + 'hostname' => ip_address(), + // 1 is DRUPAL_AUTHENTICATED_RID we hitting this during install and may + // not have the constant yet. + 'roles' => array(1 => 1), + // This will avoid some wrong PHP warnings due to incomplete user loading + 'timezone' => @date_default_timezone_get(), + ); + $session->set('uid', 1); } else { - // Set a session identifier for this request. This is necessary because - // we lazily start sessions at the end of this request, and some - // processes (like drupal_get_token()) needs to know the future - // session ID in advance. - $GLOBALS['lazy_session'] = TRUE; + // No session uid is set, meaning the session does not exists or the user + // is anonymous. $user = drupal_anonymous_user(); - // Less random sessions (which are much faster to generate) are used for - // anonymous users than are generated in drupal_session_regenerate() when - // a user becomes authenticated. - session_id(drupal_hash_base64(uniqid(mt_rand(), TRUE))); - if ($is_https && variable_get('https', FALSE)) { - $insecure_session_name = substr(session_name(), 1); - $session_id = drupal_hash_base64(uniqid(mt_rand(), TRUE)); - $_COOKIE[$insecure_session_name] = $session_id; - } } - date_default_timezone_set(drupal_get_user_timezone()); -} - -/** - * Forcefully starts a session, preserving already set session data. - * - * @ingroup php_wrappers - */ -function drupal_session_start() { - // Command line clients do not support cookies nor sessions. - if (!drupal_session_started() && !drupal_is_cli()) { - // Save current session data before starting it, as PHP will destroy it. - $session_data = isset($_SESSION) ? $_SESSION : NULL; - session_start(); - drupal_session_started(TRUE); - - // Restore session data. - if (!empty($session_data)) { - $_SESSION += $session_data; - } + // Core can cache pages if session is empty (no flash messages) and user + // is not logged in. + if (!empty($user->uid) || !$session->isEmpty()) { + drupal_page_is_cacheable(FALSE); } + + date_default_timezone_set(drupal_get_user_timezone()); } /** * Commits the current session, if necessary. - * - * If an anonymous user already have an empty session, destroy it. + * @todo: This should move into an AbstractProxy implementation instead. */ function drupal_session_commit() { - global $user, $is_https; - - if (!drupal_save_session()) { - // We don't have anything to do if we are not allowed to save the session. + global $user; + + $session = drupal_container()->get('session'); + + if (!$session->isSaveEnabled()) { + // In case business layer specifically asked for not saving the session, we + // need to unregister potential handlers the Symfony session storage + // component may have registered for us. Considering that this function is + // only run when Drupal is doing its proper shutdown, we can safely assume + // the session has not been automatically saved by PHP at shutdown. + // Notice that this check is duplicated into the Session::save() method in + // order to avoid accidental save. This check here only exists for minor + // performance reasons. return; } - if (empty($user->uid) && empty($_SESSION)) { - // There is no session data to store, destroy the session if it was - // previously started. - if (drupal_session_started()) { - session_destroy(); - } + if (empty($user->uid)) { + // Ensure there is no 'uid' set in session. Keeping an outdated or empty + // session 'uid' attributes would taint the Session::isEmpty() check and + // give potential false positives, thus forcing empty session to be saved. + $session->remove('uid'); } else { - // There is session data to store. Start the session if it is not already - // started. - if (!drupal_session_started()) { - drupal_session_start(); - if ($is_https && variable_get('https', FALSE)) { - $insecure_session_name = substr(session_name(), 1); - $params = session_get_cookie_params(); - $expire = $params['lifetime'] ? REQUEST_TIME + $params['lifetime'] : 0; - setcookie($insecure_session_name, $_COOKIE[$insecure_session_name], $expire, $params['path'], $params['domain'], FALSE, $params['httponly']); - } - } - // Write the session data. - session_write_close(); + // Ensures user 'uid' which may not be set yet. + $session->set('uid', $user->uid); } -} -/** - * Returns whether a session has been started. - */ -function drupal_session_started($set = NULL) { - static $session_started = FALSE; - if (isset($set)) { - $session_started = $set; - } - return $session_started && session_id(); -} - -/** - * Called when an anonymous user becomes authenticated or vice-versa. - * - * @ingroup php_wrappers - */ -function drupal_session_regenerate() { - global $user, $is_https; - - // Nothing to do if we are not allowed to change the session. - if (!drupal_save_session()) { - return; - } - - if ($is_https && variable_get('https', FALSE)) { - $insecure_session_name = substr(session_name(), 1); - if (!isset($GLOBALS['lazy_session']) && isset($_COOKIE[$insecure_session_name])) { - $old_insecure_session_id = $_COOKIE[$insecure_session_name]; - } - $params = session_get_cookie_params(); - $session_id = drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55)); - // If a session cookie lifetime is set, the session will expire - // $params['lifetime'] seconds from the current request. If it is not set, - // it will expire when the browser is closed. - $expire = $params['lifetime'] ? REQUEST_TIME + $params['lifetime'] : 0; - setcookie($insecure_session_name, $session_id, $expire, $params['path'], $params['domain'], FALSE, $params['httponly']); - $_COOKIE[$insecure_session_name] = $session_id; - } - - if (drupal_session_started()) { - $old_session_id = session_id(); - } - session_id(drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55))); - - if (isset($old_session_id)) { - $params = session_get_cookie_params(); - $expire = $params['lifetime'] ? REQUEST_TIME + $params['lifetime'] : 0; - setcookie(session_name(), session_id(), $expire, $params['path'], $params['domain'], $params['secure'], $params['httponly']); - $fields = array('sid' => session_id()); - if ($is_https) { - $fields['ssid'] = session_id(); - // If the "secure pages" setting is enabled, use the newly-created - // insecure session identifier as the regenerated sid. - if (variable_get('https', FALSE)) { - $fields['sid'] = $session_id; - } - } - db_update('sessions') - ->fields($fields) - ->condition($is_https ? 'ssid' : 'sid', $old_session_id) - ->execute(); - } - elseif (isset($old_insecure_session_id)) { - // If logging in to the secure site, and there was no active session on the - // secure site but a session was active on the insecure site, update the - // insecure session with the new session identifiers. - db_update('sessions') - ->fields(array('sid' => $session_id, 'ssid' => session_id())) - ->condition('sid', $old_insecure_session_id) - ->execute(); + if ($session->isEmpty()) { + // Force any empty session to be destroyed, this will avoid next bootstrap + // with the same client to attempt a useless user initialization and session + // read thus saving precious SQL queries. + $session->invalidate(); } else { - // Start the session when it doesn't exist yet. - // Preserve the logged in user, as it will be reset to anonymous - // by _drupal_session_read. - $account = $user; - drupal_session_start(); - $user = $account; - } - date_default_timezone_set(drupal_get_user_timezone()); -} - -/** - * Session handler assigned by session_set_save_handler(). - * - * Cleans up a specific session. - * - * @param $sid - * Session ID. - */ -function _drupal_session_destroy($sid) { - global $user, $is_https; - - // Nothing to do if we are not allowed to change the session. - if (!drupal_save_session()) { - return; - } - - // Delete session data. - db_delete('sessions') - ->condition($is_https ? 'ssid' : 'sid', $sid) - ->execute(); - - // Reset $_SESSION and $user to prevent a new session from being started - // in drupal_session_commit(). - $_SESSION = array(); - $user = drupal_anonymous_user(); - - // Unset the session cookies. - _drupal_session_delete_cookie(session_name()); - if ($is_https) { - _drupal_session_delete_cookie(substr(session_name(), 1), FALSE); - } - elseif (variable_get('https', FALSE)) { - _drupal_session_delete_cookie('S' . session_name(), TRUE); - } -} - -/** - * Deletes the session cookie. - * - * @param $name - * Name of session cookie to delete. - * @param boolean $secure - * Force the secure value of the cookie. - */ -function _drupal_session_delete_cookie($name, $secure = NULL) { - global $is_https; - if (isset($_COOKIE[$name]) || (!$is_https && $secure === TRUE)) { - $params = session_get_cookie_params(); - if ($secure !== NULL) { - $params['secure'] = $secure; - } - setcookie($name, '', REQUEST_TIME - 3600, $params['path'], $params['domain'], $params['secure'], $params['httponly']); - unset($_COOKIE[$name]); - } -} - -/** - * Ends a specific user's session(s). - * - * @param $uid - * User ID. - */ -function drupal_session_destroy_uid($uid) { - // Nothing to do if we are not allowed to change the session. - if (!drupal_save_session()) { - return; - } - - db_delete('sessions') - ->condition('uid', $uid) - ->execute(); -} - -/** - * Session handler assigned by session_set_save_handler(). - * - * Cleans up stalled sessions. - * - * @param $lifetime - * The value of session.gc_maxlifetime, passed by PHP. - * Sessions not updated for more than $lifetime seconds will be removed. - */ -function _drupal_session_garbage_collection($lifetime) { - // Be sure to adjust 'php_value session.gc_maxlifetime' to a large enough - // value. For example, if you want user sessions to stay in your database - // for three weeks before deleting them, you need to set gc_maxlifetime - // to '1814400'. At that value, only after a user doesn't log in after - // three weeks (1814400 seconds) will his/her session be removed. - db_delete('sessions') - ->condition('timestamp', REQUEST_TIME - $lifetime, '<') - ->execute(); - return TRUE; -} - -/** - * Determines whether to save session data of the current request. - * - * This function allows the caller to temporarily disable writing of - * session data, should the request end while performing potentially - * dangerous operations, such as manipulating the global $user object. - * See http://drupal.org/node/218104 for usage. - * - * @param $status - * Disables writing of session data when FALSE, (re-)enables - * writing when TRUE. - * - * @return - * FALSE if writing session data has been disabled. Otherwise, TRUE. - */ -function drupal_save_session($status = NULL) { - // PHP session ID, session, and cookie handling happens in the global scope. - // This value has to persist across calls to drupal_static_reset(), since a - // potentially wrong or disallowed session would be written otherwise. - static $save_session = TRUE; - if (isset($status)) { - $save_session = $status; + // Save the session only if necessary. + $session->save(); } - return $save_session; } diff --git a/core/lib/Drupal/Core/CoreBundle.php b/core/lib/Drupal/Core/CoreBundle.php index 017aa01..9517994 100644 --- a/core/lib/Drupal/Core/CoreBundle.php +++ b/core/lib/Drupal/Core/CoreBundle.php @@ -64,6 +64,22 @@ public function build(ContainerBuilder $container) { ->addArgument(new Reference('database')) ->addArgument(new Reference('lock')); + // Register the session service. + /* + * @todo This needs to be commened out as soon as the bootstrap container + * is tackled out + * + $container->register('session.storage.backend', 'Drupal\Core\Session\Handler\DatabaseSessionHandler'); + $container->register('session.storage.proxy', 'Drupal\Core\Session\Proxy\CookieOverrideProxy') + ->addArgument(new Reference('session.storage.backend')); + $container->setParameter('session.storage.options', array()); + $container->register('session.storage', 'Drupal\Core\Session\Storage\DrupalSessionStorage') + ->addArgument('%session.storage.options%') + ->addArgument(new Reference('session.storage.proxy')); + $container->register('session', 'Drupal\Core\Session\Session') + ->addArgument(new Reference('session.storage')); + */ + $container->register('router.dumper', 'Drupal\Core\Routing\MatcherDumper') ->addArgument(new Reference('database')); $container->register('router.builder', 'Drupal\Core\Routing\RouteBuilder') diff --git a/core/lib/Drupal/Core/Session/Handler/DatabaseSessionHandler.php b/core/lib/Drupal/Core/Session/Handler/DatabaseSessionHandler.php new file mode 100644 index 0000000..5dfb119 100644 --- /dev/null +++ b/core/lib/Drupal/Core/Session/Handler/DatabaseSessionHandler.php @@ -0,0 +1,82 @@ +condition('sid', $sessionId)->execute(); + } + catch (\PDOException $e) { + throw new \RuntimeException(sprintf('PDOException was thrown when trying to manipulate session data: %s', $e->getMessage()), 0, $e); + } + + return TRUE; + } + + /** + * @Implements SessionHandlerInterface::gc(). + */ + public function gc($lifetime) { + try { + db_delete('sessions')->condition('timestamp', time() - $lifetime, '<')->execute(); + } + catch (\PDOException $e) { + throw new \RuntimeException(sprintf('PDOException was thrown when trying to manipulate session data: %s', $e->getMessage()), 0, $e); + } + + return TRUE; + } + + /** + * @Implements SessionHandlerInterface::read(). + */ + public function read($sessionId) { + $data = db_query("SELECT s.* FROM {sessions} s WHERE s.sid = :sid", array(':sid' => $sessionId))->fetchObject(); + return !empty($data) ? $data->session : ''; + } + + /** + * @Implements SessionHandlerInterface::write(). + */ + public function write($sessionId, $data) { + try { + db_merge('sessions') + ->key(array( + 'sid' => $sessionId, + )) + ->fields(array( + 'session' => $data, + 'timestamp' => time(), + )) + ->execute(); + } + catch (\PDOException $e) { + throw new \RuntimeException(sprintf('PDOException was thrown when trying to write session data: %s', $e->getMessage()), 0, $e); + } + + return TRUE; + } +} diff --git a/core/lib/Drupal/Core/Session/Proxy/CookieOverrideProxy.php b/core/lib/Drupal/Core/Session/Proxy/CookieOverrideProxy.php new file mode 100644 index 0000000..3516212 100644 --- /dev/null +++ b/core/lib/Drupal/Core/Session/Proxy/CookieOverrideProxy.php @@ -0,0 +1,148 @@ +getIdFromCookie()) { + $this->setId($id); + } + else { + // Set a session identifier for this request. This is necessary because we + // lazily start sessions at the end of this request, and some processes + // (like drupal_get_token()) needs to know the future session ID i + // advance. + $GLOBALS['lazy_session'] = TRUE; + + // Less random sessions (which are much faster to generate) are used for + // anonymous users than are generated in drupal_session_regenerate() when + // a user becomes authenticated. + $this->regenerateId(); + + /* + * @todo Restore HTTPS cookie + if ($is_https && variable_get('https', FALSE)) { + $insecure_session_name = substr(session_name(), 1); + $session_id = drupal_hash_base64(uniqid(mt_rand(), TRUE)); + $_COOKIE[$insecure_session_name] = $session_id; + } + */ + } + } + + /** + * Get current session identifier from cookie, if any. + * + * @return string + * Session identifier or NULL if none found. + */ + protected function getIdFromCookie() { + $name = $this->getName(); + if (!empty($_COOKIE[$name])) { + // @todo Restore HTTPS cookie + //|| ($GLOBALS['is_https'] && variable_get('https', FALSE) && !empty($_COOKIE[substr(session_name(), 1)]))) { + return $_COOKIE[$name]; + } + } + + protected function destroyCookies() { + if (headers_sent()) { + //throw new \RuntimeException('Failed to destroy cookies because headers have already been sent.'); + } + + $params = session_get_cookie_params(); + // @todo Restore HTTPS cookie + setcookie($this->getName(), '', time() - 3600, $params['path'], $params['domain'], $params['secure'], $params['httponly']); + } + + protected function sendCookies($id) { + if (headers_sent()) { + //throw new \RuntimeException('Failed to set cookies because headers have already been sent.'); + } + + $params = session_get_cookie_params(); + $expire = $params['lifetime'] ? time() + $params['lifetime'] : 0; + // @todo Restore HTTPS cookie + setcookie($this->getName(), $id, $expire, $params['path'], $params['domain'], $params['secure'], $params['httponly']); + } + + public function write($id, $data) { + + if (!$this->active) { + return FALSE; + } + + // Cookie sending must be when we are sure we need to keep the session, this + // ensure the lazy session init. Lazy session init is abusive talking we are + // not lazy initializing the session, but lazy sending the session cookie + // instead. Each anonymous user will intrinsecly have a session tied, which + // allows to generate tokens for forms and such, but if the session ends up + // empty, the cookies will not be sent and the session will not be saved on + // disk. + $this->sendCookies($id); + + return (bool) $this->handler->write($id, $data); + } + + public function destroy($id) { + $this->destroyCookies($id); + + return (bool) $this->handler->destroy($id); + } + + /** + * Generate new session identifier. + * + * The the session_regenerate_id() is hardcoded into Symfony's + * NativeSessionStorage implementation while all other session_*() functions + * are used as setters only in the AbstractProxy implementation. This feels + * wrong and we need to override it without doing invasive changes. + * + * @todo Propose a nice PR to Symfony guys so they move this specific call + * into the SessionHandlerProxy so we wouldn't have to override the + * NativeSessionStorage at all. + * + * @see Drupal\Core\Session\Proxy\Storage\DrupalSessionStorage::regenerate() + * + * @param bool $destroy + * (optional) If set to TRUE, destroy the old session. + * + * @return string + * New session identifier. + */ + public function regenerateId($destroy = FALSE) { + $id = drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55)); + + // Do not call parent::setId() here, else it will throw exceptions because + // during session identifier regeneration, this component is considered as + // active. + session_id($id); + + if ($destroy) { + $this->destroyCookies(); + } + + return TRUE; + } +} diff --git a/core/lib/Drupal/Core/Session/Session.php b/core/lib/Drupal/Core/Session/Session.php new file mode 100644 index 0000000..8cbc677 100644 --- /dev/null +++ b/core/lib/Drupal/Core/Session/Session.php @@ -0,0 +1,77 @@ +saveEnabled = true; + } + + /** + * Disable session save, at commit time session save will be skiped and + * session token will not be sent to client. + * + * This function allows the caller to temporarily disable writing of + * session data, should the request end while performing potentially + * dangerous operations, such as manipulating the global $user object. + * See http://drupal.org/node/218104 for usage. + */ + public function disableSave() { + $this->saveEnabled = false; + } + + /** + * Is the session save enabled. + * + * @return bool + */ + public function isSaveEnabled() { + return $this->saveEnabled; + } + + /** + * Does this session is empty. + * + * @todo This is the most absurd implementation that could ever been written + * but there is no clean solution because bags can not be directly accessed + * via protected attributes, and they don't have either a count() or isEmpty() + * method. + * + * @return bool + * TRUE if session is empty. + */ + public function isEmpty() { + return !count($this->getFlashBag()->all()) && !count($this->all()); + } + + public function save() { + // Session saving is checked upper, but avoid accidental save() trigger in + // case save is disabled. + // @todo May be should throw a \LogicException here? + if (!$this->isSaveEnabled()) { + return; + } + + parent::save(); + } +} diff --git a/core/lib/Drupal/Core/Session/Storage/DrupalSessionStorage.php b/core/lib/Drupal/Core/Session/Storage/DrupalSessionStorage.php new file mode 100644 index 0000000..018e94d 100644 --- /dev/null +++ b/core/lib/Drupal/Core/Session/Storage/DrupalSessionStorage.php @@ -0,0 +1,68 @@ +setMetadataBag($metaBag); + $this->setOptions($options); + $this->setSaveHandler($handler); + } + + public function clear() { + parent::clear(); + + // Clearing the session is a signal sent when session is invalidated, this + // means we can mark the session handler as inactive so it won't attempt + // any empty session write. Our session handler will send session cookie at + // write time. This allows lazy cookie sending to the client. + $this->saveHandler->setActive(FALSE); + } + + public function regenerate($destroy = FALSE, $lifetime = NULL) { + + if (null !== $lifetime) { + ini_set('session.cookie_lifetime', $lifetime); + } + + if ($destroy) { + $this->metadataBag->stampNew(); + } + + // If the current save handler is our own we must rely its own session + // identifier generation method. I hope Symfony will move this call to + // this object so we can get rid of this method override. + if ($this->saveHandler instanceof CookieOverrideProxy) { + return $this->saveHandler->regenerateId($destroy); + } + else { + return session_regenerate_id($destroy); + } + } +} diff --git a/core/modules/system/system.install b/core/modules/system/system.install index e938128..334762c 100644 --- a/core/modules/system/system.install +++ b/core/modules/system/system.install @@ -1362,32 +1362,12 @@ function system_schema() { $schema['sessions'] = array( 'description' => "Drupal's session handlers read and write into the sessions table. Each record represents a user session, either anonymous or authenticated.", 'fields' => array( - 'uid' => array( - 'description' => 'The {users}.uid corresponding to a session, or 0 for anonymous user.', - 'type' => 'int', - 'unsigned' => TRUE, - 'not null' => TRUE, - ), 'sid' => array( 'description' => "A session ID. The value is generated by Drupal's session handlers.", 'type' => 'varchar', 'length' => 128, 'not null' => TRUE, ), - 'ssid' => array( - 'description' => "Secure session ID. The value is generated by Drupal's session handlers.", - 'type' => 'varchar', - 'length' => 128, - 'not null' => TRUE, - 'default' => '', - ), - 'hostname' => array( - 'description' => 'The IP address that last used this session ID (sid).', - 'type' => 'varchar', - 'length' => 128, - 'not null' => TRUE, - 'default' => '', - ), 'timestamp' => array( 'description' => 'The Unix timestamp when this session last requested a page. Old records are purged by PHP automatically.', 'type' => 'int', @@ -1401,20 +1381,9 @@ function system_schema() { 'size' => 'big', ), ), - 'primary key' => array( - 'sid', - 'ssid', - ), + 'primary key' => array('sid'), 'indexes' => array( 'timestamp' => array('timestamp'), - 'uid' => array('uid'), - 'ssid' => array('ssid'), - ), - 'foreign keys' => array( - 'session_user' => array( - 'table' => 'users', - 'columns' => array('uid' => 'uid'), - ), ), ); @@ -2215,6 +2184,23 @@ function system_update_8032() { } /** + * Make changes on the {sessions} table accordingly to new Symfony session + * handling usage. + * + * @todo This will fail, always. The only way we can ensure update will work + * seamlessly is by defaulting the {sessions}.uid column to 0 in Drupal 7, thus + * ensuring the new database storage handler will ignore this field when doing + * the session db_merge(). + * + * @see http://drupal.org/node/335411 + */ +function system_update_8033() { + db_drop_field('sessions', 'uid'); + db_drop_field('sessions', 'hostname'); + db_drop_field('sessions', 'ssid'); +} + +/** * @} End of "defgroup updates-7.x-to-8.x". * The next series of updates should start at 9000. */ diff --git a/core/modules/user/lib/Drupal/user/UserStorageController.php b/core/modules/user/lib/Drupal/user/UserStorageController.php index 5f340e4..1c58b01 100644 --- a/core/modules/user/lib/Drupal/user/UserStorageController.php +++ b/core/modules/user/lib/Drupal/user/UserStorageController.php @@ -166,9 +166,9 @@ protected function postSave(EntityInterface $entity, $update) { // If the password has been changed, delete all open sessions for the // user and recreate the current one. if ($entity->pass != $entity->original->pass) { - drupal_session_destroy_uid($entity->uid); + // FIXME: Destroy session by uid here if ($entity->uid == $GLOBALS['user']->uid) { - drupal_session_regenerate(); + drupal_container()->get('session')->migrate(); } } @@ -195,7 +195,7 @@ protected function postSave(EntityInterface $entity, $update) { // If the user was blocked, delete the user's sessions to force a logout. if ($entity->original->status != $entity->status && $entity->status == 0) { - drupal_session_destroy_uid($entity->uid); + // FIXME: Session destroy by uid here. } // Send emails after we have the new user object. diff --git a/core/modules/user/user.module b/core/modules/user/user.module index b7ac23d..9601873 100644 --- a/core/modules/user/user.module +++ b/core/modules/user/user.module @@ -303,7 +303,8 @@ function user_load_multiple(array $uids = NULL, $reset = FALSE) { * user. So to avoid confusion and to avoid clobbering the global $user object, * it is a good idea to assign the result of this function to a different local * variable, generally $account. If you actually do want to act as the user you - * are loading, it is essential to call drupal_save_session(FALSE); first. + * are loading, it is essential to call + * \Drupal\Core\Session\Session::disableSave(); first. * See * @link http://drupal.org/node/218104 Safely impersonating another user @endlink * for more information. @@ -1767,10 +1768,12 @@ function user_login_finalize(&$edit = array()) { ->condition('uid', $user->uid) ->execute(); + $session = drupal_container()->get('session'); // Regenerate the session ID to prevent against session fixation attacks. // This is called before hook_user in case one of those functions fails // or incorrectly does a redirect which would leave the old session in place. - drupal_session_regenerate(); + $session->migrate(); + $session->set('uid', $user->uid); user_module_invoke('login', $edit, $user); } @@ -2015,6 +2018,7 @@ function user_delete($uid) { */ function user_delete_multiple(array $uids) { entity_get_controller('user')->delete($uids); + // FIXME: Delete session by uid here. } /** diff --git a/core/modules/user/user.pages.inc b/core/modules/user/user.pages.inc index b088ecf..363b9c4 100644 --- a/core/modules/user/user.pages.inc +++ b/core/modules/user/user.pages.inc @@ -179,7 +179,8 @@ function user_logout() { module_invoke_all('user_logout', $user); // Destroy the current session, and reset $user to the anonymous user. - session_destroy(); + $user = drupal_anonymous_user(); + drupal_container()->get('session')->invalidate(); drupal_goto(); } diff --git a/core/update.php b/core/update.php index fec640b..af1583f 100644 --- a/core/update.php +++ b/core/update.php @@ -523,7 +523,7 @@ function update_check_requirements($skip_warnings = FALSE) { } if (isset($output) && $output) { // Explicitly start a session so that the update.php token will be accepted. - drupal_session_start(); + drupal_container()->get('session')->start(); // We defer the display of messages until all updates are done. $progress_page = ($batch = batch_get()) && isset($batch['running']); if ($output instanceof Response) {