diff --git a/core/lib/Drupal/Core/Session/SessionManager.php b/core/lib/Drupal/Core/Session/SessionManager.php index 1d470e2..04f3f99 100644 --- a/core/lib/Drupal/Core/Session/SessionManager.php +++ b/core/lib/Drupal/Core/Session/SessionManager.php @@ -124,16 +124,6 @@ public function start() { } if (empty($result)) { - // Randomly generate a session identifier for this request. This is - // necessary because \Drupal\user\SharedTempStoreFactory::get() wants to - // know the future session ID of a lazily started session in advance. - // - // @todo: With current versions of PHP there is little reason to generate - // the session id from within application code. Consider using the - // default php session id instead of generating a custom one: - // https://www.drupal.org/node/2238561 - $this->setId(Crypt::randomBytesBase64()); - // Initialize the session global and attach the Symfony session bags. $_SESSION = array(); $this->loadSession(); @@ -223,7 +213,7 @@ public function regenerate($destroy = FALSE, $lifetime = NULL) { if ($this->isStarted()) { $old_session_id = $this->getId(); } - session_id(Crypt::randomBytesBase64()); + session_regenerate_id(); $this->getMetadataBag()->clearCsrfTokenSeed(); diff --git a/core/modules/user/src/PrivateTempStore.php b/core/modules/user/src/PrivateTempStore.php index 79be710..5491e92 100644 --- a/core/modules/user/src/PrivateTempStore.php +++ b/core/modules/user/src/PrivateTempStore.php @@ -7,11 +7,11 @@ namespace Drupal\user; +use Drupal\Component\Utility\Crypt; use Drupal\Component\Utility\SafeMarkup; use Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface; use Drupal\Core\Lock\LockBackendInterface; use Drupal\Core\Session\AccountProxyInterface; -use Symfony\Component\HttpFoundation\RequestStack; /** * Stores and retrieves temporary data for a given owner. @@ -56,13 +56,6 @@ class PrivateTempStore { protected $currentUser; /** - * The request stack. - * - * @var \Symfony\Component\HttpFoundation\RequestStack - */ - protected $requestStack; - - /** * The time to live for items in seconds. * * By default, data is stored for one week (604800 seconds) before expiring. @@ -80,16 +73,15 @@ class PrivateTempStore { * of key/value pairs. * @param \Drupal\Core\Lock\LockBackendInterface $lockBackend * The lock object used for this data. - * @param mixed $owner - * The owner key to store along with the data (e.g. a user or session ID). + * @param \Drupal\Core\Session\AccountProxyInterface $current_user + * The current user. * @param int $expire * The time to live for items, in seconds. */ - public function __construct(KeyValueStoreExpirableInterface $storage, LockBackendInterface $lockBackend, AccountProxyInterface $current_user, RequestStack $request_stack, $expire = 604800) { + public function __construct(KeyValueStoreExpirableInterface $storage, LockBackendInterface $lockBackend, AccountProxyInterface $current_user, $expire = 604800) { $this->storage = $storage; $this->lockBackend = $lockBackend; $this->currentUser = $current_user; - $this->requestStack = $request_stack; $this->expire = $expire; } @@ -211,6 +203,15 @@ protected function createkey($key) { * The owner. */ protected function getOwner() { - return $this->currentUser->id() ?: $this->requestStack->getCurrentRequest()->getSession()->getId(); + if ($this->currentUser->isAuthenticated()) { + return $this->currentUser->id(); + } + // Anonymous users needs special handling. + // @todo Fix me. + if (!isset($_SESSION['user_private_owner'])) { + $_SESSION['user_private_owner'] = Crypt::randomBytesBase64(); + } + return $_SESSION['user_private_owner']; } + } diff --git a/core/modules/user/src/PrivateTempStoreFactory.php b/core/modules/user/src/PrivateTempStoreFactory.php index bd62633..52abbda 100644 --- a/core/modules/user/src/PrivateTempStoreFactory.php +++ b/core/modules/user/src/PrivateTempStoreFactory.php @@ -39,13 +39,6 @@ class PrivateTempStoreFactory { protected $currentUser; /** - * The request stack. - * - * @var \Symfony\Component\HttpFoundation\RequestStack - */ - protected $requestStack; - - /** * The time to live for items in seconds. * * @var int @@ -55,18 +48,19 @@ class PrivateTempStoreFactory { /** * Constructs a Drupal\user\PrivateTempStoreFactory object. * - * @param \Drupal\Core\Database\Connection $connection - * The connection object used for this data. + * @param \Drupal\Core\KeyValueStore\KeyValueExpirableFactoryInterface $storage_factory + * The storage factory creating the backend to store the data. * @param \Drupal\Core\Lock\LockBackendInterface $lockBackend * The lock object used for this data. + * @param \Drupal\Core\Session\AccountProxyInterface $current_user + * The current user. * @param int $expire * The time to live for items, in seconds. */ - function __construct(KeyValueExpirableFactoryInterface $storage_factory, LockBackendInterface $lockBackend, AccountProxyInterface $current_user, RequestStack $request_stack, $expire = 604800) { + function __construct(KeyValueExpirableFactoryInterface $storage_factory, LockBackendInterface $lockBackend, AccountProxyInterface $current_user, $expire = 604800) { $this->storageFactory = $storage_factory; $this->lockBackend = $lockBackend; $this->currentUser = $current_user; - $this->requestStack = $request_stack; $this->expire = $expire; } @@ -83,7 +77,7 @@ function __construct(KeyValueExpirableFactoryInterface $storage_factory, LockBac function get($collection) { // Store the data for this collection in the database. $storage = $this->storageFactory->get("user.private_tempstore.$collection"); - return new PrivateTempStore($storage, $this->lockBackend, $this->currentUser, $this->requestStack, $this->expire); + return new PrivateTempStore($storage, $this->lockBackend, $this->currentUser, $this->expire); } } diff --git a/core/modules/user/src/SharedTempStoreFactory.php b/core/modules/user/src/SharedTempStoreFactory.php index da2331d..cf069d7 100644 --- a/core/modules/user/src/SharedTempStoreFactory.php +++ b/core/modules/user/src/SharedTempStoreFactory.php @@ -8,6 +8,7 @@ namespace Drupal\user; use Drupal\Component\Serialization\SerializationInterface; +use Drupal\Component\Utility\Crypt; use Drupal\Core\KeyValueStore\KeyValueExpirableFactoryInterface; use Drupal\Core\Lock\LockBackendInterface; use Symfony\Component\HttpFoundation\RequestStack; @@ -82,7 +83,18 @@ function get($collection, $owner = NULL) { // Use the currently authenticated user ID or the active user ID unless // the owner is overridden. if (!isset($owner)) { - $owner = \Drupal::currentUser()->id() ?: session_id(); + $account = \Drupal::currentUser(); + if ($account->isAuthenticated()) { + $owner = $account->id(); + } + else { + // Anonymous users needs special handling. + // @todo Fix me. + if (!isset($_SESSION['user_shared_owner'])) { + $_SESSION['user_shared_owner'] = Crypt::randomBytesBase64(); + } + $owner = $_SESSION['user_shared_owner']; + } } // Store the data for this collection in the database. diff --git a/core/modules/user/tests/src/Unit/PrivateTempStoreTest.php b/core/modules/user/tests/src/Unit/PrivateTempStoreTest.php index a2d3d95..bd71c9f 100644 --- a/core/modules/user/tests/src/Unit/PrivateTempStoreTest.php +++ b/core/modules/user/tests/src/Unit/PrivateTempStoreTest.php @@ -10,7 +10,6 @@ use Drupal\Tests\UnitTestCase; use Drupal\user\PrivateTempStore; use Symfony\Component\HttpFoundation\Request; -use Symfony\Component\HttpFoundation\RequestStack; /** * @coversDefaultClass \Drupal\user\PrivateTempStore @@ -47,13 +46,6 @@ class PrivateTempStoreTest extends UnitTestCase { protected $currentUser; /** - * The request stack. - * - * @var \Symfony\Component\HttpFoundation\RequestStack - */ - protected $requestStack; - - /** * A tempstore object belonging to the owner. * * @var \stdClass @@ -80,11 +72,9 @@ protected function setUp() { ->method('id') ->willReturn(1); - $this->requestStack = new RequestStack(); $request = Request::createFromGlobals(); - $this->requestStack->push($request); - $this->tempStore = new PrivateTempStore($this->keyValue, $this->lock, $this->currentUser, $this->requestStack, 604800); + $this->tempStore = new PrivateTempStore($this->keyValue, $this->lock, $this->currentUser, 604800); $this->ownObject = (object) array( 'data' => 'test_data', diff --git a/core/modules/user/user.services.yml b/core/modules/user/user.services.yml index 0a55b6e..838bb4f 100644 --- a/core/modules/user/user.services.yml +++ b/core/modules/user/user.services.yml @@ -50,7 +50,7 @@ services: arguments: ['@entity.manager', '@password'] user.private_tempstore: class: Drupal\user\PrivateTempStoreFactory - arguments: ['@keyvalue.expirable', '@lock', '@current_user', '@request_stack', '%user.tempstore.expire%'] + arguments: ['@keyvalue.expirable', '@lock', '@current_user', '%user.tempstore.expire%'] tags: - { name: backend_overridable } user.shared_tempstore: