dbxapp 4.1.3
CMS, Shop, Workflows und modulare Geschäftsanwendungen
Loading...
Searching...
No Matches
include/dbxSession.class.php
Go to the documentation of this file.
1<?php
2
6class dbxSession {
7
8 Private function get_request() {
9 $request='';
10 if (isset($_SERVER['REQUEST_URI'])) $request=$_SERVER['REQUEST_URI'] ;
11 return $request;
12 }
13
14
15 Private function get_new_session_id($uid) {
16 $s1=microtime(true);
17 $s2=dbx()->new_password(8);
18 $sid=md5($uid.'|'.$s1.'|'.$s2);
19 $sid=substr($sid, 0, 32);
20 return $sid;
21 }
22
23 Private function get_new_session($uid) {
24 $config=dbx()->get_config('dbx');
25 $cookie=0; if (count($_COOKIE)>0) $cookie=1;
26 $oBrowser =dbx()->get_system_obj('dbxBrowser');
27 $sid=$this->get_new_session_id($uid);
28 dbx()->debug("#dbxSession new sessid for user($uid) =($sid)");
29
30 $session['record']['id'] = 0;
31 $session['record']['create_date'] = date('Y-m-d H:i:s');
32 $session['record']['create_uid'] = $uid;
33 $session['record']['update_date'] = date('Y-m-d H:i:s');
34 $session['record']['update_uid'] = $uid;
35 $session['record']['owner'] = $uid;
36 $session['record']['ip'] = $oBrowser->_ip;
37 $session['record']['host'] = $oBrowser->_host;
38 $session['record']['device']= $oBrowser->_device;
39 $session['record']['robot'] = $oBrowser->_robot;
40 $session['record']['name'] = $oBrowser->_name;
41 $session['record']['ver'] = $oBrowser->_version;
42 $session['record']['os'] = $oBrowser->_platform;
43 $session['record']['width'] = $oBrowser->_width;
44 $session['record']['height']= $oBrowser->_height;
45 $session['record']['cookie']= $cookie;
46 $session['record']['userid']= $uid;
47 $session['record']['sessid']= $sid;
48
49 $session['record']['request_counter']= '0';
50 $session['record']['request_last'] = '';
51 $session['record']['request_current']= '';
52
53 $session['current_user']=$this->get_current_user($uid);
54 $session['tmp']=array();
55 $session['remember']=array();
56 $session['cache']['tpl']=array();
57 $session['cache']['obj']=array();
58
59 // - - - - - - - - - - -
60
61
62 return $session;
63 }
64
65
66
67 private function apply_browser_to_record(&$rec) {
68 $oBrowser = dbx()->get_system_obj('dbxBrowser');
69
70 $rec['ip'] = $oBrowser->_ip;
71 $rec['host'] = $oBrowser->_host;
72 $rec['device'] = $oBrowser->_device;
73 $rec['mobile'] = $oBrowser->_mobile;
74 $rec['robot'] = $oBrowser->_robot;
75 $rec['name'] = $oBrowser->_name;
76 $rec['ver'] = $oBrowser->_version;
77 $rec['os'] = $oBrowser->_platform;
78 $rec['width'] = $oBrowser->_width;
79 $rec['height'] = $oBrowser->_height;
80 $rec['cookie'] = count($_COOKIE)>0 ? 1 : 0;
81 }
82
83
84
85 public function get_current_user($uid = 0) {
86 // #todo cfg ob user 1 (guest) db oder nicht !
87 $current_user = [
88 'id' => 0,
89 'uname' => 'guest',
90 'roles' => 'guest',
91 'email' => '',
92 'name' => 'Guest',
93 'design' => 'default',
94 'color' => 'default',
95 'language' => 'de',
96 'edit' => 0
97 ];
98
99 if ($uid) {
100 $db = dbx()->get_system_obj('dbxDB');
101 $user_rec = $db->select1('dbxUser', $uid , verify_access: 0);
102
103 if (!is_array($user_rec) || empty($user_rec['id'])) {
104 $user_rec = array();
105 }
106
107 if (is_array($user_rec) && !empty($user_rec['id'])) {
108 $current_user = [
109 'id' => (int)$user_rec['id'],
110 'uname' => $user_rec['uname'],
111 'roles' => $user_rec['roles'],
112 'email' => $user_rec['email'],
113 'name' => $user_rec['name'],
114 'design' => $user_rec['design'],
115 'color' => $user_rec['color'],
116 'language' => $user_rec['language'],
117 'edit' => $user_rec['edit']
118 ];
119 }
120 }
121
122 dbx()->debug("###CURRENT-USER###", $current_user);
123 return $current_user;
124}
125
126
127
132 public function load_session() {
133 dbx()->timer('session-browser','Session browser');
134 $sok=false;
135 $oBrowser=dbx()->get_system_obj('dbxBrowser');
136 $ip = $oBrowser->_ip;
137 $host= $oBrowser->_host;
138 if (isset($_SESSION['dbx']['record'])) {
139 if (isset($_SESSION['dbx']['current_user']['id'])) {
140 $sok=1;
141 if ($_SESSION['dbx']['record']['ip'] != $ip ) $sok=false;
142 if ($_SESSION['dbx']['record']['host'] != $host) $sok=false;
143 }
144 }
145
146
147 if (!$sok) {
148 dbx()->timer('session-new','Session create new');
149 $_SESSION['dbx'] =$this->get_new_session(0);
150 dbx()->debug("#### Create new session #### ");
151 dbx()->timer('session-new');
152 }
153 $this->clean_session();
154
155
156
157 dbx()->timer('session-browser');
158 }
159 public function clean_session() {
160 $cache = dbx()->get_config('dbx','cache');
161 //$cache2 = dbx()->get_system_var('dbx_cache',0);
162 //dbx_debug("##clear session cache=($cache)");
163 $_SESSION['dbx']['tmp'] =array();
164 $_SESSION['dbx']['norep']=array();
165 if (!$cache) {
166 //dbx_debug("clear cache config");
167 $_SESSION['dbx']['config']=array();
168 $_SESSION['dbx']['cache']=array();
169 }
170 }
171
172 public function save_session($rec=1) {
173 $session_db=dbx()->get_config('dbx','session_db');
174 $session_db_guest=(int)dbx()->get_config('dbx','session_db_guest',0) === 1;
175 $uid=(int)dbx()->user();
176 $existingId=(int)($_SESSION['dbx']['record']['id'] ?? 0);
177 if ($session_db && !$session_db_guest && $uid <= 0 && $existingId <= 0) {
178 // PHP-Session, Warenkorb, Sprache und Workflow-Gastbindung bleiben
179 // unveraendert erhalten; lediglich der zentrale Session-DB-Datensatz
180 // wird fuer anonyme Seitenaufrufe nicht pro Request geschrieben.
181 dbx()->debug('#SESSION db guest write skipped');
182 return;
183 }
184 dbx()->debug("#SESSION db write =($session_db)");
185 if ($session_db) {
186
187
188 $install=dbx()->get_system_var('dbx_install',0);
189
190 $design =dbx()->get_system_var('dbx_activ_design','default');
191 $page =dbx()->get_system_var('dbx_activ_page','default');
192
193 $modul =dbx()->get_system_var('dbx_master_modul');
194 $run1 =dbx()->get_system_var('dbx_master_action');
195 $run2 =dbx()->get_system_var('dbx_run2', '');
196 $uid =dbx()->user();
197
198
199 if (isset($_SESSION['dbx']['record'])) {
200 $_SESSION['dbx']['record']['request_counter'] = ((int)($_SESSION['dbx']['record']['request_counter'] ?? 0)) + 1;
201 $_SESSION['dbx']['record']['request_last'] = (string)($_SESSION['dbx']['record']['request_current'] ?? '');
202 $_SESSION['dbx']['record']['request_current'] = $this->get_request();
203 $rec=$_SESSION['dbx']['record'];
204 $id =(int)($rec['id'] ?? 0);
205 } else {
206 $rec=array();
207 $id = 0;
208 }
209
210 //$this->apply_browser_to_record($rec);
211
212 $rec['update_date']=date('Y-m-d H:i:s');
213 $rec['create_uid'] =$uid;
214 $rec['update_uid'] =$uid;
215 $rec['owner'] =$uid;
216 $rec['userid'] =$uid;
217 $rec['design'] =$design;
218 $rec['page'] =$page;
219 $rec['modul'] =$modul;
220 $rec['run1'] =$run1;
221 $rec['run2'] =$run2;
222 $rec['color'] =dbx()->get_system_var('dbx_color','default');
223 $rec['language'] =dbx()->get_system_var('dbx_lng' ,'de');
224 $rec['edit'] =dbx()->get_system_var('dbx_edit' ,'0');
225
226
227
228 if (!$install && $session_db) {
229 $oDB=dbx()->get_system_obj('dbxDB');
230
231 //dbx_debug("#### SESSION SAVE ID=($id) User=($uid) rec=($id) #####",$rec);
232
233 $sessid = (string)($rec['sessid'] ?? '');
234
235 if ($id) {
236 $ok=$oDB->update('dbxSession',$rec,$id,0,1,0,0);
237 if (!$ok) {
238 $id=0;
239 } elseif ((int)($oDB->_update_count ?? 0) === 0 && (int)$oDB->count('dbxSession', "id=" . (int)$id) <= 0) {
240 $id=0;
241 }
242 }
243
244 if (!$id && $sessid !== '') {
245 $server = $oDB->get_dd_server('dbxSession');
246 $where = "sessid='" . $oDB->escape($sessid, $server) . "'";
247 $old = $oDB->select1('dbxSession', $where, array('id'), 0);
248 $oldId = is_array($old) ? (int)($old['id'] ?? 0) : 0;
249
250 if ($oldId > 0) {
251 $ok=$oDB->update('dbxSession',$rec,$oldId,0,1,0,0);
252 if ($ok) $id=$oldId;
253 }
254 }
255
256 if (!$id) { // new session
257 $ok=$oDB->insert('dbxSession',$rec,0,1,0,0);
258 $id=(int)$oDB->_insert_id;
259 }
260 }
261
262 $rec['id'] = (int)$id;
263 if (!$session_db_guest && (int)$uid <= 0) {
264 // Nach einem Logout wird der vorhandene Datensatz einmalig auf Gast
265 // gesetzt. Danach entstehen fuer diese Gast-Session keine Folgewrites.
266 $rec['id'] = 0;
267 }
268 $_SESSION['dbx']['record']=$rec;
269 dbx()->debug("#SESSIOM-PHP-ID",$_SESSION['dbx']['record']['id']);
270 } // session_db
271 }
272
280 public function is_ephemeral_anonymous_session_request(bool $publicCacheHit = false): bool {
281 $method = strtoupper((string)($_SERVER['REQUEST_METHOD'] ?? 'GET'));
282 if (!in_array($method, array('GET', 'HEAD'), true)) {
283 return false;
284 }
285 if ((int)dbx()->user() > 0) {
286 return false;
287 }
288
289 $sessionName = session_name();
290 $incomingSessionId = $sessionName !== ''
291 ? trim((string)($_COOKIE[$sessionName] ?? ''))
292 : '';
293 if ($incomingSessionId !== '') {
294 $activeSessionId = trim((string)session_id());
295 if ($activeSessionId !== '' && hash_equals($activeSessionId, $incomingSessionId)) {
296 return false;
297 }
298 }
299
300 // Ein Full-Page-Cache-Hit ist bereits als unpersonalisiert und tokenfrei
301 // verifiziert. Seine kurz gestartete PHP-Session wird niemals gebraucht.
302 if ($publicCacheHit) {
303 return true;
304 }
305
306 $browser = dbx()->get_system_obj('dbxBrowser');
307 return is_object($browser) && (int)($browser->_robot ?? 0) === 1;
308 }
309
316 public function discard_ephemeral_anonymous_session(bool $publicCacheHit = false): bool {
317 if (!$this->is_ephemeral_anonymous_session_request($publicCacheHit)) {
318 return false;
319 }
320
321 if (session_status() === PHP_SESSION_ACTIVE) {
322 $_SESSION = array();
323 session_destroy();
324 }
325
326 if (!headers_sent()) {
327 // session_start() hat fuer den cookie-losen Bot bereits eine PHPSESSID
328 // vorgemerkt. Der fluechtige Request darf sie nicht ausliefern.
329 header_remove('Set-Cookie');
330 }
331
332 dbx()->debug($publicCacheHit
333 ? '#SESSION ephemeral anonymous full-page-cache guest discarded'
334 : '#SESSION ephemeral anonymous robot discarded');
335 return true;
336 }
337
338
339
340 public function logout($userid,$kill=1) {
341 dbx()->debug("#SESSION# LOGOUT Kill=($kill) userid=($userid)");
342 dbx()->invalidate_action_tokens();
343
344 if (isset($_SESSION['dbx']['record'])) {
345 $_SESSION['dbx']['record']['owner'] = 0;
346 $_SESSION['dbx']['record']['userid'] = 0;
347 }
348 $_SESSION['dbx']['current_user']=$this->get_current_user(0);
349
350 if ($kill) $GLOBALS['dbx_session_destroy_pending'] = 1;
351 }
352
353 public function destroy_php_session() {
354 $GLOBALS['dbx_session_destroyed'] = 1;
355
356 if (session_status() === PHP_SESSION_ACTIVE) {
357 $_SESSION = array();
358
359 if (ini_get('session.use_cookies')) {
360 $params = session_get_cookie_params();
361 setcookie(
362 session_name(),
363 '',
364 time() - 42000,
365 $params['path'] ?? '/',
366 $params['domain'] ?? '',
367 $params['secure'] ?? false,
368 $params['httponly'] ?? false
369 );
370 }
371
372 session_destroy();
373 }
374
375 dbx_delete_cookie('dbXwebApp');
376 }
377
378 public function login($uid,$remember=0) {
379 dbx()->debug("#SESSION# LOGIN");
380 if (session_status() === PHP_SESSION_ACTIVE && !headers_sent()) {
381 session_regenerate_id(true);
382 }
383 dbx()->invalidate_action_tokens();
384 $new_sessid =$this->get_new_session_id($uid);
385 $current_user=$this->get_current_user($uid);
386 $_SESSION['dbx']['record']['owner'] = $uid;
387 $_SESSION['dbx']['record']['userid'] = $uid;
388 $_SESSION['dbx']['record']['update_uid'] = $uid;
389 $_SESSION['dbx']['record']['create_uid'] = $uid;
390 $_SESSION['dbx']['record']['sessid'] = $new_sessid;
391 $_SESSION['dbx']['current_user'] = $current_user;
392 //$_SESSION=array();
393 if ($remember) dbx()->set_cookie_var('dbXwebApp','session_id',$new_sessid); // #ToDo
394 dbx()->debug("#SESSION# LOGIN ($uid) Sessid=($new_sessid)",);
395
396 }
397
398
399} // Class
dbxSession
Summary of dbxSession.
Definition include/dbxSession.class.php:6
dbxSession\get_new_session
Private get_new_session($uid)
Definition include/dbxSession.class.php:23
dbxSession\discard_ephemeral_anonymous_session
discard_ephemeral_anonymous_session(bool $publicCacheHit=false)
Entfernt die nur fuer den aktuellen Robot-Request benoetigte PHP-Session.
Definition include/dbxSession.class.php:316
dbxSession\login
login($uid, $remember=0)
Definition include/dbxSession.class.php:378
dbxSession\is_ephemeral_anonymous_session_request
is_ephemeral_anonymous_session_request(bool $publicCacheHit=false)
Erkennt eine fluechtige Robot-Session ohne eingehenden Session-Cookie.
Definition include/dbxSession.class.php:280
dbxSession\logout
logout($userid, $kill=1)
Definition include/dbxSession.class.php:340
dbxSession\load_session
load_session()
Summary of load_session.
Definition include/dbxSession.class.php:132
dbxSession\get_new_session_id
Private get_new_session_id($uid)
Definition include/dbxSession.class.php:15
$ok
$ok
Definition configure_docs_access_20260728.php:90
$_SESSION
$_SESSION
Definition dbxActionTokenAutomation_test.php:11
user
user($key='id')
Liest einen Wert des aktuellen Benutzers.
Definition dbxApi.php:1305
dbx
dbx()
Liefert die zentrale dbXapp-API als Singleton.
Definition dbxApi.php:2805
dbx_delete_cookie
dbx_delete_cookie($cookie)
Definition dbxApi.php:3489
$method
$method
Definition dbxApi_head_response_test.php:7
$_SERVER
$_SERVER['REQUEST_METHOD']
Definition dbxApi_head_response_test.php:10
$config
if($resolved !==$expectedBase . 'files/test/') $config
Definition dbxApi_paths_test.php:35
$db
$db
Definition dbxDB_dd_server_binding_test.php:52
$server
$server
Definition dbxDB_dynamic_reconnect_test.php:20
$GLOBALS
$GLOBALS['dbxMissingResourcesTestApi']
Definition dbxMissingResources_test.php:24
$_COOKIE
$_COOKIE
Definition dbxSession_ephemeral_guest_test.php:43
$session
$session
Definition dbxSession_ephemeral_guest_test.php:41
$design
if(trim($second) !=='second') $design
Definition dbxTPL_raw_cache_test.php:118
if
if(!defined( 'IMG_WEBP')) define( 'IMG_WEBP'
Definition dbxUpload.class.php:30
dbx
DBX schema administration.
$page
if($cinematic===''||!str_contains($cinematic, 'data-dbx-cinema')) $page
Definition update_docs_home_cinematic_20260728.php:38