tweet_live: comparison web/lib/Zend/Session.php

equal deleted inserted replaced

-:5e7a0fedabdf
+:877f952ae2bd
 * obtain it through the world-wide-web, please send an email
 * to license@zend.com so we can send you a copy immediately.
 *
 * @category   Zend
 * @package    Zend_Session
-* @copyright  Copyright (c) 2005-2010 Zend Technologies USA Inc. (http://www.zend.com)
+* @copyright  Copyright (c) 2005-2012 Zend Technologies USA Inc. (http://www.zend.com)
 * @license    http://framework.zend.com/license/new-bsd     New BSD License
-* @version    $Id: Session.php 22587 2010-07-16 20:14:18Z ralph $
+* @version    $Id: Session.php 25121 2012-11-13 21:51:23Z matthew $
 * @since      Preview Release 0.2
 */
 /**
 /**
 * Zend_Session
 *
 * @category   Zend
 * @package    Zend_Session
-* @copyright  Copyright (c) 2005-2010 Zend Technologies USA Inc. (http://www.zend.com)
+* @copyright  Copyright (c) 2005-2012 Zend Technologies USA Inc. (http://www.zend.com)
 * @license    http://framework.zend.com/license/new-bsd     New BSD License
 */
 class Zend_Session extends Zend_Session_Abstract
 {
 /**
 require_once 'Zend/Session/Exception.php';
 throw new Zend_Session_Exception("You must call " . __CLASS__ . '::' . __FUNCTION__ .
 "() before any output has been sent to the browser; output started in {$filename}/{$linenum}");
 }
-if (self::$_sessionStarted && self::$_regenerateIdState <= 0) {
+if ( !self::$_sessionStarted ) {
+self::$_regenerateIdState = -1;
+} else {
 if (!self::$_unitTestEnabled) {
 session_regenerate_id(true);
 }
 self::$_regenerateIdState = 1;
-} else {
-/**
-* @todo If we can detect that this requester had no session previously,
-*       then why regenerate the id before the session has started?
-*       Feedback wanted for:
-//
-if (isset($_COOKIE[session_name()]) || (!use only cookies && isset($_REQUEST[session_name()]))) {
-self::$_regenerateIdState = 1;
-} else {
-self::$_regenerateIdState = -1;
-}
-//*/
-self::$_regenerateIdState = -1;
 }
 }
 /**
 * rememberMe() - Write a persistent cookie that expires after a number of seconds in the future. If no number of
 * seconds is specified, then this defaults to self::$_rememberMeSeconds.  Due to clock errors on end users' systems,
 * large values are recommended to avoid undesirable expiration of session cookies.
 *
-* @param $seconds integer - OPTIONAL specifies TTL for cookie in seconds from present time
+* @param int $seconds OPTIONAL specifies TTL for cookie in seconds from present time
 * @return void
 */
 public static function rememberMe($seconds = null)
 {
 $seconds = (int) $seconds;
 *
 * @return bool
 */
 public static function sessionExists()
 {
-if (ini_get('session.use_cookies') == '1' && isset($_COOKIE[session_name()])) {
+if ((bool)ini_get('session.use_cookies') == true && isset($_COOKIE[session_name()])) {
 return true;
-} elseif (!empty($_REQUEST[session_name()])) {
+} elseif ((bool)ini_get('session.use_only_cookies') == false && isset($_REQUEST[session_name()])) {
 return true;
 } elseif (self::$_unitTestEnabled) {
 return true;
 }
 * @throws Zend_Session_Exception
 * @return void
 */
 public static function start($options = false)
 {
+// Check to see if we've been passed an invalid session ID
+if ( self::getId() && !self::_checkId(self::getId()) ) {
+// Generate a valid, temporary replacement
+self::setId(md5(self::getId()));
+// Force a regenerate after session is started
+self::$_regenerateIdState = -1;
+}
 if (self::$_sessionStarted && self::$_destroyed) {
 require_once 'Zend/Session/Exception.php';
 throw new Zend_Session_Exception('The session was explicitly destroyed during this request, attempting to re-start is not allowed.');
 }
 if (isset($_SESSION['__ZF']['VALID'])) {
 self::_processValidators();
 }
 self::_processStartupMetadataGlobal();
+}
+/**
+* Perform a hash-bits check on the session ID
+*
+* @param string $id Session ID
+* @return bool
+*/
+protected static function _checkId($id)
+{
+$saveHandler = ini_get('session.save_handler');
+if ($saveHandler == 'cluster') { // Zend Server SC, validate only after last dash
+$dashPos = strrpos($id, '-');
+if ($dashPos) {
+$id = substr($id, $dashPos + 1);
+}
+}
+$hashBitsPerChar = ini_get('session.hash_bits_per_character');
+if (!$hashBitsPerChar) {
+$hashBitsPerChar = 5; // the default value
+}
+switch($hashBitsPerChar) {
+case 4: $pattern = '^[0-9a-f]*$'; break;
+case 5: $pattern = '^[0-9a-v]*$'; break;
+case 6: $pattern = '^[0-9a-zA-Z-,]*$'; break;
+}
+return preg_match('#'.$pattern.'#', $id);
 }
 /**
 * _processGlobalMetadata() - this method initizes the sessions GLOBAL
 }
 unset($_SESSION['__ZF'][$namespace]['ENVGH'][$variable]);
 }
 }
 if (empty($_SESSION['__ZF'][$namespace]['ENVGH'])) {
 unset($_SESSION['__ZF'][$namespace]['ENVGH']);
 }
 }
-}
+if (isset($namespace) && empty($_SESSION['__ZF'][$namespace])) {
-if (isset($namespace) && empty($_SESSION['__ZF'][$namespace])) {
+unset($_SESSION['__ZF'][$namespace]);
-unset($_SESSION['__ZF'][$namespace]);
+}
 }
 }
 if (isset($_SESSION['__ZF']) && empty($_SESSION['__ZF'])) {
 unset($_SESSION['__ZF']);

changeset 807	877f952ae2bd
parent 207	621fa6caec0c
child 1230	68c69c656a2c