mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-02-06 20:41:17 -05:00
84492f29b1
* If token is present do token based auth and do not do anything with session * update HostController. Use config constants, don't use sessions * Remove Session from the components list * spacing * Remove Session from App Components list. * Move APIEnabled check to the api from auth.php * Rework auth. login using username and password only occurs on login action now. Including auth.php should not touch the session. auth_hash logins no longer touch the session. replace userLogin with a function called validateUser which matches the semantics of validateToken. * remove debugging * Add session storage if stateful query param is on, but only for LEGACY_API_AUTH * fix mUser to username, etc. * shuffle lines * use instead of session when generating auth hash. * Add docs regarding the use of cookies and stateful query param * Only open/close session if we are clearing a session var * Use zm_session_start instead of session_start * Should use zm_session_start instead of session_start * document that zm_session_start should be called previously to session_regenerate_id * Don't actually write out the session when generating auth hashes. Means they should never actually persist. * More backticking of SQL * add .. to fix #2686 * Use material icons for sort because they look nicer * fix typo * have to add authhash to session on login * restore username&password login for all urls * fix * fixes
76 lines
2.5 KiB
PHP
76 lines
2.5 KiB
PHP
<?php
|
|
// ZM session start function support timestamp management
|
|
function zm_session_start() {
|
|
// Make sure use_strict_mode is enabled.
|
|
// use_strict_mode is mandatory for security reasons.
|
|
ini_set('session.use_strict_mode', 1);
|
|
|
|
$currentCookieParams = session_get_cookie_params();
|
|
$currentCookieParams['lifetime'] = ZM_COOKIE_LIFETIME;
|
|
|
|
session_set_cookie_params(
|
|
$currentCookieParams['lifetime'],
|
|
$currentCookieParams['path'],
|
|
$currentCookieParams['domain'],
|
|
$currentCookieParams['secure'],
|
|
true
|
|
);
|
|
|
|
ini_set('session.name', 'ZMSESSID');
|
|
ZM\Logger::Debug('Setting cookie parameters to lifetime('.$currentCookieParams['lifetime'].') path('.$currentCookieParams['path'].') domain ('.$currentCookieParams['domain'].') secure('.$currentCookieParams['secure'].') httpOnly(1) name:'.session_name());
|
|
|
|
session_start();
|
|
$_SESSION['remoteAddr'] = $_SERVER['REMOTE_ADDR']; // To help prevent session hijacking
|
|
// Do not allow to use expired session ID
|
|
if ( !empty($_SESSION['last_time']) && ($_SESSION['last_time'] < (time() - 180)) ) {
|
|
ZM\Info('Destroying session due to timeout. ');
|
|
session_destroy();
|
|
session_start();
|
|
}
|
|
} // function zm_session_start()
|
|
|
|
// session regenerate id function
|
|
// Assumes that zm_session_start has been called previously
|
|
function zm_session_regenerate_id() {
|
|
if ( session_status() != PHP_SESSION_ACTIVE ) {
|
|
session_start();
|
|
}
|
|
|
|
// Set deleted timestamp. Session data must not be deleted immediately for reasons.
|
|
$_SESSION['last_time'] = time();
|
|
// Finish session
|
|
session_write_close();
|
|
|
|
session_start();
|
|
session_regenerate_id();
|
|
unset($_SESSION['last_time']);
|
|
} // function zm_session_regenerate_id()
|
|
|
|
function is_session_started() {
|
|
if ( php_sapi_name() !== 'cli' ) {
|
|
if ( version_compare(phpversion(), '5.4.0', '>=') ) {
|
|
return session_status() === PHP_SESSION_ACTIVE ? TRUE : FALSE;
|
|
} else {
|
|
return session_id() === '' ? FALSE : TRUE;
|
|
}
|
|
} else {
|
|
Warning("php_sapi_name === 'cli'");
|
|
}
|
|
return FALSE;
|
|
} // function is_session_started()
|
|
|
|
function zm_session_clear() {
|
|
session_start();
|
|
$_SESSION = array();
|
|
if ( ini_get('session.use_cookies') ) {
|
|
$p = session_get_cookie_params();
|
|
# Update the cookie to expire in the past.
|
|
setcookie(session_name(), '', time() - 31536000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
|
|
}
|
|
session_unset();
|
|
session_destroy();
|
|
session_write_close();
|
|
session_start();
|
|
} // function zm_session_clear()
|
|
?>
|