aboutsummaryrefslogtreecommitdiffstats
path: root/lib/private/Session
diff options
context:
space:
mode:
Diffstat (limited to 'lib/private/Session')
-rw-r--r--lib/private/Session/CryptoSessionData.php28
-rw-r--r--lib/private/Session/CryptoWrapper.php77
-rw-r--r--lib/private/Session/Internal.php66
-rw-r--r--lib/private/Session/Memory.php33
-rw-r--r--lib/private/Session/Session.php35
5 files changed, 68 insertions, 171 deletions
diff --git a/lib/private/Session/CryptoSessionData.php b/lib/private/Session/CryptoSessionData.php
index 22d2aba0405..323253af534 100644
--- a/lib/private/Session/CryptoSessionData.php
+++ b/lib/private/Session/CryptoSessionData.php
@@ -1,31 +1,10 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Victor Dubiniuk <dubiniuk@owncloud.com>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
@@ -39,6 +18,7 @@ use function OCP\Log\logger;
* Class CryptoSessionData
*
* @package OC\Session
+ * @template-implements \ArrayAccess<string,mixed>
*/
class CryptoSessionData implements \ArrayAccess, ISession {
/** @var ISession */
diff --git a/lib/private/Session/CryptoWrapper.php b/lib/private/Session/CryptoWrapper.php
index 5004ebf82cf..40c2ba6adf3 100644
--- a/lib/private/Session/CryptoWrapper.php
+++ b/lib/private/Session/CryptoWrapper.php
@@ -1,31 +1,15 @@
<?php
+
+declare(strict_types=1);
+
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Phil Davis <phil.davis@inf.org>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
+
namespace OC\Session;
-use OCP\IConfig;
use OCP\IRequest;
use OCP\ISession;
use OCP\Security\ICrypto;
@@ -48,37 +32,19 @@ use OCP\Security\ISecureRandom;
* @package OC\Session
*/
class CryptoWrapper {
+ /** @var string */
public const COOKIE_NAME = 'oc_sessionPassphrase';
- /** @var IConfig */
- protected $config;
- /** @var ISession */
- protected $session;
- /** @var ICrypto */
- protected $crypto;
- /** @var ISecureRandom */
- protected $random;
- /** @var string */
- protected $passphrase;
+ protected string $passphrase;
- /**
- * @param IConfig $config
- * @param ICrypto $crypto
- * @param ISecureRandom $random
- * @param IRequest $request
- */
- public function __construct(IConfig $config,
- ICrypto $crypto,
+ public function __construct(
+ protected ICrypto $crypto,
ISecureRandom $random,
- IRequest $request) {
- $this->crypto = $crypto;
- $this->config = $config;
- $this->random = $random;
-
- if (!is_null($request->getCookie(self::COOKIE_NAME))) {
- $this->passphrase = $request->getCookie(self::COOKIE_NAME);
- } else {
- $this->passphrase = $this->random->generate(128);
+ IRequest $request,
+ ) {
+ $passphrase = $request->getCookie(self::COOKIE_NAME);
+ if ($passphrase === null) {
+ $passphrase = $random->generate(128);
$secureCookie = $request->getServerProtocol() === 'https';
// FIXME: Required for CI
if (!defined('PHPUNIT_RUN')) {
@@ -89,11 +55,11 @@ class CryptoWrapper {
setcookie(
self::COOKIE_NAME,
- $this->passphrase,
+ $passphrase,
[
'expires' => 0,
'path' => $webRoot,
- 'domain' => '',
+ 'domain' => \OCP\Server::get(\OCP\IConfig::class)->getSystemValueString('cookie_domain'),
'secure' => $secureCookie,
'httponly' => true,
'samesite' => 'Lax',
@@ -101,13 +67,10 @@ class CryptoWrapper {
);
}
}
+ $this->passphrase = $passphrase;
}
- /**
- * @param ISession $session
- * @return ISession
- */
- public function wrapSession(ISession $session) {
+ public function wrapSession(ISession $session): ISession {
if (!($session instanceof CryptoSessionData)) {
return new CryptoSessionData($session, $this->crypto, $this->passphrase);
}
diff --git a/lib/private/Session/Internal.php b/lib/private/Session/Internal.php
index 5fb9b05c5f4..b465bcd3eda 100644
--- a/lib/private/Session/Internal.php
+++ b/lib/private/Session/Internal.php
@@ -3,39 +3,19 @@
declare(strict_types=1);
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
- * @author cetra3 <peter@parashift.com.au>
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author MartB <mart.b@outlook.de>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- * @author Victor Dubiniuk <dubiniuk@owncloud.com>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
use OC\Authentication\Token\IProvider;
use OCP\Authentication\Exceptions\InvalidTokenException;
+use OCP\ILogger;
use OCP\Session\Exceptions\SessionNotAvailableException;
+use Psr\Log\LoggerInterface;
+use function call_user_func_array;
+use function microtime;
/**
* Class Internal
@@ -49,9 +29,13 @@ class Internal extends Session {
* @param string $name
* @throws \Exception
*/
- public function __construct(string $name) {
+ public function __construct(
+ string $name,
+ private ?LoggerInterface $logger,
+ ) {
set_error_handler([$this, 'trapError']);
$this->invoke('session_name', [$name]);
+ $this->invoke('session_cache_limiter', ['']);
try {
$this->startSession();
} catch (\Exception $e) {
@@ -121,7 +105,7 @@ class Internal extends Session {
* Wrapper around session_regenerate_id
*
* @param bool $deleteOldSession Whether to delete the old associated session file or not.
- * @param bool $updateToken Wheater to update the associated auth token
+ * @param bool $updateToken Whether to update the associated auth token
* @return void
*/
public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
@@ -207,11 +191,31 @@ class Internal extends Session {
*/
private function invoke(string $functionName, array $parameters = [], bool $silence = false) {
try {
+ $timeBefore = microtime(true);
if ($silence) {
- return @call_user_func_array($functionName, $parameters);
+ $result = @call_user_func_array($functionName, $parameters);
} else {
- return call_user_func_array($functionName, $parameters);
+ $result = call_user_func_array($functionName, $parameters);
+ }
+ $timeAfter = microtime(true);
+ $timeSpent = $timeAfter - $timeBefore;
+ if ($timeSpent > 0.1) {
+ $logLevel = match (true) {
+ $timeSpent > 25 => ILogger::ERROR,
+ $timeSpent > 10 => ILogger::WARN,
+ $timeSpent > 0.5 => ILogger::INFO,
+ default => ILogger::DEBUG,
+ };
+ $this->logger?->log(
+ $logLevel,
+ "Slow session operation $functionName detected",
+ [
+ 'parameters' => $parameters,
+ 'timeSpent' => $timeSpent,
+ ],
+ );
}
+ return $result;
} catch (\Error $e) {
$this->trapError($e->getCode(), $e->getMessage());
}
diff --git a/lib/private/Session/Memory.php b/lib/private/Session/Memory.php
index fe71ec77692..395711836f5 100644
--- a/lib/private/Session/Memory.php
+++ b/lib/private/Session/Memory.php
@@ -1,32 +1,10 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Jörn Friedrich Dreyer <jfd@butonic.de>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
@@ -42,11 +20,6 @@ use OCP\Session\Exceptions\SessionNotAvailableException;
class Memory extends Session {
protected $data;
- public function __construct(string $name) {
- //no need to use $name since all data is already scoped to this instance
- $this->data = [];
- }
-
/**
* @param string $key
* @param integer $value
diff --git a/lib/private/Session/Session.php b/lib/private/Session/Session.php
index b434461a335..b7510b63683 100644
--- a/lib/private/Session/Session.php
+++ b/lib/private/Session/Session.php
@@ -1,34 +1,18 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
use OCP\ISession;
+/**
+ * @template-implements \ArrayAccess<string,mixed>
+ */
abstract class Session implements \ArrayAccess, ISession {
/**
* @var bool
@@ -36,13 +20,6 @@ abstract class Session implements \ArrayAccess, ISession {
protected $sessionClosed = false;
/**
- * $name serves as a namespace for the session keys
- *
- * @param string $name
- */
- abstract public function __construct(string $name);
-
- /**
* @param mixed $offset
* @return bool
*/
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-16 12:30:45 +0000