aboutsummaryrefslogtreecommitdiffstats
path: root/lib/private/Session
diff options
context:
space:
mode:
Diffstat (limited to 'lib/private/Session')
-rw-r--r--lib/private/Session/CryptoSessionData.php58
-rw-r--r--lib/private/Session/CryptoWrapper.php79
-rw-r--r--lib/private/Session/Internal.php80
-rw-r--r--lib/private/Session/Memory.php45
-rw-r--r--lib/private/Session/Session.php35
5 files changed, 93 insertions, 204 deletions
diff --git a/lib/private/Session/CryptoSessionData.php b/lib/private/Session/CryptoSessionData.php
index 1eb6987fc18..323253af534 100644
--- a/lib/private/Session/CryptoSessionData.php
+++ b/lib/private/Session/CryptoSessionData.php
@@ -1,42 +1,24 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Victor Dubiniuk <dubiniuk@owncloud.com>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
use OCP\ISession;
use OCP\Security\ICrypto;
use OCP\Session\Exceptions\SessionNotAvailableException;
+use function json_decode;
+use function OCP\Log\logger;
/**
* Class CryptoSessionData
*
* @package OC\Session
+ * @template-implements \ArrayAccess<string,mixed>
*/
class CryptoSessionData implements \ArrayAccess, ISession {
/** @var ISession */
@@ -57,8 +39,8 @@ class CryptoSessionData implements \ArrayAccess, ISession {
* @param string $passphrase
*/
public function __construct(ISession $session,
- ICrypto $crypto,
- string $passphrase) {
+ ICrypto $crypto,
+ string $passphrase) {
$this->crypto = $crypto;
$this->session = $session;
$this->passphrase = $passphrase;
@@ -79,14 +61,24 @@ class CryptoSessionData implements \ArrayAccess, ISession {
protected function initializeSession() {
$encryptedSessionData = $this->session->get(self::encryptedSessionName) ?: '';
- try {
- $this->sessionValues = json_decode(
- $this->crypto->decrypt($encryptedSessionData, $this->passphrase),
- true
- );
- } catch (\Exception $e) {
+ if ($encryptedSessionData === '') {
+ // Nothing to decrypt
$this->sessionValues = [];
- $this->regenerateId(true, false);
+ } else {
+ try {
+ $this->sessionValues = json_decode(
+ $this->crypto->decrypt($encryptedSessionData, $this->passphrase),
+ true,
+ 512,
+ JSON_THROW_ON_ERROR,
+ );
+ } catch (\Exception $e) {
+ logger('core')->critical('Could not decrypt or decode encrypted session data', [
+ 'exception' => $e,
+ ]);
+ $this->sessionValues = [];
+ $this->regenerateId(true, false);
+ }
}
}
diff --git a/lib/private/Session/CryptoWrapper.php b/lib/private/Session/CryptoWrapper.php
index e98aac3b8bf..40c2ba6adf3 100644
--- a/lib/private/Session/CryptoWrapper.php
+++ b/lib/private/Session/CryptoWrapper.php
@@ -1,31 +1,15 @@
<?php
+
+declare(strict_types=1);
+
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Phil Davis <phil.davis@inf.org>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
+
namespace OC\Session;
-use OCP\IConfig;
use OCP\IRequest;
use OCP\ISession;
use OCP\Security\ICrypto;
@@ -48,37 +32,19 @@ use OCP\Security\ISecureRandom;
* @package OC\Session
*/
class CryptoWrapper {
- public const COOKIE_NAME = 'oc_sessionPassphrase';
-
- /** @var IConfig */
- protected $config;
- /** @var ISession */
- protected $session;
- /** @var ICrypto */
- protected $crypto;
- /** @var ISecureRandom */
- protected $random;
/** @var string */
- protected $passphrase;
+ public const COOKIE_NAME = 'oc_sessionPassphrase';
- /**
- * @param IConfig $config
- * @param ICrypto $crypto
- * @param ISecureRandom $random
- * @param IRequest $request
- */
- public function __construct(IConfig $config,
- ICrypto $crypto,
- ISecureRandom $random,
- IRequest $request) {
- $this->crypto = $crypto;
- $this->config = $config;
- $this->random = $random;
+ protected string $passphrase;
- if (!is_null($request->getCookie(self::COOKIE_NAME))) {
- $this->passphrase = $request->getCookie(self::COOKIE_NAME);
- } else {
- $this->passphrase = $this->random->generate(128);
+ public function __construct(
+ protected ICrypto $crypto,
+ ISecureRandom $random,
+ IRequest $request,
+ ) {
+ $passphrase = $request->getCookie(self::COOKIE_NAME);
+ if ($passphrase === null) {
+ $passphrase = $random->generate(128);
$secureCookie = $request->getServerProtocol() === 'https';
// FIXME: Required for CI
if (!defined('PHPUNIT_RUN')) {
@@ -89,11 +55,11 @@ class CryptoWrapper {
setcookie(
self::COOKIE_NAME,
- $this->passphrase,
+ $passphrase,
[
'expires' => 0,
'path' => $webRoot,
- 'domain' => '',
+ 'domain' => \OCP\Server::get(\OCP\IConfig::class)->getSystemValueString('cookie_domain'),
'secure' => $secureCookie,
'httponly' => true,
'samesite' => 'Lax',
@@ -101,13 +67,10 @@ class CryptoWrapper {
);
}
}
+ $this->passphrase = $passphrase;
}
- /**
- * @param ISession $session
- * @return ISession
- */
- public function wrapSession(ISession $session) {
+ public function wrapSession(ISession $session): ISession {
if (!($session instanceof CryptoSessionData)) {
return new CryptoSessionData($session, $this->crypto, $this->passphrase);
}
diff --git a/lib/private/Session/Internal.php b/lib/private/Session/Internal.php
index 87dd5ed6014..b465bcd3eda 100644
--- a/lib/private/Session/Internal.php
+++ b/lib/private/Session/Internal.php
@@ -3,39 +3,19 @@
declare(strict_types=1);
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
- * @author cetra3 <peter@parashift.com.au>
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author MartB <mart.b@outlook.de>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- * @author Victor Dubiniuk <dubiniuk@owncloud.com>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
-use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Token\IProvider;
+use OCP\Authentication\Exceptions\InvalidTokenException;
+use OCP\ILogger;
use OCP\Session\Exceptions\SessionNotAvailableException;
+use Psr\Log\LoggerInterface;
+use function call_user_func_array;
+use function microtime;
/**
* Class Internal
@@ -49,9 +29,13 @@ class Internal extends Session {
* @param string $name
* @throws \Exception
*/
- public function __construct(string $name) {
+ public function __construct(
+ string $name,
+ private ?LoggerInterface $logger,
+ ) {
set_error_handler([$this, 'trapError']);
$this->invoke('session_name', [$name]);
+ $this->invoke('session_cache_limiter', ['']);
try {
$this->startSession();
} catch (\Exception $e) {
@@ -107,6 +91,7 @@ class Internal extends Session {
$this->reopen();
$this->invoke('session_unset');
$this->regenerateId();
+ $this->invoke('session_write_close');
$this->startSession(true);
$_SESSION = [];
}
@@ -120,7 +105,7 @@ class Internal extends Session {
* Wrapper around session_regenerate_id
*
* @param bool $deleteOldSession Whether to delete the old associated session file or not.
- * @param bool $updateToken Wheater to update the associated auth token
+ * @param bool $updateToken Whether to update the associated auth token
* @return void
*/
public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
@@ -148,7 +133,7 @@ class Internal extends Session {
$newId = $this->getId();
/** @var IProvider $tokenProvider */
- $tokenProvider = \OC::$server->query(IProvider::class);
+ $tokenProvider = \OCP\Server::get(IProvider::class);
try {
$tokenProvider->renewSessionToken($oldId, $newId);
@@ -198,15 +183,6 @@ class Internal extends Session {
}
/**
- * @throws \Exception
- */
- private function validateSession() {
- if ($this->sessionClosed) {
- throw new SessionNotAvailableException('Session has been closed - no further changes to the session are allowed');
- }
- }
-
- /**
* @param string $functionName the full session_* function name
* @param array $parameters
* @param bool $silence whether to suppress warnings
@@ -215,11 +191,31 @@ class Internal extends Session {
*/
private function invoke(string $functionName, array $parameters = [], bool $silence = false) {
try {
+ $timeBefore = microtime(true);
if ($silence) {
- return @call_user_func_array($functionName, $parameters);
+ $result = @call_user_func_array($functionName, $parameters);
} else {
- return call_user_func_array($functionName, $parameters);
+ $result = call_user_func_array($functionName, $parameters);
+ }
+ $timeAfter = microtime(true);
+ $timeSpent = $timeAfter - $timeBefore;
+ if ($timeSpent > 0.1) {
+ $logLevel = match (true) {
+ $timeSpent > 25 => ILogger::ERROR,
+ $timeSpent > 10 => ILogger::WARN,
+ $timeSpent > 0.5 => ILogger::INFO,
+ default => ILogger::DEBUG,
+ };
+ $this->logger?->log(
+ $logLevel,
+ "Slow session operation $functionName detected",
+ [
+ 'parameters' => $parameters,
+ 'timeSpent' => $timeSpent,
+ ],
+ );
}
+ return $result;
} catch (\Error $e) {
$this->trapError($e->getCode(), $e->getMessage());
}
diff --git a/lib/private/Session/Memory.php b/lib/private/Session/Memory.php
index b9b3dba54b7..395711836f5 100644
--- a/lib/private/Session/Memory.php
+++ b/lib/private/Session/Memory.php
@@ -1,36 +1,13 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Christoph Wurst <christoph@winzerhof-wurst.at>
- * @author Jörn Friedrich Dreyer <jfd@butonic.de>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
-use Exception;
use OCP\Session\Exceptions\SessionNotAvailableException;
/**
@@ -43,11 +20,6 @@ use OCP\Session\Exceptions\SessionNotAvailableException;
class Memory extends Session {
protected $data;
- public function __construct(string $name) {
- //no need to use $name since all data is already scoped to this instance
- $this->data = [];
- }
-
/**
* @param string $key
* @param integer $value
@@ -113,15 +85,4 @@ class Memory extends Session {
$this->sessionClosed = false;
return $reopened;
}
-
- /**
- * In case the session has already been locked an exception will be thrown
- *
- * @throws Exception
- */
- private function validateSession() {
- if ($this->sessionClosed) {
- throw new Exception('Session has been closed - no further changes to the session are allowed');
- }
- }
}
diff --git a/lib/private/Session/Session.php b/lib/private/Session/Session.php
index b434461a335..b7510b63683 100644
--- a/lib/private/Session/Session.php
+++ b/lib/private/Session/Session.php
@@ -1,34 +1,18 @@
<?php
declare(strict_types=1);
-
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author Thomas Müller <thomas.mueller@tmit.eu>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
namespace OC\Session;
use OCP\ISession;
+/**
+ * @template-implements \ArrayAccess<string,mixed>
+ */
abstract class Session implements \ArrayAccess, ISession {
/**
* @var bool
@@ -36,13 +20,6 @@ abstract class Session implements \ArrayAccess, ISession {
protected $sessionClosed = false;
/**
- * $name serves as a namespace for the session keys
- *
- * @param string $name
- */
- abstract public function __construct(string $name);
-
- /**
* @param mixed $offset
* @return bool
*/
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-15 12:06:41 +0000