Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

session id validation when using php7.1 #372

Merged
merged 8 commits into from
Jan 19, 2017
Merged

session id validation when using php7.1 #372

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
14ed8d9
php7.1 session key length fix
Jan 18, 2017
7e07cb9
session function comments fix
Jan 18, 2017
b2cba8d
session function comments fix
Jan 18, 2017
cebc5bc
php7.1 session key length fix
Jan 18, 2017
1acaa67
php7.1 session key length fix
Jan 18, 2017
5beecd7
php7.1 session key length fix
Jan 18, 2017
c198b06
php7.1 session key length fix
Jan 18, 2017
cab349e
php7.1 session key length fix
Jan 18, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 82 additions & 5 deletions system/Session/Session.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,8 @@ class Session implements SessionInterface
*/
protected $cookieSecure = false;

protected $sidRegexp;

/**
* Logger instance to record error messages and awarnings.
* @var \PSR\Log\LoggerInterface
Expand Down Expand Up @@ -199,9 +201,9 @@ public function start()

$this->setSaveHandler();

// Sanitize the cookie, because apparently PHP doesn't do that for userspace handlers
// Sanitize the cookie, because apparently PHP doesn't do that for userspace handlers
if (isset($_COOKIE[$this->sessionCookieName]) && (
! is_string($_COOKIE[$this->sessionCookieName]) || ! preg_match('/^[0-9a-f]{40}$/', $_COOKIE[$this->sessionCookieName])
! is_string($_COOKIE[$this->sessionCookieName]) || ! preg_match('#\A'.$this->sidRegexp.'\z#', $_COOKIE[$this->sessionCookieName])
)
)
{
Expand Down Expand Up @@ -301,8 +303,83 @@ protected function configure()
ini_set('session.use_strict_mode', 1);
ini_set('session.use_cookies', 1);
ini_set('session.use_only_cookies', 1);
ini_set('session.hash_function', 1);
ini_set('session.hash_bits_per_character', 4);

$this->configureSidLength();
}

// ------------------------------------------------------------------------

/**
* Configure session ID length
*
* To make life easier, we used to force SHA-1 and 4 bits per
* character on everyone. And of course, someone was unhappy.
*
* Then PHP 7.1 broke backwards-compatibility because ext/session
* is such a mess that nobody wants to touch it with a pole stick,
* and the one guy who does, nobody has the energy to argue with.
*
* So we were forced to make changes, and OF COURSE something was
* going to break and now we have this pile of shit. -- Narf
*
* @return void
*/
protected function configureSidLength()
{
if (PHP_VERSION_ID < 70100)
{
$bits = 160;
$hash_function = ini_get('session.hash_function');
if (ctype_digit($hash_function))
{
if ($hash_function !== '1')
{
ini_set('session.hash_function', 1);
$bits = 160;
}
}
elseif ( ! in_array($hash_function, hash_algos(), true))
{
ini_set('session.hash_function', 1);
$bits = 160;
}
elseif (($bits = strlen(hash($hash_function, 'dummy', false)) * 4) < 160)
{
ini_set('session.hash_function', 1);
$bits = 160;
}

$bits_per_character = (int) ini_get('session.hash_bits_per_character');
$sid_length = (int) ceil($bits / $bits_per_character);
}
else
{
$bits_per_character = (int) ini_get('session.sid_bits_per_character');
$sid_length = (int) ini_get('session.sid_length');
if (($sid_length * $bits_per_character) < 160)
{
$bits = ($sid_length * $bits_per_character);
// Add as many more characters as necessary to reach at least 160 bits
$sid_length += (int) ceil((160 % $bits) / $bits_per_character);
ini_set('session.sid_length', $sid_length);
}
}

// Yes, 4,5,6 are the only known possible values as of 2016-10-27
switch ($bits_per_character)
{
case 4:
$this->sidRegexp = '[0-9a-f]';
break;
case 5:
$this->sidRegexp = '[0-9a-v]';
break;
case 6:
$this->sidRegexp = '[0-9a-zA-Z,-]';
break;
}

$this->sidRegexp .= '{'.$sid_length.'}';
}

//--------------------------------------------------------------------
Expand Down Expand Up @@ -884,4 +961,4 @@ protected function setCookie()
}

//--------------------------------------------------------------------
}
}