forked from shaarli/Shaarli
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Relates to shaarli#324 Added: - `SessionManager` class to group session-related features - unit tests Changed: - `getToken()` -> `SessionManager->generateToken()` - `tokenOk()` -> `SessionManager->checkToken()` - inject a `$token` parameter to `PageBuilder`'s constructor Signed-off-by: VirtualTam <[email protected]>
- Loading branch information
1 parent
e648f62
commit ebd650c
Showing
4 changed files
with
153 additions
and
49 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| <?php | ||
| namespace Shaarli; | ||
|
|
||
| /** | ||
| * Manages the server-side session | ||
| */ | ||
| class SessionManager | ||
| { | ||
| protected $session = []; | ||
|
|
||
| /** | ||
| * Constructor | ||
| * | ||
| * @param array $session The $_SESSION array (reference) | ||
| * @param ConfigManager $conf ConfigManager instance (reference) | ||
| */ | ||
| public function __construct(& $session, & $conf) | ||
| { | ||
| $this->session = &$session; | ||
| $this->conf = &$conf; | ||
| } | ||
|
|
||
| /** | ||
| * Generates a session token | ||
| * | ||
| * @return string token | ||
| */ | ||
| public function generateToken() | ||
| { | ||
| $token = sha1(uniqid('', true) .'_'. mt_rand() . $this->conf->get('credentials.salt')); | ||
| $this->session['tokens'][$token] = 1; | ||
| return $token; | ||
| } | ||
|
|
||
| /** | ||
| * Checks the validity of a session token, and destroys it afterwards | ||
| * | ||
| * @param string $token The token to check | ||
| * | ||
| * @return bool true if the token is valid, else false | ||
| */ | ||
| public function checkToken($token) | ||
| { | ||
| if (! isset($this->session['tokens'][$token])) { | ||
| // the token is wrong, or has already been used | ||
| return false; | ||
| } | ||
|
|
||
| // destroy the token to prevent future use | ||
| unset($this->session['tokens'][$token]); | ||
| return true; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| <?php | ||
| namespace Shaarli; | ||
|
|
||
| use \PHPUnit\Framework\TestCase; | ||
|
|
||
| /** | ||
| * Fake ConfigManager | ||
| */ | ||
| class FakeConfigManager | ||
| { | ||
| public static function get($key) | ||
| { | ||
| return $key; | ||
| } | ||
| } | ||
|
|
||
|
|
||
| /** | ||
| * Test coverage for SessionManager | ||
| */ | ||
| class SessionManagerTest extends TestCase | ||
| { | ||
| /** | ||
| * Generate a session token | ||
| */ | ||
| public function testGenerateToken() | ||
| { | ||
| $session = []; | ||
| $conf = new FakeConfigManager(); | ||
| $sessionManager = new SessionManager($session, $conf); | ||
|
|
||
| $token = $sessionManager->generateToken(); | ||
|
|
||
| $this->assertEquals(1, $session['tokens'][$token]); | ||
| $this->assertEquals(40, strlen($token)); | ||
| } | ||
|
|
||
| /** | ||
| * Generate and check a session token | ||
| */ | ||
| public function testGenerateAndCheckToken() | ||
| { | ||
| $session = []; | ||
| $conf = new FakeConfigManager(); | ||
| $sessionManager = new SessionManager($session, $conf); | ||
|
|
||
| $token = $sessionManager->generateToken(); | ||
|
|
||
| // ensure a token has been generated | ||
| $this->assertEquals(1, $session['tokens'][$token]); | ||
| $this->assertEquals(40, strlen($token)); | ||
|
|
||
| // check and destroy the token | ||
| $this->assertTrue($sessionManager->checkToken($token)); | ||
| $this->assertFalse(isset($session['tokens'][$token])); | ||
|
|
||
| // ensure the token has been destroyed | ||
| $this->assertFalse($sessionManager->checkToken($token)); | ||
| } | ||
|
|
||
| /** | ||
| * Check an invalid session token | ||
| */ | ||
| public function testCheckInvalidToken() | ||
| { | ||
| $session = []; | ||
| $conf = new FakeConfigManager(); | ||
| $sessionManager = new SessionManager($session, $conf); | ||
|
|
||
| $this->assertFalse($sessionManager->checkToken('4dccc3a45ad9d03e5542b90c37d8db6d10f2b38b')); | ||
| } | ||
| } |