phpmyadmin/libraries/session.inc.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * session handling
   5  *
   6  * @todo    add failover or warn if sessions are not configured properly
   7  * @todo    add an option to use mm-module for session handler
   8  *
   9  * @package PhpMyAdmin
  10  * @see     http://www.php.net/session
  11  */
  12 if (! defined('PHPMYADMIN')) {
  13     exit;
  14 }
  15
  16 // verify if PHP supports session, die if it does not
  17
  18 if (!@function_exists('session_name')) {
  19     PMA_warnMissingExtension('session', true);
  20 } elseif (ini_get('session.auto_start') == true && session_name() != 'phpMyAdmin') {
  21     // Do not delete the existing session, it might be used by other
  22     // applications; instead just close it.
  23     session_write_close();
  24 }
  25
  26 // disable starting of sessions before all settings are done
  27 // does not work, besides how it is written in php manual
  28 //ini_set('session.auto_start', 0);
  29
  30 // session cookie settings
  31 session_set_cookie_params(
  32     0, $GLOBALS['PMA_Config']->getCookiePath(),
  33     '', $GLOBALS['PMA_Config']->isHttps(), true
  34 );
  35
  36 // cookies are safer (use @ini_set() in case this function is disabled)
  37 @ini_set('session.use_cookies', true);
  38
  39 // optionally set session_save_path
  40 $path = $GLOBALS['PMA_Config']->get('SessionSavePath');
  41 if (!empty($path)) {
  42     session_save_path($path);
  43 }
  44
  45 // but not all user allow cookies
  46 @ini_set('session.use_only_cookies', false);
  47 // do not force transparent session ids, see bug #3398788
  48 //@ini_set('session.use_trans_sid', true);
  49 @ini_set(
  50     'url_rewriter.tags',
  51     'a=href,frame=src,input=src,form=fakeentry,fieldset='
  52 );
  53 //ini_set('arg_separator.output', '&amp;');
  54
  55 // delete session/cookies when browser is closed
  56 @ini_set('session.cookie_lifetime', 0);
  57
  58 // warn but dont work with bug
  59 @ini_set('session.bug_compat_42', false);
  60 @ini_set('session.bug_compat_warn', true);
  61
  62 // use more secure session ids
  63 @ini_set('session.hash_function', 1);
  64
  65 // some pages (e.g. stylesheet) may be cached on clients, but not in shared
  66 // proxy servers
  67 session_cache_limiter('private');
  68
  69 // start the session
  70 // on some servers (for example, sourceforge.net), we get a permission error
  71 // on the session data directory, so I add some "@"
  72
  73 // See bug #1538132. This would block normal behavior on a cluster
  74 //ini_set('session.save_handler', 'files');
  75
  76 $session_name = 'phpMyAdmin';
  77 @session_name($session_name);
  78
  79 if (! isset($_COOKIE[$session_name])) {
  80     // on first start of session we check for errors
  81     // f.e. session dir cannot be accessed - session file not created
  82     $orig_error_count = $GLOBALS['error_handler']->countErrors();
  83     $r = session_start();
  84     if ($r !== true
  85         || $orig_error_count != $GLOBALS['error_handler']->countErrors()
  86     ) {
  87         setcookie($session_name, '', 1);
  88         /*
  89          * Session initialization is done before selecting language, so we
  90          * can not use translations here.
  91          */
  92         PMA_fatalError('Cannot start session without errors, please check errors given in your PHP and/or webserver log file and configure your PHP installation properly. Also ensure that cookies are enabled in your browser.');
  93     }
  94     unset($orig_error_count);
  95 } else {
  96     session_start();
  97 }
  98
  99 /**
 100  * Token which is used for authenticating access queries.
 101  * (we use "space PMA_token space" to prevent overwriting)
 102  */
 103 if (! isset($_SESSION[' PMA_token '])) {
 104     $_SESSION[' PMA_token '] = md5(uniqid(rand(), true));
 105 }
 106
 107 /**
 108  * tries to secure session from hijacking and fixation
 109  * should be called before login and after successfull login
 110  * (only required if sensitive information stored in session)
 111  *
 112  * @return void
 113  */
 114 function PMA_secureSession()
 115 {
 116     // prevent session fixation and XSS
 117     session_regenerate_id(true);
 118     $_SESSION[' PMA_token '] = md5(uniqid(rand(), true));
 119 }
 120 ?>