Rev Author Line No. Line
250 kaklik 1 <?php
2 /* $Id: session.inc.php,v 2.8.2.4 2006/05/12 15:26:16 nijel Exp $ */
3 // vim: expandtab sw=4 ts=4 sts=4:
4 /**
5 * session handling
6 *
7 * @TODO add failover or warn if sessions are not configured properly
8 * @TODO add an option to use mm-module for session handler
9 * @see http://www.php.net/session
10 * @uses session_name()
11 * @uses session_start()
12 * @uses ini_set()
13 * @uses version_compare()
14 * @uses PHP_VERSION
15 */
16  
17 // verify if PHP supports session, die if it does not
18  
19 if (!@function_exists('session_name')) {
20 $cfg = array('DefaultLang' => 'en-iso-8859-1',
21 'AllowAnywhereRecoding' => false);
22 // Loads the language file
23 require_once('./libraries/select_lang.lib.php');
24 // Displays the error message
25 // (do not use &amp; for parameters sent by header)
26 header('Location: error.php'
27 . '?lang=' . urlencode($available_languages[$lang][2])
28 . '&char=' . urlencode($charset)
29 . '&dir=' . urlencode($text_dir)
30 . '&type=' . urlencode($strError)
31 . '&error=' . urlencode(sprintf($strCantLoad, 'session')));
32 exit();
33 } elseif (ini_get('session.auto_start') == true && session_name() != 'phpMyAdmin') {
34 /* $cfg = array('DefaultLang' => 'en-iso-8859-1',
35 'AllowAnywhereRecoding' => false);
36 // Loads the language file
37 require_once('./libraries/select_lang.lib.php');
38 // Displays the error message
39 // (do not use &amp; for parameters sent by header)
40 // TODO FIXME replace with locale string
41 $strSessionAutostartError = 'phpMyAdmin cannot run with'
42 . ' [a@http://php.net/session#ini.session.auto-start@php]session.auto_start[/a]'
43 . ' enabled. Check your php configuration.';
44 header('Location: error.php'
45 . '?lang=' . urlencode('en') //($available_languages[$lang][2])
46 . '&char=' . urlencode($charset)
47 . '&dir=' . urlencode('ltr') //($text_dir)
48 . '&type=' . urlencode('Error') //($strError)
49 . '&error=' . urlencode($strSessionAutostartError));
50 exit();
51 */
52 $_SESSION = array();
53 if (isset($_COOKIE[session_name()])) {
54 setcookie(session_name(), '', time()-42000, '/');
55 }
56 session_unset();
57 @session_destroy();
58 }
59  
60 // disable starting of sessions before all settings are done
61 // does not work, besides how it is written in php manual
62 //ini_set('session.auto_start', 0);
63  
64 // session cookie settings
65 session_set_cookie_params(0, PMA_Config::getCookiePath(),
66 '', PMA_Config::isHttps());
67  
68 // cookies are safer
69 ini_set('session.use_cookies', true);
70  
71 // but not all user allow cookies
72 ini_set('session.use_only_cookies', false);
73 ini_set('session.use_trans_sid', true);
74 ini_set('url_rewriter.tags',
75 'a=href,frame=src,input=src,form=fakeentry,fieldset=');
76 //ini_set('arg_separator.output', '&amp;');
77  
78 // delete session/cookies when browser is closed
79 ini_set('session.cookie_lifetime', 0);
80  
81 // warn but dont work with bug
82 ini_set('session.bug_compat_42', false);
83 ini_set('session.bug_compat_warn', true);
84  
85 // use more secure session ids (with PHP 5)
86 if (version_compare(PHP_VERSION, '5.0.0', 'ge')
87 && substr(PHP_OS, 0, 3) != 'WIN') {
88 ini_set('session.hash_function', 1);
89 ini_set('session.hash_bits_per_character', 6);
90 }
91  
92 // start the session
93 // on some servers (for example, sourceforge.net), we get a permission error
94 // on the session data directory, so I add some "@"
95  
96 // [2006-01-25] Nicola Asuni - www.tecnick.com: maybe the PHP directive
97 // session.save_handler is set to another value like "user"
98 ini_set('session.save_handler', 'files');
99  
100 @session_name('phpMyAdmin');
101 @session_start();
102  
103 /**
104 * Token which is used for authenticating access queries.
105 */
106 if (!isset($_SESSION['PMA_token'])) {
107 $_SESSION['PMA_token'] = md5(uniqid(rand(), true));
108 }
109  
110 /**
111 * trys to secure session from hijacking and fixation
112 * should be called before login and after successfull login
113 * (only required if sensitive information stored in session)
114 *
115 * @uses session_regenerate_id() to secure session from fixation
116 * @uses session_id() to set new session id
117 * @uses strip_tags() to prevent XSS attacks in SID
118 * @uses function_exists() for session_regenerate_id()
119 */
120 function PMA_secureSession()
121 {
122 // prevent session fixation and XSS
123 if (function_exists('session_regenerate_id')) {
124 session_regenerate_id(true);
125 } else {
126 session_id(strip_tags(session_id()));
127 }
128 }
129 ?>