SessionPhp.php (mrbs-1.9.4) | : | SessionPhp.php (mrbs-1.10.0) | ||
---|---|---|---|---|
<?php | <?php | |||
namespace MRBS\Session; | namespace MRBS\Session; | |||
use MRBS\User; | ||||
// Uses PHP's built-in session handling | // Uses PHP's built-in session handling | |||
class SessionPhp extends SessionWithLogin | class SessionPhp extends SessionWithLogin | |||
{ | { | |||
public function __construct() | public function __construct() | |||
{ | { | |||
global $auth; | global $auth; | |||
parent::__construct(); | parent::__construct(); | |||
skipping to change at line 34 | skipping to change at line 36 | |||
// Ajax requests don't count as activity, unless it's the special Ajax req uest used | // Ajax requests don't count as activity, unless it's the special Ajax req uest used | |||
// to record client side activity. | // to record client side activity. | |||
$activity = \MRBS\get_form_var('activity', 'int'); | $activity = \MRBS\get_form_var('activity', 'int'); | |||
if ($activity || !\MRBS\is_ajax() || !isset($_SESSION['LastActivity'])) | if ($activity || !\MRBS\is_ajax() || !isset($_SESSION['LastActivity'])) | |||
{ | { | |||
$_SESSION['LastActivity'] = time(); | $_SESSION['LastActivity'] = time(); | |||
} | } | |||
} | } | |||
} | } | |||
public function getCurrentUser() | public function getCurrentUser() : ?User | |||
{ | { | |||
return (isset($_SESSION['user'])) ? $_SESSION['user'] : null; | return (isset($_SESSION['user'])) ? $_SESSION['user'] : null; | |||
} | } | |||
protected function logonUser($username) | protected function logonUser(string $username) : void | |||
{ | { | |||
$user = \MRBS\auth()->getUser($username); | $user = \MRBS\auth()->getUser($username); | |||
// As a defence against session fixation, regenerate | // As a defence against session fixation, regenerate | |||
// the session id and delete the old session. | // the session id and delete the old session. | |||
session_regenerate_id(true); | session_regenerate_id(true); | |||
$_SESSION['user'] = $user; | $_SESSION['user'] = $user; | |||
// Problems have been reported on Windows IIS with session data not being | // Problems have been reported on Windows IIS with session data not being | |||
// written out without a call to session_write_close() | // written out without a call to session_write_close() | |||
session_write_close(); | session_write_close(); | |||
} | } | |||
public function logoffUser() | public function logoffUser() : void | |||
{ | { | |||
// Unset the session variables | // Unset the session variables | |||
session_unset(); | session_unset(); | |||
session_destroy(); | session_destroy(); | |||
// Problems have been reported on Windows IIS with session data not being | // Problems have been reported on Windows IIS with session data not being | |||
// written out without a call to session_write_close(). [Is this necessary | // written out without a call to session_write_close(). [Is this necessary | |||
// after session_destroy() ??] | // after session_destroy() ??] | |||
session_write_close(); | session_write_close(); | |||
} | } | |||
End of changes. 4 change blocks. | ||||
3 lines changed or deleted | 5 lines changed or added |