class.ilSessionControl.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2009 ILIAS open source, Extended GPL, see docs/LICENSE */


class ilSessionControl
{
    const INTERNAL_DEBUG = false;

    const DEFAULT_MAX_COUNT = 0;
    const DEFAULT_MIN_IDLE = 15;
    const DEFAULT_MAX_IDLE = 30;
    const DEFAULT_MAX_IDLE_AFTER_FIRST_REQUEST = 1;
    const DEFAULT_ALLOW_CLIENT_MAINTENANCE = 1;

    private static $setting_fields = array(
        'session_max_count',
        'session_min_idle',
        'session_max_idle',
        'session_max_idle_after_first_request',
        'session_allow_client_maintenance',
        'session_handling_type'
    );

    const SESSION_TYPE_UNKNOWN = 0;
    const SESSION_TYPE_SYSTEM = 1;
    const SESSION_TYPE_ADMIN = 2;
    const SESSION_TYPE_USER = 3;
    const SESSION_TYPE_ANONYM = 4;

    public static $session_types_controlled = array(
        self::SESSION_TYPE_USER,
        self::SESSION_TYPE_ANONYM
    );

    private static $session_types_not_controlled = array(
        self::SESSION_TYPE_UNKNOWN,
        self::SESSION_TYPE_SYSTEM,
        self::SESSION_TYPE_ADMIN
    );

    public static function checkExpiredSession()
    {
        global $DIC;

        $ilSetting = $DIC['ilSetting'];
        
        // do not check session in fixed duration mode
        if ($ilSetting->get('session_handling_type', 0) != 1) {
            return;
        }

        // check for expired sessions makes sense
        // only when public section is not enabled
        // because it is not possible to determine
        // wether the sid cookie relates to a session of an
        // authenticated user or a anonymous user
        // when the session dataset has allready been deleted

        if (!$ilSetting->get("pub_section")) {
            global $DIC;

            $lng = $DIC['lng'];

            $sid = null;

            if (!isset($_COOKIE[session_name()]) || !strlen($_COOKIE[session_name()])) {
                self::debug('Browser did not send a sid cookie');
            } else {
                $sid = $_COOKIE[session_name()];

                self::debug('Browser sent sid cookie with value (' . $sid . ')');

                if (!self::isValidSession($sid)) {
                    self::debug('remove session cookie for (' . $sid . ') and trigger event');

                    // raw data will be updated (later) with garbage collection [destroyExpired()]
                    
                    self::removeSessionCookie();

                    // Trigger expiredSessionDetected  Event
                    global $DIC;

                    $ilAppEventHandler = $DIC['ilAppEventHandler'];
                    $ilAppEventHandler->raise(
                        'Services/Authentication',
                        'expiredSessionDetected',
                        array()
                    );

                    ilUtil::redirect('login.php?expired=true' . '&target=' . $_GET['target']);
                }
            }
        }
    }

    public static function initSession()
    {
        global $DIC;

        $ilSetting = $DIC['ilSetting'];
        
        // do not init session type in fixed duration mode
        if ($ilSetting->get('session_handling_type', 0) != 1) {
            return;
        }
        
        if (!isset($_SESSION['SessionType'])) {
            $_SESSION['SessionType'] = self::SESSION_TYPE_UNKNOWN;
            self::debug(__METHOD__ . " --> init session with type (" . $_SESSION['SessionType'] . ")");
        } else {
            self::debug(__METHOD__ . " --> keep sessions type on (" . $_SESSION['SessionType'] . ")");
        }
    }

    public static function handleLoginEvent($a_login, ilAuthSession $auth_session)
    {
        global $DIC;

        $ilSetting = $DIC['ilSetting'];
        
        require_once 'Services/User/classes/class.ilObjUser.php';
        $user_id = ilObjUser::_lookupId($a_login);

        // we need the session type for the session statistics
        // regardless of the current session handling type
        switch (true) {
            case isset($_ENV['SHELL']):
                $type = self::SESSION_TYPE_SYSTEM;
                break;

            case $user_id == ANONYMOUS_USER_ID:
                $type = self::SESSION_TYPE_ANONYM;
                break;

            case self::checkAdministrationPermission($user_id):
                $type = self::SESSION_TYPE_ADMIN;
                break;

            default:
                $type = self::SESSION_TYPE_USER;
                break;
        }
        
        $_SESSION['SessionType'] = $type;
        self::debug(__METHOD__ . " --> update sessions type to (" . $type . ")");
                
        // do not handle login event in fixed duration mode
        if ($ilSetting->get('session_handling_type', 0) != 1) {
            return true;
        }
                
        if (in_array($type, self::$session_types_controlled)) {
            return self::checkCurrentSessionIsAllowed($auth_session, $user_id);
        }
    }

    public static function handleLogoutEvent()
    {
        global $DIC;

        $ilSetting = $DIC['ilSetting'];
        
        // do not handle logout event in fixed duration mode
        if ($ilSetting->get('session_handling_type', 0) != 1) {
            return;
        }
        
        $_SESSION['SessionType'] = self::SESSION_TYPE_UNKNOWN;
        self::debug(__METHOD__ . " --> reset sessions type to (" . $_SESSION['SessionType'] . ")");
        
        // session_destroy() is called in auth, so raw data will be updated

        self::removeSessionCookie();
    }

    private static function checkCurrentSessionIsAllowed(ilAuthSession $auth, $a_user_id)
    {
        global $DIC;

        $ilSetting = $DIC['ilSetting'];
        
        $max_sessions = (int) $ilSetting->get('session_max_count', self::DEFAULT_MAX_COUNT);

        if ($max_sessions > 0) {
            // get total number of sessions
            $num_sessions = self::getExistingSessionCount(self::$session_types_controlled);

            self::debug(__METHOD__ . "--> total existing sessions (" . $num_sessions . ")");

            if (($num_sessions + 1) > $max_sessions) {
                self::debug(__METHOD__ . ' --> limit for session pool reached, but try kicking some first request abidencer');

                self::kickFirstRequestAbidencer(self::$session_types_controlled);

                // get total number of sessions again
                $num_sessions = self::getExistingSessionCount(self::$session_types_controlled);

                if (($num_sessions + 1) > $max_sessions) {
                    self::debug(__METHOD__ . ' --> limit for session pool still reached so try kick one min idle session');

                    self::kickOneMinIdleSession(self::$session_types_controlled);

                    // get total number of sessions again
                    $num_sessions = self::getExistingSessionCount(self::$session_types_controlled);

                    if (($num_sessions + 1) > $max_sessions) {
                        self::debug(__METHOD__ . ' --> limit for session pool still reached so logout session (' . session_id() . ') and trigger event');

                        ilSession::setClosingContext(ilSession::SESSION_CLOSE_LIMIT);
                        
                        // as the session is opened and closed in one request, there
                        // is no proper session yet and we have to do this ourselves
                        ilSessionStatistics::createRawEntry(
                            session_id(),
                            $_SESSION['SessionType'],
                            time(),
                            $a_user_id
                        );

                        $auth->logout();

                        // Trigger reachedSessionPoolLimit Event
                        global $DIC;

                        $ilAppEventHandler = $DIC['ilAppEventHandler'];
                        $ilAppEventHandler->raise(
                            'Services/Authentication',
                            'reachedSessionPoolLimit',
                            array()
                        );

                        // auth won't do this, we need to close session properly
                        // already done in new implementation
                        // session_destroy();

                        ilUtil::redirect('login.php?reached_session_limit=true');
                    } else {
                        self::debug(__METHOD__ . ' --> limit of session pool not reached anymore after kicking one min idle session');
                    }
                } else {
                    self::debug(__METHOD__ . ' --> limit of session pool not reached anymore after kicking some first request abidencer');
                }
            } else {
                self::debug(__METHOD__ . ' --> limit for session pool not reached yet');
            }
        } else {
            self::debug(__METHOD__ . ' --> limit for session pool not set so check is bypassed');
        }
    }

    public static function getExistingSessionCount(array $a_types)
    {
        global $DIC;

        $ilDB = $DIC['ilDB'];

        $ts = time();

        $query = "SELECT count(session_id) AS num_sessions FROM usr_session " .
                    "WHERE expires > %s " .
                    "AND " . $ilDB->in('type', $a_types, false, 'integer');
    
        $res = $ilDB->queryF($query, array('integer'), array($ts));
        $row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT);

        return $row->num_sessions;
    }

    private static function kickOneMinIdleSession(array $a_types)
    {
        global $DIC;

        $ilDB = $DIC['ilDB'];
        $ilSetting = $DIC['ilSetting'];

        $ts = time();
        $min_idle = (int) $ilSetting->get('session_min_idle', self::DEFAULT_MIN_IDLE) * 60;
        $max_idle = (int) $ilSetting->get('session_max_idle', self::DEFAULT_MAX_IDLE) * 60;

        $query = "SELECT session_id,expires FROM usr_session WHERE expires >= %s " .
                "AND (expires - %s) < (%s - %s) " .
                "AND " . $ilDB->in('type', $a_types, false, 'integer') . " ORDER BY expires";

        $res = $ilDB->queryF(
            $query,
            array('integer', 'integer', 'integer', 'integer'),
            array($ts, $ts, $max_idle, $min_idle)
        );
        
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            ilSession::_destroy($row->session_id, ilSession::SESSION_CLOSE_IDLE, $row->expires);

            self::debug(__METHOD__ . ' --> successfully deleted one min idle session');

            return true;
        }

        self::debug(__METHOD__ . ' --> no min idle session available for deletion');
        
        return false;
    }

    private static function kickFirstRequestAbidencer(array $a_types)
    {
        global $DIC;

        $ilDB = $DIC['ilDB'];
        $ilSetting = $DIC['ilSetting'];

        $max_idle_after_first_request = (int) $ilSetting->get('session_max_idle_after_first_request') * 60;

        if ((int) $max_idle_after_first_request == 0) {
            return;
        }

        $query = "SELECT session_id,expires FROM usr_session WHERE " .
                "(ctime - createtime) < %s " .
                "AND (%s - createtime) > %s " .
                "AND " . $ilDB->in('type', $a_types, false, 'integer');

        $res = $ilDB->queryF(
            $query,
            array('integer', 'integer', 'integer'),
            array($max_idle_after_first_request, time(), $max_idle_after_first_request)
        );
        
        $session_ids = array();
        while ($row = $res->fetchRow(ilDBConstants::FETCHMODE_OBJECT)) {
            $session_ids[$row->session_id] = $row->expires;
        }
        ilSession::_destroy($session_ids, ilSession::SESSION_CLOSE_FIRST, true);

        self::debug(__METHOD__ . ' --> Finished kicking first request abidencer');
    }

    private static function isValidSession($a_sid)
    {
        global $DIC;

        $ilDB = $DIC['ilDB'];
        $ilSetting = $DIC['ilSetting'];

        $query = "SELECT session_id, expires FROM usr_session " .
                    "WHERE session_id = %s";

        $res = $ilDB->queryF($query, array('text'), array($a_sid));

        $ts = time();

        $sessions = array();

        while ($row = $ilDB->fetchAssoc($res)) {
            if ($row['expires'] > $ts) {
                self::debug(__METHOD__ . ' --> Found a valid session with id (' . $a_sid . ')');
                $sessions[] = $row;
            } else {
                self::debug(__METHOD__ . ' --> Found an expired session with id (' . $a_sid . ')');
            }
        }

        if (count($sessions) == 1) {
            self::debug(__METHOD__ . ' --> Exact one valid session found for session id (' . $a_sid . ')');

            return true;
        } else {
            if (count($sessions) > 1) {
                self::debug(__METHOD__ . ' --> Strange!!! More than one sessions found for given session id! (' . $a_sid . ')');
            } else {
                self::debug(__METHOD__ . ' --> No valid session found for session id (' . $a_sid . ')');
            }

            return false;
        }
    }

    private static function removeSessionCookie()
    {
        ilUtil::setCookie(session_name(), 'deleted', true, true);
        self::debug('Session cookie has been removed');
    }

    private static function checkAdministrationPermission($a_user_id)
    {
        if (!(int) $a_user_id) {
            return false;
        }

        global $DIC;

        $rbacsystem = $DIC['rbacsystem'];

        $access = $rbacsystem->checkAccessOfUser(
            $a_user_id,
            'read,visible',
            SYSTEM_FOLDER_ID
        );

        return $access;
    }

    private static function debug($a_debug_log_message)
    {
        global $DIC;

        $ilLog = $DIC['ilLog'];

        if (DEVMODE) {
            $ilLog->write($a_debug_log_message, 'message');
        }

        if (self::INTERNAL_DEBUG) {
            error_log($a_debug_log_message . "\n", 3, 'session.log');
        }
    }

    public static function getSettingFields()
    {
        return self::$setting_fields;
    }
}