diff options
Diffstat (limited to 'phpBB/includes/classes/session.php')
| -rw-r--r-- | phpBB/includes/classes/session.php | 1289 |
1 files changed, 0 insertions, 1289 deletions
diff --git a/phpBB/includes/classes/session.php b/phpBB/includes/classes/session.php deleted file mode 100644 index ca54bae552..0000000000 --- a/phpBB/includes/classes/session.php +++ /dev/null @@ -1,1289 +0,0 @@ -<?php -/** -* -* @package phpBB3 -* @version $Id$ -* @copyright (c) 2005, 2008 phpBB Group -* @license http://opensource.org/licenses/gpl-license.php GNU Public License -* -*/ - -/** -* @ignore -*/ -if (!defined('IN_PHPBB')) -{ - exit; -} - -/** -* Session class -* @package phpBB3 -*/ -abstract class phpbb_session -{ - /** - * @var array Cookie informations - */ - private $cookie_data = array(); - - /** - * @var array User data - */ - public $data = array(); - - /** - * @var string Session id - */ - public $session_id = ''; - - /** - * @var int Current time - */ - public $time_now = 0; - - /** - * @var bool True if the current page is updated within the sessions table - */ - public $update_session_page = true; - - /** - * @var mixed Reference to authentication system. - */ - public $auth = NULL; - - /** - * @var mixed Reference to system array for obtaining server/system information - */ - public $system = NULL; - - /** - * @var array Extra url parameter to append to every URL in phpBB - */ - public $extra_url = array(); - - /** - * @var bool If this is true then the session id (?sid=[session_id]) is required - */ - public $need_sid = false; - - /** - * @var array Information about current page - */ - public $page = array(); - - /** - * @var string The users IP - */ - public $ip = '127.0.0.1'; - - /** - * Init session. Empties the user data and assigns the system object (phpbb::$instances['system']) - * @access public - */ - public function __construct() - { - // Reset data array ;) - $this->data = array(); - - // Set auth to false (only valid for an user object) - $this->auth = false; - - // Some system/server variables, directly generated by phpbb_system_info methods. Used like an array. - // We use the phpbb:: one, because it could've been modified and being a completely different class - $this->system =& phpbb::$instances['server-vars']; - } - - /** - * Specifiy the need for a session id within the URL - * - * @param bool $need_sid Specify if the session id is needed or not. Default is false. - * @access public - */ - public function need_sid($need_sid = false) - { - $this->need_sid = $need_sid; - } - - /** - * Start session management - * - * This is where all session activity begins. We gather various pieces of - * information from the client and server. We test to see if a session already - * exists. If it does, fine and dandy. If it doesn't we'll go on to create a - * new one ... pretty logical heh? We also examine the system load (if we're - * running on a system which makes such information readily available) and - * halt if it's above an admin definable limit. - * - * @param bool $update_session_page If true the session page gets updated. - * This can be set to false to circumvent certain scripts to update the users last visited page. - * - * @return bool True if the session exist or has been created, else False. - * @access public - */ - public function session_begin($update_session_page = true) - { - // Give us some basic information - $this->time_now = time(); - $this->cookie_data = array('u' => 0, 'k' => ''); - $this->update_session_page = $update_session_page; - $this->page = $this->system['page']; - $this->ip = $this->system['ip']; - - if (phpbb_request::is_set(phpbb::$config['cookie_name'] . '_sid', phpbb_request::COOKIE) || phpbb_request::is_set(phpbb::$config['cookie_name'] . '_u', phpbb_request::COOKIE)) - { - $this->cookie_data['u'] = request_var(phpbb::$config['cookie_name'] . '_u', 0, false, true); - $this->cookie_data['k'] = request_var(phpbb::$config['cookie_name'] . '_k', '', false, true); - $this->session_id = request_var(phpbb::$config['cookie_name'] . '_sid', '', false, true); - - if (empty($this->session_id)) - { - $this->session_id = request_var('sid', ''); - $this->cookie_data = array('u' => 0, 'k' => ''); - $this->need_sid = true; - } - } - else - { - $this->session_id = request_var('sid', ''); - $this->need_sid = true; - } - - $this->extra_url = array(); - - // Now check for an existing session - if ($this->session_exist()) - { - return true; - } - - // If we reach here then no (valid) session exists. So we'll create a new one - return $this->session_create(); - } - - /** - * Create a new session - * - * If upon trying to start a session we discover there is nothing existing we - * jump here. Additionally this method is called directly during login to regenerate - * the session for the specific user. In this method we carry out a number of tasks; - * garbage collection, (search)bot checking, banned user comparison. Basically - * though this method will result in a new session for a specific user. - * - * @param int $user_id The user id to create the session for. - * @param bool $set_admin Set the users admin field to identify him/her as an admin? - * @param bool $persist_login Allow persistent login - * @param bool $viewonline If false then the user will be logged in as hidden - * - * @return bool True if session got created successfully. - * @access public - */ - public function session_create($user_id = false, $set_admin = false, $persist_login = false, $viewonline = true) - { - // There is one case where we need to add a "failsafe" user... when we are not able to query the database - if (!phpbb::registered('db')) - { - $this->data = $this->default_data(); - return true; - } - - // If the data array is filled, chances are high that there was a different session active - if (sizeof($this->data)) - { - // Kill the session and do not create a new one - $this->session_kill(false); - } - - $this->data = array(); - - // Do we allow autologin on this board? No? Then override anything - // that may be requested here - if (!phpbb::$config['allow_autologin']) - { - $this->cookie_data['k'] = $persist_login = false; - } - - // Check for autologin key. ;) - if ($this->auth !== false && method_exists($this->auth, 'autologin')) - { - $this->data = $this->auth->autologin(); - - if (sizeof($this->data)) - { - $this->cookie_data['k'] = ''; - $this->cookie_data['u'] = $this->data['user_id']; - } - } - - // NULL indicates we need to check for a bot later. Sometimes it is apparant that it is not a bot. ;) No need to always check this. - $bot = NULL; - - // If we're presented with an autologin key we'll join against it. - // Else if we've been passed a user_id we'll grab data based on that - if (isset($this->cookie_data['k']) && $this->cookie_data['k'] && $this->cookie_data['u'] && !sizeof($this->data)) - { - $sql = 'SELECT u.* - FROM ' . USERS_TABLE . ' u, ' . SESSIONS_KEYS_TABLE . ' k - WHERE u.user_id = ' . (int) $this->cookie_data['u'] . ' - AND u.user_type IN (' . phpbb::USER_NORMAL . ', ' . phpbb::USER_FOUNDER . ") - AND k.user_id = u.user_id - AND k.key_id = '" . phpbb::$db->sql_escape(md5($this->cookie_data['k'])) . "'"; - $result = phpbb::$db->sql_query($sql); - $this->data = phpbb::$db->sql_fetchrow($result); - phpbb::$db->sql_freeresult($result); - - $bot = false; - } - else if ($user_id !== false && !sizeof($this->data)) - { - $this->cookie_data['k'] = ''; - $this->cookie_data['u'] = $user_id; - - $sql = 'SELECT * - FROM ' . USERS_TABLE . ' - WHERE user_id = ' . (int) $this->cookie_data['u'] . ' - AND user_type IN (' . phpbb::USER_NORMAL . ', ' . phpbb::USER_FOUNDER . ')'; - $result = phpbb::$db->sql_query($sql); - $this->data = phpbb::$db->sql_fetchrow($result); - phpbb::$db->sql_freeresult($result); - - $bot = false; - } - - if ($bot === NULL) - { - $bot = $this->check_bot(); - } - - // If no data was returned one or more of the following occurred: - // Key didn't match one in the DB - // User does not exist - // User is inactive - // User is bot - if (!sizeof($this->data) || !is_array($this->data)) - { - $this->cookie_data['k'] = ''; - $this->cookie_data['u'] = ($bot) ? $bot : ANONYMOUS; - - if (!$bot) - { - $sql = 'SELECT * - FROM ' . USERS_TABLE . ' - WHERE user_id = ' . (int) $this->cookie_data['u']; - } - else - { - // We give bots always the same session if it is not yet expired. - $sql = 'SELECT u.*, s.* - FROM ' . USERS_TABLE . ' u - LEFT JOIN ' . SESSIONS_TABLE . ' s ON (s.session_user_id = u.user_id) - WHERE u.user_id = ' . (int) $bot; - } - - $result = phpbb::$db->sql_query($sql); - $this->data = phpbb::$db->sql_fetchrow($result); - phpbb::$db->sql_freeresult($result); - - $this->is_registered = false; - } - else - { - $this->is_registered = true; - $this->is_guest = false; - $this->is_founder = $this->data['user_type'] == phpbb::USER_FOUNDER; - } - - // Force user id to be integer... - $this->data['user_id'] = (int) $this->data['user_id']; - - // Code for ANONYMOUS user, INACTIVE user and BOTS - if (!$this->is_registered) - { - // Set last visit date to 'now' - $this->data['session_last_visit'] = $this->time_now; - $this->is_bot = ($bot) ? true : false; - - // If our friend is a bot, we re-assign a previously assigned session - if ($this->is_bot && $bot == $this->data['user_id'] && $this->data['session_id']) - { - if ($this->session_valid(false)) - { - $this->session_id = $this->data['session_id']; - - // Only update session DB a minute or so after last update or if page changes - if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->system['page']['page'])) - { - $this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now; - $sql_ary = array('session_time' => $this->time_now, 'session_last_visit' => $this->time_now, 'session_admin' => 0); - - if ($this->update_session_page) - { - $sql_ary['session_page'] = substr($this->system['page']['page'], 0, 199); - } - - $sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . phpbb::$db->sql_build_array('UPDATE', $sql_ary) . " - WHERE session_id = '" . phpbb::$db->sql_escape($this->session_id) . "'"; - phpbb::$db->sql_query($sql); - - // Update the last visit time - $sql = 'UPDATE ' . USERS_TABLE . ' - SET user_lastvisit = ' . (int) $this->data['session_time'] . ' - WHERE user_id = ' . (int) $this->data['user_id']; - phpbb::$db->sql_query($sql); - } - - $this->session_id = ''; - - return true; - } - else - { - // If the ip and browser does not match make sure we only have one bot assigned to one session - phpbb::$db->sql_query('DELETE FROM ' . SESSIONS_TABLE . ' WHERE session_user_id = ' . $this->data['user_id']); - } - } - } - else - { - // Code for registered users - $this->data['session_last_visit'] = (!empty($this->data['session_time'])) ? $this->data['session_time'] : (($this->data['user_lastvisit']) ? $this->data['user_lastvisit'] : $this->time_now); - $this->is_bot = false; - } - - // At this stage we should have a filled data array, defined cookie u and k data. - // data array should contain recent session info if we're a real user and a recent - // session exists in which case session_id will also be set - - // Is user banned? Are they excluded? Won't return on ban, exists within method - if ($this->data['user_type'] != phpbb::USER_FOUNDER) - { - if (!phpbb::$config['forwarded_for_check']) - { - $this->check_ban($this->data['user_id'], $this->system['ip']); - } - else - { - $ips = explode(', ', $this->forwarded_for); - $ips[] = $this->system['ip']; - $this->check_ban($this->data['user_id'], $ips); - } - } - - $session_autologin = (($this->cookie_data['k'] || $persist_login) && $this->is_registered) ? true : false; - $set_admin = ($set_admin && $this->is_registered) ? true : false; - - // Create or update the session - $sql_ary = array( - 'session_user_id' => (int) $this->data['user_id'], - 'session_start' => (int) $this->time_now, - 'session_last_visit' => (int) $this->data['session_last_visit'], - 'session_time' => (int) $this->time_now, - 'session_browser' => (string) trim(substr($this->system['browser'], 0, 149)), - 'session_forwarded_for' => (string) $this->system['forwarded_for'], - 'session_ip' => (string) $this->system['ip'], - 'session_autologin' => ($session_autologin) ? 1 : 0, - 'session_admin' => ($set_admin) ? 1 : 0, - 'session_viewonline' => ($viewonline) ? 1 : 0, - ); - - if ($this->update_session_page) - { - $sql_ary['session_page'] = (string) substr($this->system['page']['page'], 0, 199); - } - - phpbb::$db->sql_return_on_error(true); - - // Delete old session, if user id now different from anonymous - if (!defined('IN_ERROR_HANDLER')) - { - // We do not care about the user id, because we assign a new session later - $sql = 'DELETE - FROM ' . SESSIONS_TABLE . " - WHERE session_id = '" . phpbb::$db->sql_escape($this->session_id) . "'"; - $result = phpbb::$db->sql_query($sql); - - // If there were no sessions or the session id empty (then the affected rows will be empty too), then we have a brand new session and can check the active sessions limit - if ((!$result || !phpbb::$db->sql_affectedrows()) && (empty($this->data['session_time']) && phpbb::$config['active_sessions'])) - { - $sql = 'SELECT COUNT(session_id) AS sessions - FROM ' . SESSIONS_TABLE . ' - WHERE session_time >= ' . ($this->time_now - 60); - $result = phpbb::$db->sql_query($sql); - $row = phpbb::$db->sql_fetchrow($result); - phpbb::$db->sql_freeresult($result); - - if ((int) $row['sessions'] > (int) phpbb::$config['active_sessions']) - { - header('HTTP/1.1 503 Service Unavailable'); - trigger_error('BOARD_UNAVAILABLE'); - } - } - } - - // Something quite important: session_page always holds the *last* page visited, except for the *first* visit. - // We are not able to simply have an empty session_page btw, therefore we need to tell phpBB how to detect this special case. - // If the session id is empty, we have a completely new one and will set an "identifier" here. This identifier is able to be checked later. - if (empty($this->data['session_id'])) - { - // This is a temporary variable, only set for the very first visit - $this->data['session_created'] = true; - } - - $this->session_id = $this->data['session_id'] = md5(phpbb::$security->unique_id()); - - $sql_ary['session_id'] = (string) $this->session_id; - - $sql = 'INSERT INTO ' . SESSIONS_TABLE . ' ' . phpbb::$db->sql_build_array('INSERT', $sql_ary); - phpbb::$db->sql_query($sql); - - phpbb::$db->sql_return_on_error(false); - - // Regenerate autologin/persistent login key - if ($session_autologin) - { - $this->set_login_key(); - } - - // refresh data - $this->data = array_merge($this->data, $sql_ary); - - if (!$bot) - { - $cookie_expire = $this->time_now + ((phpbb::$config['max_autologin_time']) ? 86400 * (int) phpbb::$config['max_autologin_time'] : 31536000); - - $this->set_cookie('u', $this->cookie_data['u'], $cookie_expire); - $this->set_cookie('k', $this->cookie_data['k'], $cookie_expire); - $this->set_cookie('sid', $this->session_id, $cookie_expire); - - unset($cookie_expire); - - // Only one session entry present... - $sql = 'SELECT COUNT(session_id) AS sessions - FROM ' . SESSIONS_TABLE . ' - WHERE session_user_id = ' . (int) $this->data['user_id'] . ' - AND session_time >= ' . (int) ($this->time_now - (max(phpbb::$config['session_length'], phpbb::$config['form_token_lifetime']))); - $result = phpbb::$db->sql_query($sql); - $row = phpbb::$db->sql_fetchrow($result); - phpbb::$db->sql_freeresult($result); - - if ((int) $row['sessions'] <= 1 || empty($this->data['user_form_salt'])) - { - $this->data['user_form_salt'] = phpbb::$security->unique_id(); - - // Update the form key - $sql = 'UPDATE ' . USERS_TABLE . ' - SET user_form_salt = \'' . phpbb::$db->sql_escape($this->data['user_form_salt']) . '\' - WHERE user_id = ' . (int) $this->data['user_id']; - phpbb::$db->sql_query($sql); - } - } - else - { - $this->data['session_time'] = $this->data['session_last_visit'] = $this->time_now; - - // Update the last visit time - $sql = 'UPDATE ' . USERS_TABLE . ' - SET user_lastvisit = ' . (int) $this->data['session_time'] . ' - WHERE user_id = ' . (int) $this->data['user_id']; - phpbb::$db->sql_query($sql); - - $this->session_id = ''; - } - - return true; - } - - /** - * Kills a session - * - * This method does what it says on the tin. It will delete a pre-existing session. - * It resets cookie information (destroying any autologin key within that cookie data) - * and update the users information from the relevant session data. It will then - * grab guest user information. - * - * @param bool $new_session If true a new session will be generated after the original one got killed. - * @access public - */ - public function session_kill($new_session = true) - { - $sql = 'DELETE FROM ' . SESSIONS_TABLE . " - WHERE session_id = '" . phpbb::$db->sql_escape($this->session_id) . "' - AND session_user_id = " . (int) $this->data['user_id']; - phpbb::$db->sql_query($sql); - - // Allow connecting logout with external auth method logout - if ($this->auth !== false && method_exists($this->auth, 'logout')) - { - $this->auth->logout($this, $new_session); - } - - if ($this->data['user_id'] != ANONYMOUS) - { - // Delete existing session, update last visit info first! - if (!isset($this->data['session_time'])) - { - $this->data['session_time'] = time(); - } - - $sql = 'UPDATE ' . USERS_TABLE . ' - SET user_lastvisit = ' . (int) $this->data['session_time'] . ' - WHERE user_id = ' . (int) $this->data['user_id']; - phpbb::$db->sql_query($sql); - - if ($this->cookie_data['k']) - { - $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . ' - WHERE user_id = ' . (int) $this->data['user_id'] . " - AND key_id = '" . phpbb::$db->sql_escape(md5($this->cookie_data['k'])) . "'"; - phpbb::$db->sql_query($sql); - } - - // Reset the data array - $this->data = array(); - - $sql = 'SELECT * - FROM ' . USERS_TABLE . ' - WHERE user_id = ' . ANONYMOUS; - $result = phpbb::$db->sql_query($sql); - $this->data = phpbb::$db->sql_fetchrow($result); - phpbb::$db->sql_freeresult($result); - } - - $cookie_expire = $this->time_now - 31536000; - $this->set_cookie('u', '', $cookie_expire); - $this->set_cookie('k', '', $cookie_expire); - $this->set_cookie('sid', '', $cookie_expire); - unset($cookie_expire); - - $this->session_id = ''; - - // To make sure a valid session is created we create one for the anonymous user - if ($new_session) - { - $this->session_create(ANONYMOUS); - } - } - - /** - * Session garbage collection - * - * This looks a lot more complex than it really is. Effectively we are - * deleting any sessions older than an admin definable limit. Due to the - * way in which we maintain session data we have to ensure we update user - * data before those sessions are destroyed. In addition this method - * removes autologin key information that is older than an admin defined - * limit. - * - * @access public - */ - public function session_gc() - { - $batch_size = 10; - - if (!$this->time_now) - { - $this->time_now = time(); - } - - // Firstly, delete guest sessions - $sql = 'DELETE FROM ' . SESSIONS_TABLE . ' - WHERE session_user_id = ' . ANONYMOUS . ' - AND session_time < ' . (int) ($this->time_now - phpbb::$config['session_length']); - phpbb::$db->sql_query($sql); - - // Get expired sessions, only most recent for each user - $sql = 'SELECT session_user_id, session_page, MAX(session_time) AS recent_time - FROM ' . SESSIONS_TABLE . ' - WHERE session_time < ' . ($this->time_now - phpbb::$config['session_length']) . ' - GROUP BY session_user_id, session_page'; - $result = phpbb::$db->sql_query_limit($sql, $batch_size); - - $del_user_id = array(); - $del_sessions = 0; - - while ($row = phpbb::$db->sql_fetchrow($result)) - { - $sql = 'UPDATE ' . USERS_TABLE . ' - SET user_lastvisit = ' . (int) $row['recent_time'] . ", user_lastpage = '" . phpbb::$db->sql_escape($row['session_page']) . "' - WHERE user_id = " . (int) $row['session_user_id']; - phpbb::$db->sql_query($sql); - - $del_user_id[] = (int) $row['session_user_id']; - $del_sessions++; - } - phpbb::$db->sql_freeresult($result); - - if (sizeof($del_user_id)) - { - // Delete expired sessions - $sql = 'DELETE FROM ' . SESSIONS_TABLE . ' - WHERE ' . phpbb::$db->sql_in_set('session_user_id', $del_user_id) . ' - AND session_time < ' . ($this->time_now - phpbb::$config['session_length']); - phpbb::$db->sql_query($sql); - } - - if ($del_sessions < $batch_size) - { - // Less than 10 users, update gc timer ... else we want gc - // called again to delete other sessions - set_config('session_last_gc', $this->time_now, true); - - if (phpbb::$config['max_autologin_time']) - { - $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . ' - WHERE last_login < ' . (time() - (86400 * (int) phpbb::$config['max_autologin_time'])); - phpbb::$db->sql_query($sql); - } - - // only called from CRON; should be a safe workaround until the infrastructure gets going - if (!class_exists('captcha_factory')) - { - include(PHPBB_ROOT_PATH . "includes/captcha/captcha_factory." . PHP_EXT); - } - captcha_factory::garbage_collect(phpbb::$config['captcha_plugin']); - } - - return; - } - - - /** - * Sets a cookie of the given name with the specified data for the given length of time. If no time is specified, a session cookie will be set. - * - * @param string $name Name of the cookie, will be automatically prefixed with the phpBB cookie name. Track becomes [cookie_name]_track then. - * @param string $cookiedata The data to hold within the cookie - * @param int $cookietime The expiration time as UNIX timestamp. If 0 is provided, a session cookie is set. - * - * @access public - */ - public function set_cookie($name, $cookiedata, $cookietime) - { - $name_data = rawurlencode(phpbb::$config['cookie_name'] . '_' . $name) . '=' . rawurlencode($cookiedata); - $expire = gmdate('D, d-M-Y H:i:s \\G\\M\\T', $cookietime); - $domain = (!phpbb::$config['cookie_domain'] || phpbb::$config['cookie_domain'] == 'localhost' || phpbb::$config['cookie_domain'] == '127.0.0.1') ? '' : '; domain=' . phpbb::$config['cookie_domain']; - - header('Set-Cookie: ' . $name_data . (($cookietime) ? '; expires=' . $expire : '') . '; path=' . phpbb::$config['cookie_path'] . $domain . ((!phpbb::$config['cookie_secure']) ? '' : '; secure') . '; HttpOnly', false); - } - - /** - * Check for banned user - * - * Checks whether the supplied user is banned by id, ip or email. If no parameters - * are passed to the method pre-existing session data is used. If $return is false - * this routine does not return on finding a banned user, it outputs a relevant - * message and stops execution. - * - * @param int $user_id The user id to check. If false then do not check user ids - * @param string|array $user_ips Can contain a string with one IP or an array of multiple IPs. If false then no ips are checked. - * @param int $user_email The email address to check - * @param bool $return If false then the banned message is displayed and script halted - * - * @return bool|string True if banned and no reason given. - * False if not banned. A ban reason if banned and ban reason given. Check for !== false. - * @access public - */ - public function check_ban($user_id = false, $user_ips = false, $user_email = false, $return = false) - { - if (defined('IN_CHECK_BAN')) - { - return; - } - - $banned = false; - $cache_ttl = 3600; - $where_sql = array(); - - $sql = 'SELECT ban_ip, ban_userid, ban_email, ban_exclude, ban_give_reason, ban_end - FROM ' . BANLIST_TABLE . ' - WHERE '; - - // Determine which entries to check, only return those - if ($user_email === false) - { - $where_sql[] = "ban_email = ''"; - } - - if ($user_ips === false) - { - $where_sql[] = "(ban_ip = '' OR ban_exclude = 1)"; - } - - if ($user_id === false) - { - $where_sql[] = '(ban_userid = 0 OR ban_exclude = 1)'; - } - else - { - $cache_ttl = ($user_id == ANONYMOUS) ? 3600 : 0; - $_sql = '(ban_userid = ' . $user_id; - - if ($user_email !== false) - { - $_sql .= " OR ban_email <> ''"; - } - - if ($user_ips !== false) - { - $_sql .= " OR ban_ip <> ''"; - } - - $_sql .= ')'; - - $where_sql[] = $_sql; - } - - $sql .= (sizeof($where_sql)) ? implode(' AND ', $where_sql) : ''; - $result = phpbb::$db->sql_query($sql, $cache_ttl); - - $ban_triggered_by = 'user'; - while ($row = phpbb::$db->sql_fetchrow($result)) - { - if ($row['ban_end'] && $row['ban_end'] < time()) - { - continue; - } - - $ip_banned = false; - if (!empty($row['ban_ip'])) - { - if (!is_array($user_ips)) - { - $ip_banned = preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_ip'], '#')) . '$#i', $user_ips); - } - else - { - foreach ($user_ips as $user_ip) - { - if (preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_ip'], '#')) . '$#i', $user_ip)) - { - $ip_banned = true; - break; - } - } - } - } - - if ((!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id) || - $ip_banned || - (!empty($row['ban_email']) && preg_match('#^' . str_replace('\*', '.*?', preg_quote($row['ban_email'], '#')) . '$#i', $user_email))) - { - if (!empty($row['ban_exclude'])) - { - $banned = false; - break; - } - else - { - $banned = true; - $ban_row = $row; - - if (!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id) - { - $ban_triggered_by = 'user'; - } - else if ($ip_banned) - { - $ban_triggered_by = 'ip'; - } - else - { - $ban_triggered_by = 'email'; - } - - // Don't break. Check if there is an exclude rule for this user - } - } - } - phpbb::$db->sql_freeresult($result); - - if ($banned && !$return) - { - // If the session is empty we need to create a valid one... - if (empty($this->session_id)) - { - // This seems to be no longer needed? - #14971 -// $this->session_create(ANONYMOUS); - } - - // Initiate environment ... since it won't be set at this stage - $this->setup(); - - // Logout the user, banned users are unable to use the normal 'logout' link - if ($this->data['user_id'] != ANONYMOUS) - { - $this->session_kill(); - } - - // We show a login box here to allow founders accessing the board if banned by IP - if (defined('IN_LOGIN') && $this->data['user_id'] == ANONYMOUS) - { - $this->setup('ucp'); - $this->is_registered = $this->is_bot = $this->is_founder = false; - $this->is_guest = true; - - // Set as a precaution to allow login_box() handling this case correctly as well as this function not being executed again. - define('IN_CHECK_BAN', 1); - - login_box('index.' . PHP_EXT); - - // The false here is needed, else the user is able to circumvent the ban. - $this->session_kill(false); - } - - // Ok, we catch the case of an empty session id for the anonymous user... - // This can happen if the user is logging in, banned by username and the login_box() being called "again". - if (empty($this->session_id) && defined('IN_CHECK_BAN')) - { - $this->session_create(ANONYMOUS); - } - - - // Determine which message to output - $till_date = ($ban_row['ban_end']) ? $this->format_date($ban_row['ban_end']) : ''; - $message = ($ban_row['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM'; - - $message = sprintf($this->lang[$message], $till_date, '<a href="mailto:' . phpbb::$config['board_contact'] . '">', '</a>'); - $message .= ($ban_row['ban_give_reason']) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_give_reason']) : ''; - $message .= '<br /><br /><em>' . $this->lang['BAN_TRIGGERED_BY_' . strtoupper($ban_triggered_by)] . '</em>'; - - // To circumvent session_begin returning a valid value and the check_ban() not called on second page view, we kill the session again - $this->session_kill(false); - - // A very special case... we are within the cron script which is not supposed to print out the ban message... show blank page - if (defined('IN_CRON')) - { - garbage_collection(); - exit_handler(); - exit; - } - - trigger_error($message); - } - - return ($banned && $ban_row['ban_give_reason']) ? $ban_row['ban_give_reason'] : $banned; - } - - /** - * Check if ip is blacklisted - * This should be called only where absolutly necessary - * - * Only IPv4 (rbldns does not support AAAA records/IPv6 lookups) - * - * @param string $mode Possible modes are: register and post - * spamhaus.org is used for both modes. Spamcop.net is additionally used for register. - * @param string $ip The ip to check. If false then the current IP is used - * - * @return bool|array False if ip is not blacklisted, else an array([checked server], [lookup]) - * @author satmd (from the php manual) - * @access public - */ - public function check_dnsbl($mode, $ip = false) - { - if ($ip === false) - { - $ip = $this->system['ip']; - } - - $dnsbl_check = array( - 'sbl-xbl.spamhaus.org' => 'http://www.spamhaus.org/query/bl?ip=', - ); - - if ($mode == 'register') - { - $dnsbl_check['bl.spamcop.net'] = 'http://spamcop.net/bl.shtml?'; - } - - if ($ip) - { - $quads = explode('.', $ip); - $reverse_ip = $quads[3] . '.' . $quads[2] . '.' . $quads[1] . '.' . $quads[0]; - - // Need to be listed on all servers... - $listed = true; - $info = array(); - - foreach ($dnsbl_check as $dnsbl => $lookup) - { - if (phpbb_checkdnsrr($reverse_ip . '.' . $dnsbl . '.', 'A') === true) - { - $info = array($dnsbl, $lookup . $ip); - } - else - { - $listed = false; - } - } - - if ($listed) - { - return $info; - } - } - - return false; - } - - /** - * Set/Update a persistent login key - * - * This method creates or updates a persistent session key. When a user makes - * use of persistent (formerly auto-) logins a key is generated and stored in the - * DB. When they revisit with the same key it's automatically updated in both the - * DB and cookie. Multiple keys may exist for each user representing different - * browsers or locations. As with _any_ non-secure-socket no passphrase login this - * remains vulnerable to exploit. - * - * @param int $user_id The user id. If false the current users user id will be used - * @param string $key A login key. If false then the current users login key stored within the cookie will be used - * @param string $user_ip The users ip. If false, then the current users IP will be used - * @access public - */ - public function set_login_key($user_id = false, $key = false, $user_ip = false) - { - $user_id = ($user_id === false) ? $this->data['user_id'] : $user_id; - $user_ip = ($user_ip === false) ? $this->system['ip'] : $user_ip; - $key = ($key === false) ? (($this->cookie_data['k']) ? $this->cookie_data['k'] : false) : $key; - - $key_id = phpbb::$security->unique_id(hexdec(substr($this->session_id, 0, 8))); - - $sql_ary = array( - 'key_id' => (string) md5($key_id), - 'last_ip' => (string) $this->system['ip'], - 'last_login' => (int) $this->time_now, - ); - - if (!$key) - { - $sql_ary += array( - 'user_id' => (int) $user_id - ); - } - - if ($key) - { - $sql = 'UPDATE ' . SESSIONS_KEYS_TABLE . ' - SET ' . phpbb::$db->sql_build_array('UPDATE', $sql_ary) . ' - WHERE user_id = ' . (int) $user_id . " - AND key_id = '" . phpbb::$db->sql_escape(md5($key)) . "'"; - } - else - { - $sql = 'INSERT INTO ' . SESSIONS_KEYS_TABLE . ' ' . phpbb::$db->sql_build_array('INSERT', $sql_ary); - } - phpbb::$db->sql_query($sql); - - $this->cookie_data['k'] = $key_id; - } - - /** - * Reset all login keys for the specified user - * - * This method removes all current login keys for a specified (or the current) - * user. It will be called on password change to render old keys unusable - * - * @param int $user_id The user id. If false then the current users user id is used. - * @access public - */ - public function reset_login_keys($user_id = false) - { - $user_id = ($user_id === false) ? $this->data['user_id'] : $user_id; - - $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . ' - WHERE user_id = ' . (int) $user_id; - phpbb::$db->sql_query($sql); - - // Let's also clear any current sessions for the specified user_id - // If it's the current user then we'll leave this session intact - $sql_where = 'session_user_id = ' . (int) $user_id; - $sql_where .= ($user_id === $this->data['user_id']) ? " AND session_id <> '" . phpbb::$db->sql_escape($this->session_id) . "'" : ''; - - $sql = 'DELETE FROM ' . SESSIONS_TABLE . " - WHERE $sql_where"; - phpbb::$db->sql_query($sql); - - // We're changing the password of the current user and they have a key - // Lets regenerate it to be safe - if ($user_id === $this->data['user_id'] && $this->cookie_data['k']) - { - $this->set_login_key($user_id); - } - } - - /** - * Reset all admin sessions - * - * @access public - */ - public function unset_admin() - { - $sql = 'UPDATE ' . SESSIONS_TABLE . " - SET session_admin = 0 - WHERE session_id = '" . phpbb::$db->sql_escape($this->session_id) . "'"; - phpbb::$db->sql_query($sql); - } - - /** - * Check if a valid, non-expired session exist. Also make sure it errors out correctly if we do not have a db-setup yet. ;) - * - * @return bool True if a valid, non-expired session exist - * @access private - */ - private function session_exist() - { - // If session is empty or does not match the session within the URL (if required - set by NEED_SID), then we need a new session - if (empty($this->session_id) || ($this->need_sid && $this->session_id !== phpbb_request::variable('sid', '', false, phpbb_request::GET))) - { - return false; - } - - // If the db is not initialized/registered, then we also need a new session (we are not able to go forward then... - if (!phpbb::registered('db')) - { - return false; - } - - // Now finally check the db for our provided session - $sql = 'SELECT u.*, s.* - FROM ' . SESSIONS_TABLE . ' s, ' . USERS_TABLE . " u - WHERE s.session_id = '" . phpbb::$db->sql_escape($this->session_id) . "' - AND u.user_id = s.session_user_id"; - $result = phpbb::$db->sql_query($sql); - $row = phpbb::$db->sql_fetchrow($result); - phpbb::$db->sql_freeresult($result); - - // Also new session if it has not been found. ;) - if (!$row) - { - return false; - } - - $this->data = $row; - - // Now check the ip, the browser, forwarded for and referer - if (!$this->session_valid()) - { - return false; - } - - // Ok, we are not finished yet. We need to know if the session is expired - - // Check whether the session is still valid if we have one - if ($this->auth !== false && method_exists($this->auth, 'validate_session')) - { - if (!$this->auth->validate_session($this)) - { - return false; - } - } - - // Check the session length timeframe if autologin is not enabled. - // Else check the autologin length... and also removing those having autologin enabled but no longer allowed board-wide. - if (!$this->data['session_autologin']) - { - if ($this->data['session_time'] < $this->time_now - (phpbb::$config['session_length'] + 60)) - { - return false; - } - } - else if (!phpbb::$config['allow_autologin'] || (phpbb::$config['max_autologin_time'] && $this->data['session_time'] < $this->time_now - (86400 * (int) phpbb::$config['max_autologin_time']) + 60)) - { - return false; - } - - // Only update session DB a minute or so after last update or if page changes - if ($this->time_now - $this->data['session_time'] > 60 || ($this->update_session_page && $this->data['session_page'] != $this->system['page']['page'])) - { - $sql_ary = array('session_time' => $this->time_now); - - if ($this->update_session_page) - { - $sql_ary['session_page'] = substr($this->system['page']['page'], 0, 199); - $sql_ary['session_forum_id'] = $this->system['page']['forum']; - } - - $sql = 'UPDATE ' . SESSIONS_TABLE . ' SET ' . phpbb::$db->sql_build_array('UPDATE', $sql_ary) . " - WHERE session_id = '" . phpbb::$db->sql_escape($this->session_id) . "'"; - phpbb::$db->sql_query($sql); - } - - $this->is_registered = ($this->data['user_id'] != ANONYMOUS && ($this->data['user_type'] == phpbb::USER_NORMAL || $this->data['user_type'] == phpbb::USER_FOUNDER)) ? true : false; - $this->is_bot = (!$this->is_registered && $this->data['user_id'] != ANONYMOUS) ? true : false; - $this->is_founder = $this->data['user_type'] == phpbb::USER_FOUNDER; - $this->is_guest = (!$this->is_registered && $this->data['user_id'] == ANONYMOUS) ? true : false; - $this->data['user_lang'] = basename($this->data['user_lang']); - - return true; - } - - /** - * Check if the request originated from the same page. - * - * @param bool $check_script_path If true, the path will be checked as well - * - * @return bool True if the referer is valid - * @access private - */ - private function validate_referer($check_script_path = false) - { - // no referer - nothing to validate, user's fault for turning it off (we only check on POST; so meta can't be the reason) - if (empty($this->system['referer']) || empty($this->system['host'])) - { - return true; - } - - // Specialchar host, because it's the only one not specialchared - $host = htmlspecialchars($this->system['host']); - $ref = substr($this->system['referer'], strpos($this->system['referer'], '://') + 3); - - if (!(stripos($ref, $host) === 0)) - { - return false; - } - else if ($check_script_path && rtrim($this->system['page']['root_script_path'], '/') !== '') - { - $ref = substr($ref, strlen($host)); - $server_port = $this->system['port']; - - if ($server_port !== 80 && $server_port !== 443 && stripos($ref, ":$server_port") === 0) - { - $ref = substr($ref, strlen(":$server_port")); - } - - if (!(stripos(rtrim($ref, '/'), rtrim($this->system['page']['root_script_path'], '/')) === 0)) - { - return false; - } - } - - return true; - } - - /** - * Fill data array with a "faked" user account - * - * @return array Default user data array - * @access private - */ - private function default_data() - { - return array( - 'user_id' => ANONYMOUS, - ); - } - - /** - * Check for a bot by comparing user agent and ip - * - * Here we do a bot check, oh er saucy! No, not that kind of bot - * check. We loop through the list of bots defined by the admin and - * see if we have any useragent and/or IP matches. If we do, this is a - * bot, act accordingly - * - * @return bool True if it is a bot. - * @access private - */ - private function check_bot() - { - $bot = false; - - foreach (phpbb_cache::obtain_bots() as $row) - { - if ($row['bot_agent'] && preg_match('#' . str_replace('\*', '.*?', preg_quote($row['bot_agent'], '#')) . '#i', $this->system['browser'])) - { - $bot = $row['user_id']; - } - - // If ip is supplied, we will make sure the ip is matching too... - if ($row['bot_ip'] && ($bot || !$row['bot_agent'])) - { - // Set bot to false, then we only have to set it to true if it is matching - $bot = false; - - foreach (explode(',', $row['bot_ip']) as $bot_ip) - { - if (!trim($bot_ip)) - { - continue; - } - - if (strpos($this->system['ip'], $bot_ip) === 0) - { - $bot = (int) $row['user_id']; - break; - } - } - } - - if ($bot) - { - break; - } - } - - return $bot; - } - - /** - * Check if session is valid by comparing ip, forwarded for, browser and referer - * - * @param bool $log_failure If true then a non-match will be logged. Can cause huge logs. - * - * @return bool True if the session is valid - * @access private - */ - private function session_valid($log_failure = true) - { - // Validate IP length according to admin ... enforces an IP - // check on bots if admin requires this -// $quadcheck = (phpbb::$config['ip_check_bot'] && $this->data['user_type'] & USER_BOT) ? 4 : phpbb::$config['ip_check']; - - if (strpos($this->system['ip'], ':') !== false && strpos($this->data['session_ip'], ':') !== false) - { - $session_ip = short_ipv6($this->data['session_ip'], phpbb::$config['ip_check']); - $user_ip = short_ipv6($this->system['ip'], phpbb::$config['ip_check']); - } - else - { - $session_ip = implode('.', array_slice(explode('.', $this->data['session_ip']), 0, phpbb::$config['ip_check'])); - $user_ip = implode('.', array_slice(explode('.', $this->system['ip']), 0, phpbb::$config['ip_check'])); - } - - $session_browser = (phpbb::$config['browser_check']) ? trim(strtolower(substr($this->data['session_browser'], 0, 149))) : ''; - $user_browser = (phpbb::$config['browser_check']) ? trim(strtolower(substr($this->system['browser'], 0, 149))) : ''; - - $session_forwarded_for = (phpbb::$config['forwarded_for_check']) ? substr($this->data['session_forwarded_for'], 0, 254) : ''; - $user_forwarded_for = (phpbb::$config['forwarded_for_check']) ? substr($this->system['forwarded_for'], 0, 254) : ''; - - // referer checks - $check_referer_path = phpbb::$config['referer_validation'] == REFERER_VALIDATE_PATH; - $referer_valid = true; - - // we assume HEAD and TRACE to be foul play and thus only whitelist GET - if (phpbb::$config['referer_validation'] && $this->system['request_method']) - { - $referer_valid = $this->validate_referer($check_referer_path); - } - - if ($user_ip !== $session_ip || $user_browser !== $session_browser || $user_forwarded_for !== $session_forwarded_for || !$referer_valid) - { - // Added logging temporarly to help debug bugs... - if (phpbb::$base_config['debug_extra'] && $this->data['user_id'] != ANONYMOUS && $log_failure) - { - if ($referer_valid) - { - add_log('critical', 'LOG_IP_BROWSER_FORWARDED_CHECK', $user_ip, $session_ip, $user_browser, $session_browser, htmlspecialchars($user_forwarded_for), htmlspecialchars($session_forwarded_for)); - } - else - { - add_log('critical', 'LOG_REFERER_INVALID', $this->system['referer']); - } - } - - return false; - } - - return true; - } -} - -?>
\ No newline at end of file |