diff --git a/classes/context/Context.class.php b/classes/context/Context.class.php index 8ea34a771..cc46efcfa 100644 --- a/classes/context/Context.class.php +++ b/classes/context/Context.class.php @@ -338,7 +338,7 @@ class Context array(&$oSessionController, 'open'), array(&$oSessionController, 'close'), array(&$oSessionModel, 'read'), array(&$oSessionController, 'write'), array(&$oSessionController, 'destroy'), array(&$oSessionController, 'gc') ); } - + // start session if it was previously started $session_name = session_name(); $session_id = NULL; @@ -354,7 +354,8 @@ class Context if($session_id !== NULL || !config('session.delay')) { $this->setCacheControl(0, false); - session_start(); + $relax_key_checks = ($this->act === 'procFileUpload' && preg_match('/shockwave\s?flash/i', $_SERVER['HTTP_USER_AGENT'])); + Rhymix\Framework\Session::start($relax_key_checks); } else { @@ -376,7 +377,7 @@ class Context if($oMemberController && $oMemberModel) { // if signed in, validate it. - if($oMemberModel->isLogged()) + if(Rhymix\Framework\Session::getMemberSrl()) { $oMemberController->setSessionInfo(); } @@ -385,12 +386,9 @@ class Context { $oMemberController->doAutologin(); } - + self::set('is_logged', $oMemberModel->isLogged()); - if($oMemberModel->isLogged()) - { - self::set('logged_info', $oMemberModel->getLoggedInfo()); - } + self::set('logged_info', $oMemberModel->getLoggedInfo()); } } @@ -428,7 +426,7 @@ class Context */ public static function getSessionStatus() { - return (session_id() !== ''); + return Rhymix\Framework\Session::isStarted(); } /** @@ -446,8 +444,14 @@ class Context { $tempSession = $_SESSION; unset($_SESSION); - session_start(); - $_SESSION = $tempSession; + Rhymix\Framework\Session::start(); + foreach ($tempSession as $key => $val) + { + if ($key !== 'RHYMIX') + { + $_SESSION[$key] = $val; + } + } return true; } return false; @@ -469,7 +473,7 @@ class Context // Check session status and close it if open. if (self::checkSessionStatus()) { - session_write_close(); + Rhymix\Framework\Session::close(); } } diff --git a/common/framework/session.php b/common/framework/session.php index 84a3bc36d..bffba0b63 100644 --- a/common/framework/session.php +++ b/common/framework/session.php @@ -11,6 +11,7 @@ class Session * Properties for internal use only. */ protected static $_started = false; + protected static $_member_info = false; /** * Get a session variable. @@ -83,6 +84,9 @@ class Session return false; } + // Mark the session as started. + self::$_started = true; + // Fetch session keys. list($key1, $key2) = self::_getKeys(); $must_create = $must_refresh = $must_resend_keys = false; @@ -131,12 +135,6 @@ class Session } } - // Check the IP address. - if (!$must_create && !Filters\IpFilter::inRange(\RX_CLIENT_IP, $_SESSION['RHYMIX']['ipaddress'])) - { - $must_create = true; - } - // Check the refresh interval. if (!$must_create && $_SESSION['RHYMIX']['keys'][$domain]['key1_time'] < time() - $refresh_interval && !$relax_key_checks) { @@ -178,6 +176,7 @@ class Session // Ensure backward compatibility with XE session. $member_srl = $_SESSION['member_srl'] ?: false; $_SESSION['is_logged'] = (bool)$member_srl; + $_SESSION['is_admin'] = ''; // Create the data structure for a new Rhymix session. $_SESSION['RHYMIX'] = array(); @@ -300,7 +299,17 @@ class Session { $_SESSION['RHYMIX']['login'] = $_SESSION['member_srl'] = false; $_SESSION['is_logged'] = false; - self::refresh(); + self::destroy(); + } + + /** + * Check if the session has been started. + * + * @return bool + */ + public static function isStarted() + { + return self::$_started; } /** @@ -324,7 +333,8 @@ class Session */ public static function isAdmin() { - + $member_info = self::getMemberInfo(); + return ($member_info && $member_info->is_admin === 'Y'); } /** @@ -373,7 +383,21 @@ class Session */ public static function getMemberInfo() { + // Return false if the current user is not logged in. + $member_srl = self::getMemberSrl(); + if (!$member_srl) + { + return false; + } + // Create a member info object. + if (!self::$_member_info) + { + !self::$_member_info = getModel('member')->getMemberInfoByMemberSrl($member_srl); + } + + // Return the member info object. + return self::$_member_info; } /** diff --git a/modules/member/member.controller.php b/modules/member/member.controller.php index 915a25a04..8a9a626c6 100644 --- a/modules/member/member.controller.php +++ b/modules/member/member.controller.php @@ -101,7 +101,8 @@ class memberController extends member if(!$trigger_output->toBool()) return $trigger_output; // Destroy session information - $this->destroySessionInfo(); + Rhymix\Framework\Session::logout(); + $this->_clearMemberCache($logged_info->member_srl); // Call a trigger after log-out (after) ModuleHandler::triggerCall('member.doLogout', 'after', $logged_info); @@ -111,9 +112,9 @@ class memberController extends member $oModuleModel = getModel('module'); $config = $oModuleModel->getModuleConfig('member'); if($config->after_logout_url) + { $output->redirect_url = $config->after_logout_url; - - $this->_clearMemberCache($logged_info->member_srl); + } return $output; } @@ -700,7 +701,7 @@ class memberController extends member $output = $this->deleteMember($member_srl); if(!$output->toBool()) return $output; // Destroy all session information - $this->destroySessionInfo(); + Rhymix\Framework\Session::logout(); // Return success message $this->setMessage('success_leaved'); @@ -1844,6 +1845,7 @@ class memberController extends member } $this->setSessionInfo(); + Rhymix\Framework\Session::login($this->memberInfo->member_srl); return $output; } @@ -1855,11 +1857,11 @@ class memberController extends member $oMemberModel = getModel('member'); $config = $oMemberModel->getMemberConfig(); // If your information came through the current session information to extract information from the users - if(!$this->memberInfo && $_SESSION['member_srl'] && $oMemberModel->isLogged() ) + if(!$this->memberInfo && $member_srl = Rhymix\Framework\Session::getMemberSrl()) { - $this->memberInfo = $oMemberModel->getMemberInfoByMemberSrl($_SESSION['member_srl']); + $this->memberInfo = $oMemberModel->getMemberInfoByMemberSrl($member_srl); // If you do not destroy the session Profile - if($this->memberInfo->member_srl != $_SESSION['member_srl']) + if($this->memberInfo->member_srl != $member_srl) { $this->destroySessionInfo(); return; @@ -1872,11 +1874,11 @@ class memberController extends member return; } // Log in for treatment sessions set + /* $_SESSION['is_logged'] = true; - $_SESSION['ipaddress'] = $_SERVER['REMOTE_ADDR']; - $_SESSION['member_srl'] = $this->memberInfo->member_srl; + $_SESSION['member_srl'] = $_SESSION['RHYMIX']['login'] = $this->memberInfo->member_srl; $_SESSION['is_admin'] = ''; - setcookie('xe_logged', 'true', 0, '/'); + */ // Do not save your password in the session jiwojum;; //unset($this->memberInfo->password); // User Group Settings @@ -2582,7 +2584,7 @@ class memberController extends member $_SESSION[$key] = ''; } - session_destroy(); + Rhymix\Framework\Session::destroy(); setcookie(session_name(), '', $_SERVER['REQUEST_TIME']-42000, '/'); setcookie('sso','',$_SERVER['REQUEST_TIME']-42000, '/'); setcookie('xeak','',$_SERVER['REQUEST_TIME']-42000, '/'); diff --git a/modules/member/member.model.php b/modules/member/member.model.php index 93191b070..471437ce8 100644 --- a/modules/member/member.model.php +++ b/modules/member/member.model.php @@ -200,36 +200,9 @@ class memberModel extends member /** * @brief Check if logged-in */ - function isLogged() { - if($_SESSION['is_logged']) - { - if(Mobile::isFromMobilePhone()) - { - return true; - } - elseif(filter_var($_SESSION['ipaddress'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) - { - // IPv6: require same /48 - if(strncmp(inet_pton($_SESSION['ipaddress']), inet_pton($_SERVER['REMOTE_ADDR']), 6) == 0) - { - return true; - } - } - else - { - // IPv4: require same /24 - if(ip2long($_SESSION['ipaddress']) >> 8 == ip2long($_SERVER['REMOTE_ADDR']) >> 8) - { - return true; - } - } - } - - if(Context::getSessionStatus()) - { - $_SESSION['is_logged'] = false; - } - return false; + function isLogged() + { + return Rhymix\Framework\Session::getMemberSrl() ? true : false; } /** @@ -238,7 +211,7 @@ class memberModel extends member function getLoggedInfo() { // Return session info if session info is requested and the user is logged-in - if($this->isLogged()) + if(Rhymix\Framework\Session::getMemberSrl()) { $logged_info = Context::get('logged_info'); // Admin/Group list defined depending on site_module_info @@ -462,8 +435,7 @@ class memberModel extends member */ function getLoggedMemberSrl() { - if(!$this->isLogged()) return; - return $_SESSION['member_srl']; + return Rhymix\Framework\Session::getMemberSrl(); } /**