Previous version was 2.1.3
Here’s the Session.php page:
<pre><code><?php if ( ! defined(‘BASEPATH’)) exit(‘No direct script access allowed’);
/**
* ExpressionEngine - by EllisLab
*
* @package ExpressionEngine
* @author ExpressionEngine Dev Team
* @copyright Copyright (c) 2003 - 2010, EllisLab, Inc.
* @license http://ellislab.com/expressionengine/user-guide/license.html
* @link http://expressionengine.com
* @since Version 2.0
* @filesource
*/
//————————————————————————————————————
/**
* ExpressionEngine Core Session Class
*
* @package ExpressionEngine
* @subpackage Core
* @category Core
* @author ExpressionEngine Dev Team
* @link http://expressionengine.com
*/
//————————————————————————————————————
/*
There are three validation types, set in the config file:
1. User cookies AND session ID (cs)
This is the most secure way to run a site. Three cookies are set:
1. Session ID - This is a unique hash that is randomly generated when someone logs in.
2. Password hash - The encrypted password of the current user
3. Unique ID - The permanent unique ID hash associated with the account.
All three cookies expire when you close your browser OR when you have been
inactive longer than two hours (one hour in the control panel).
Using this setting does NOT allow ‘stay logged-in’ capability, as each session has a finite lifespan.
2. Cookies only - no session ID (c)
With this validation type, a session is not generated, therefore
users can remain permanently logged in.
This setting is obviously less secure because it does not provide a safety net
if you share your computer or access your site from a public computer. It relies
solely on the password/unique_id cookies.
3. Session ID only (s).
Most compatible as it does not rely on cookies at all. Instead, a URL query string ID
is used.
No stay-logged in capability. The session will expire after one hour of inactivity, so
in terms of security, it is preferable to number 2.
NOTE: The control panel and public pages can each have their own session preference.
*/
class EE_Session {
var $user_session_len = 7200; // User sessions expire in two hours
var $cpan_session_len = 3600; // Admin sessions expire in one hour
var $c_session = 'sessionid';
var $c_uniqueid = 'uniqueid';
var $c_password = 'userhash';
var $c_expire = 'expiration';
var $c_anon = 'anon';
var $c_prefix = '';
var $sdata = array();
var $userdata = array();
var $tracker = array();
var $flashdata = array();
var $sess_crypt_key = '';
var $validation_type = '';
var $session_length = '';
var $cookies_exist = FALSE;
var $session_exists = FALSE;
var $access_cp = FALSE;
var $gc_probability = 5; // Garbage collection probability. Used to kill expired sessions.
var $cache = array(); // Store data for just this page load. Multi-dimensional array with module/class name, e.g. $SESS->cache['module']['var_name']
/**
* Session Class Constructor
*/
function __construct()
{
// Make a local reference to the ExpressionEngine super object
$this->EE =& get_instance();
// Is the user banned?
// We only look for banned IPs if it's not a control panel request.
// We test for banned admins separately in the front controller
$ban_status = FALSE;
if (REQ != 'CP')
{
if ($this->ban_check('ip'))
{
switch ($this->EE->config->item('ban_action'))
{
case 'message' : return $this->EE->output->fatal_error($this->EE->config->item('ban_message'), 0);
break;
case 'bounce' : $this->EE->functions->redirect($this->EE->config->item('ban_destination')); exit;
break;
default : $ban_status = TRUE;
break;
}
}
}
/**———————————————————
/** Set session length.
/**———————————————————*/
$this->session_length = (REQ == ‘CP’) ? $this->cpan_session_len : $this->user_session_len;
/**———————————————————
/** Set Default Session Values
/**———————————————————*/
// Set USER-DATA as GUEST until proven otherwise
$this->userdata = array(
‘username’ => $this->EE->input->cookie(‘my_name’),
‘screen_name’ => ‘’,
‘email’ => $this->EE->input->cookie(‘my_email’),
‘url’ => $this->EE->input->cookie(‘my_url’),
‘location’ => $this->EE->input->cookie(‘my_location’),
‘language’ => ‘’,
‘timezone’ => ($this->EE->config->item(‘default_site_timezone’) && $this->EE->config->item(‘default_site_timezone’) != ‘’) ? $this->EE->config->item(‘default_site_timezone’) : $this->EE->config->item(‘server_timezone’),
‘daylight_savings’ => ($this->EE->config->item(‘default_site_dst’) && $this->EE->config->item(‘default_site_dst’) != ‘’) ? $this->EE->config->item(‘default_site_dst’) : $this->EE->config->item(‘daylight_savings’),
‘time_format’ => ($this->EE->config->item(‘time_format’) && $this->EE->config->item(‘time_format’) != ‘’) ? $this->EE->config->item(‘time_format’) : ‘us’,
‘group_id’ => ‘3’,
‘access_cp’ => 0,
‘last_visit’ => 0,
‘is_banned’ => $ban_status,
‘ignore_list’ => array()
);
// Set SESSION data as GUEST until proven otherwise
$this->sdata = array(
‘session_id’ => 0,
‘member_id’ => 0,
‘admin_sess’ => 0,
‘ip_address’ => $this->EE->input->ip_address(),
‘user_agent’ => substr($this->EE->input->user_agent(), 0, 50),
‘last_activity’ => 0
);
//—————————————————————-
// ‘sessions_start’ hook.
// - Reset any session class variable
// - Override the whole session check
// - Modify default/guest settings
//
$edata = $this->EE->extensions->universal_call(‘sessions_start’, $this);
if ($this->E