Initial commit
This commit is contained in:
Ben Ramey
210
production/classes/session/cc_session.php
Normal file
210
production/classes/session/cc_session.php
Normal file
@@ -0,0 +1,210 @@
|
||||
<?php
|
||||
/*
|
||||
+--------------------------------------------------------------------------
|
||||
| CubeCart 4
|
||||
| ========================================
|
||||
| CubeCart is a registered trade mark of Devellion Limited
|
||||
| Copyright Devellion Limited 2006. All rights reserved.
|
||||
| Devellion Limited,
|
||||
| 5 Bridge Street,
|
||||
| Bishops Stortford,
|
||||
| HERTFORDSHIRE.
|
||||
| CM23 2JU
|
||||
| UNITED KINGDOM
|
||||
| http://www.devellion.com
|
||||
| UK Private Limited Company No. 5323904
|
||||
| ========================================
|
||||
| Web: http://www.cubecart.com
|
||||
| Email: info (at) cubecart (dot) com
|
||||
| License Type: CubeCart is NOT Open Source Software and Limitations Apply
|
||||
| Licence Info: http://www.cubecart.com/site/faq/license.php
|
||||
+--------------------------------------------------------------------------
|
||||
| cc_session.php
|
||||
| ========================================
|
||||
| Front Session Class
|
||||
+--------------------------------------------------------------------------
|
||||
*/
|
||||
class session {
|
||||
|
||||
var $ccUserData;
|
||||
var $ccUserBlocked = false;
|
||||
|
||||
var $config;
|
||||
var $db;
|
||||
var $glob;
|
||||
var $ini;
|
||||
|
||||
function session() {
|
||||
# $this->__construct();
|
||||
#}
|
||||
|
||||
#function __construct() {
|
||||
global $config, $db, $glob, $ini;
|
||||
|
||||
$this->config = $config;
|
||||
$this->db = $db;
|
||||
$this->glob = $glob;
|
||||
$this->ini = $ini;
|
||||
|
||||
if (isset($_GET[CC_SESSION_NAME])) {
|
||||
$this->set_cc_cookie(CC_SESSION_NAME, $_GET[CC_SESSION_NAME]);
|
||||
} else {
|
||||
## see if session is still in db
|
||||
$query = sprintf("SELECT sessId FROM %sCubeCart_sessions WHERE sessId=%s", $this->glob['dbprefix'], $this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
||||
|
||||
$results = $this->db->select($query);
|
||||
|
||||
## !empty($results[0]['sessId']) critical incase reuslts=true if session DB table has an empty sessionId!!
|
||||
if ($results && !empty($results[0]['sessId'])) {
|
||||
$data["timeLast"] = $this->db->mySQLSafe(time());
|
||||
$data["location"] = $this->db->mySQLSafe(currentPage());
|
||||
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data, "sessId=".$this->db->mySQLSafe($results[0]['sessId']));
|
||||
} else {
|
||||
$this->makeSession();
|
||||
}
|
||||
}
|
||||
|
||||
## get all session data and store as class array
|
||||
$query = sprintf("SELECT * FROM %1\$sCubeCart_sessions LEFT JOIN %1\$sCubeCart_customer ON %1\$sCubeCart_sessions.customer_id = %1\$sCubeCart_customer.customer_id WHERE sessId = %2\$s", $this->glob['dbprefix'], $this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
||||
$result = $this->db->select($query);
|
||||
// security checks
|
||||
|
||||
$client_ip = get_ip_address();
|
||||
|
||||
if (!empty($result[0]['ip']) && ($result[0]['ip'] !== $client_ip || $result[0]['browser'] !== $_SERVER['HTTP_USER_AGENT'])) {
|
||||
$this->destroySession($GLOBALS[CC_SESSION_NAME]);
|
||||
}
|
||||
$this->ccUserData = $result[0];
|
||||
|
||||
if (empty($result[0]['lang'])) {
|
||||
define("LANG_FOLDER", $this->config['defaultLang']);
|
||||
} else {
|
||||
define("LANG_FOLDER", $result[0]['lang']);
|
||||
}
|
||||
|
||||
if (empty($result[0]['skin'])) {
|
||||
define("SKIN_FOLDER", $this->config['skinDir']);
|
||||
} else {
|
||||
define("SKIN_FOLDER", $result[0]['skin']);
|
||||
}
|
||||
}
|
||||
|
||||
function destroySession($sessionId) {
|
||||
setcookie(CC_SESSION_NAME);
|
||||
$data["customer_id"] = '0';
|
||||
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data,"sessId=".$this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
||||
return ($update) ? true : false;
|
||||
}
|
||||
|
||||
function makeSession() {
|
||||
$sessionId = $this->makeSessId();
|
||||
$this->set_cc_cookie(CC_SESSION_NAME, $sessionId);
|
||||
|
||||
## set session global var because cookie won't show until next page load
|
||||
$GLOBALS[CC_SESSION_NAME] = $sessionId;
|
||||
|
||||
## insert sessionId into db
|
||||
$data["sessId"] = $this->db->mySQLSafe($sessionId);
|
||||
$timeNow = $this->db->mySQLSafe(time());
|
||||
$data["timeStart"] = $timeNow;
|
||||
$data["timeLast"] = $timeNow;
|
||||
$data["customer_id"] = 0;
|
||||
$data["ip"] = $this->db->mySQLSafe(get_ip_address());
|
||||
$data["browser"] = $this->db->mySQLSafe($_SERVER['HTTP_USER_AGENT']);
|
||||
|
||||
$insert = $this->db->insert($this->glob['dbprefix']."CubeCart_sessions", $data);
|
||||
$this->deleteOldSessions();
|
||||
}
|
||||
|
||||
function deleteOldSessions() {
|
||||
$expiredSessTime = time() - $this->config['sqlSessionExpiry'];
|
||||
/* Stock on add to basket possibly for future
|
||||
$this->reduce();
|
||||
*/
|
||||
## delete sessions older than time set in config file
|
||||
$delete = $this->db->delete($this->glob['dbprefix']."CubeCart_sessions", "timeLast<".$expiredSessTime);
|
||||
}
|
||||
|
||||
function authenticate($user, $pass, $remember = false) {
|
||||
$user = sanitizeVar($user);
|
||||
$pass = sanitizeVar($pass);
|
||||
$query = "SELECT customer_id FROM ".$this->glob['dbprefix']."CubeCart_customer WHERE email=".$this->db->mySQLSafe($user)." AND password = ".$this->db->mySQLSafe(md5($pass))." AND type>0";
|
||||
|
||||
$customer = $this->db->select($query);
|
||||
|
||||
if (!$customer) {
|
||||
if ($this->db->blocker($user, $this->ini['bfattempts'], $this->ini['bftime'], false, 'f')) {
|
||||
$this->ccUserBlocked = true;
|
||||
}
|
||||
} else if ($customer[0]['customer_id']>0) {
|
||||
|
||||
// remember user for as long as sessions are allowed in DB
|
||||
if ($remember == true) {
|
||||
$this->set_cc_cookie(CC_SESSION_NAME, $GLOBALS[CC_SESSION_NAME], $this->config['sqlSessionExpiry']);
|
||||
}
|
||||
|
||||
if ($this->db->blocker($user, $this->ini['bfattempts'], $this->ini['bftime'], true, 'f')) {
|
||||
$this->ccUserBlocked = true;
|
||||
} else {
|
||||
$data["customer_id"] = $customer[0]['customer_id'];
|
||||
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data,"sessId=".$this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
||||
|
||||
## "login","reg","unsubscribe","forgotPass" etc..
|
||||
$redir = sanitizeVar(urldecode($_GET['redir']));
|
||||
|
||||
## prevent phishing attacks
|
||||
if (eregi("^http://|^https://",$redir) && !eregi("^".$this->glob['storeURL']."|^".$this->config['storeURL_SSL'], $redir)) {
|
||||
die("Redirect URL not allowed!");
|
||||
}
|
||||
if (isset($_GET['redir']) && !empty($_GET['redir']) && !eregi("logout|login|forgotPass|changePass", $redir)) {
|
||||
httpredir($redir);
|
||||
} else {
|
||||
httpredir($GLOBALS['rootRel']."index.php");
|
||||
}
|
||||
}
|
||||
} else if (eregi("step1", urldecode($_GET['redir']))) {
|
||||
httpredir($GLOBALS['rootRel']."index.php?_g=co&_a=step1");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function makeSessId() {
|
||||
session_start();
|
||||
session_regenerate_id(true);
|
||||
return session_id();
|
||||
}
|
||||
|
||||
function get_cookie_domain($domain) {
|
||||
$cookie_domain = str_replace(array('http://', 'https://', 'www.'), '', strtolower($domain));
|
||||
$cookie_domain = explode("/", $cookie_domain);
|
||||
$cookie_domain = explode(":", $cookie_domain[0]);
|
||||
return '.'.$cookie_domain[0];
|
||||
}
|
||||
|
||||
function set_cc_cookie($name, $value, $length = '') {
|
||||
## only set the cookie if the visitor is not a spider or search engine system is off
|
||||
if (!$this->user_is_search_engine() || $this->config['sef'] == false) {
|
||||
$expires = ($length>0) ? (time()+$length) : 0;
|
||||
setcookie($name, $value, $expires, $GLOBALS['rootRel']);
|
||||
}
|
||||
}
|
||||
|
||||
function user_is_search_engine() {
|
||||
$user_agent = strtolower($_SERVER['HTTP_USER_AGENT']);
|
||||
$spider_flag = false;
|
||||
if (($user_agent != '') && (strtolower($user_agent) != 'null') && (strlen(trim($user_agent)) > 0)) {
|
||||
$spiders = file(CC_ROOT_DIR.'/spiders.txt');
|
||||
foreach ($spiders as $spider) {
|
||||
if (($spider != '') && (strtolower($spider) != 'null') && (strlen(trim($spider)) > 0)) {
|
||||
if (strpos($user_agent, trim($spider)) !== false) {
|
||||
$spider_flag = TRUE;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return $spider_flag;
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
Reference in New Issue
Block a user