211 lines
7.2 KiB
PHP
211 lines
7.2 KiB
PHP
<?php
|
|
/*
|
|
+--------------------------------------------------------------------------
|
|
| CubeCart 4
|
|
| ========================================
|
|
| CubeCart is a registered trade mark of Devellion Limited
|
|
| Copyright Devellion Limited 2006. All rights reserved.
|
|
| Devellion Limited,
|
|
| 5 Bridge Street,
|
|
| Bishops Stortford,
|
|
| HERTFORDSHIRE.
|
|
| CM23 2JU
|
|
| UNITED KINGDOM
|
|
| http://www.devellion.com
|
|
| UK Private Limited Company No. 5323904
|
|
| ========================================
|
|
| Web: http://www.cubecart.com
|
|
| Email: info (at) cubecart (dot) com
|
|
| License Type: CubeCart is NOT Open Source Software and Limitations Apply
|
|
| Licence Info: http://www.cubecart.com/site/faq/license.php
|
|
+--------------------------------------------------------------------------
|
|
| cc_session.php
|
|
| ========================================
|
|
| Front Session Class
|
|
+--------------------------------------------------------------------------
|
|
*/
|
|
class session {
|
|
|
|
var $ccUserData;
|
|
var $ccUserBlocked = false;
|
|
|
|
var $config;
|
|
var $db;
|
|
var $glob;
|
|
var $ini;
|
|
|
|
function session() {
|
|
# $this->__construct();
|
|
#}
|
|
|
|
#function __construct() {
|
|
global $config, $db, $glob, $ini;
|
|
|
|
$this->config = $config;
|
|
$this->db = $db;
|
|
$this->glob = $glob;
|
|
$this->ini = $ini;
|
|
|
|
if (isset($_GET[CC_SESSION_NAME])) {
|
|
$this->set_cc_cookie(CC_SESSION_NAME, $_GET[CC_SESSION_NAME]);
|
|
} else {
|
|
## see if session is still in db
|
|
$query = sprintf("SELECT sessId FROM %sCubeCart_sessions WHERE sessId=%s", $this->glob['dbprefix'], $this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
|
|
|
$results = $this->db->select($query);
|
|
|
|
## !empty($results[0]['sessId']) critical incase reuslts=true if session DB table has an empty sessionId!!
|
|
if ($results && !empty($results[0]['sessId'])) {
|
|
$data["timeLast"] = $this->db->mySQLSafe(time());
|
|
$data["location"] = $this->db->mySQLSafe(currentPage());
|
|
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data, "sessId=".$this->db->mySQLSafe($results[0]['sessId']));
|
|
} else {
|
|
$this->makeSession();
|
|
}
|
|
}
|
|
|
|
## get all session data and store as class array
|
|
$query = sprintf("SELECT * FROM %1\$sCubeCart_sessions LEFT JOIN %1\$sCubeCart_customer ON %1\$sCubeCart_sessions.customer_id = %1\$sCubeCart_customer.customer_id WHERE sessId = %2\$s", $this->glob['dbprefix'], $this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
|
$result = $this->db->select($query);
|
|
// security checks
|
|
|
|
$client_ip = get_ip_address();
|
|
|
|
if (!empty($result[0]['ip']) && ($result[0]['ip'] !== $client_ip || $result[0]['browser'] !== $_SERVER['HTTP_USER_AGENT'])) {
|
|
$this->destroySession($GLOBALS[CC_SESSION_NAME]);
|
|
}
|
|
$this->ccUserData = $result[0];
|
|
|
|
if (empty($result[0]['lang'])) {
|
|
define("LANG_FOLDER", $this->config['defaultLang']);
|
|
} else {
|
|
define("LANG_FOLDER", $result[0]['lang']);
|
|
}
|
|
|
|
if (empty($result[0]['skin'])) {
|
|
define("SKIN_FOLDER", $this->config['skinDir']);
|
|
} else {
|
|
define("SKIN_FOLDER", $result[0]['skin']);
|
|
}
|
|
}
|
|
|
|
function destroySession($sessionId) {
|
|
setcookie(CC_SESSION_NAME);
|
|
$data["customer_id"] = '0';
|
|
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data,"sessId=".$this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
|
return ($update) ? true : false;
|
|
}
|
|
|
|
function makeSession() {
|
|
$sessionId = $this->makeSessId();
|
|
$this->set_cc_cookie(CC_SESSION_NAME, $sessionId);
|
|
|
|
## set session global var because cookie won't show until next page load
|
|
$GLOBALS[CC_SESSION_NAME] = $sessionId;
|
|
|
|
## insert sessionId into db
|
|
$data["sessId"] = $this->db->mySQLSafe($sessionId);
|
|
$timeNow = $this->db->mySQLSafe(time());
|
|
$data["timeStart"] = $timeNow;
|
|
$data["timeLast"] = $timeNow;
|
|
$data["customer_id"] = 0;
|
|
$data["ip"] = $this->db->mySQLSafe(get_ip_address());
|
|
$data["browser"] = $this->db->mySQLSafe($_SERVER['HTTP_USER_AGENT']);
|
|
|
|
$insert = $this->db->insert($this->glob['dbprefix']."CubeCart_sessions", $data);
|
|
$this->deleteOldSessions();
|
|
}
|
|
|
|
function deleteOldSessions() {
|
|
$expiredSessTime = time() - $this->config['sqlSessionExpiry'];
|
|
/* Stock on add to basket possibly for future
|
|
$this->reduce();
|
|
*/
|
|
## delete sessions older than time set in config file
|
|
$delete = $this->db->delete($this->glob['dbprefix']."CubeCart_sessions", "timeLast<".$expiredSessTime);
|
|
}
|
|
|
|
function authenticate($user, $pass, $remember = false) {
|
|
$user = sanitizeVar($user);
|
|
$pass = sanitizeVar($pass);
|
|
$query = "SELECT customer_id FROM ".$this->glob['dbprefix']."CubeCart_customer WHERE email=".$this->db->mySQLSafe($user)." AND password = ".$this->db->mySQLSafe(md5($pass))." AND type>0";
|
|
|
|
$customer = $this->db->select($query);
|
|
|
|
if (!$customer) {
|
|
if ($this->db->blocker($user, $this->ini['bfattempts'], $this->ini['bftime'], false, 'f')) {
|
|
$this->ccUserBlocked = true;
|
|
}
|
|
} else if ($customer[0]['customer_id']>0) {
|
|
|
|
// remember user for as long as sessions are allowed in DB
|
|
if ($remember == true) {
|
|
$this->set_cc_cookie(CC_SESSION_NAME, $GLOBALS[CC_SESSION_NAME], $this->config['sqlSessionExpiry']);
|
|
}
|
|
|
|
if ($this->db->blocker($user, $this->ini['bfattempts'], $this->ini['bftime'], true, 'f')) {
|
|
$this->ccUserBlocked = true;
|
|
} else {
|
|
$data["customer_id"] = $customer[0]['customer_id'];
|
|
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data,"sessId=".$this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
|
|
|
|
## "login","reg","unsubscribe","forgotPass" etc..
|
|
$redir = sanitizeVar(urldecode($_GET['redir']));
|
|
|
|
## prevent phishing attacks
|
|
if (eregi("^http://|^https://",$redir) && !eregi("^".$this->glob['storeURL']."|^".$this->config['storeURL_SSL'], $redir)) {
|
|
die("Redirect URL not allowed!");
|
|
}
|
|
if (isset($_GET['redir']) && !empty($_GET['redir']) && !eregi("logout|login|forgotPass|changePass", $redir)) {
|
|
httpredir($redir);
|
|
} else {
|
|
httpredir($GLOBALS['rootRel']."index.php");
|
|
}
|
|
}
|
|
} else if (eregi("step1", urldecode($_GET['redir']))) {
|
|
httpredir($GLOBALS['rootRel']."index.php?_g=co&_a=step1");
|
|
}
|
|
}
|
|
|
|
|
|
function makeSessId() {
|
|
session_start();
|
|
session_regenerate_id(true);
|
|
return session_id();
|
|
}
|
|
|
|
function get_cookie_domain($domain) {
|
|
$cookie_domain = str_replace(array('http://', 'https://', 'www.'), '', strtolower($domain));
|
|
$cookie_domain = explode("/", $cookie_domain);
|
|
$cookie_domain = explode(":", $cookie_domain[0]);
|
|
return '.'.$cookie_domain[0];
|
|
}
|
|
|
|
function set_cc_cookie($name, $value, $length = '') {
|
|
## only set the cookie if the visitor is not a spider or search engine system is off
|
|
if (!$this->user_is_search_engine() || $this->config['sef'] == false) {
|
|
$expires = ($length>0) ? (time()+$length) : 0;
|
|
setcookie($name, $value, $expires, $GLOBALS['rootRel']);
|
|
}
|
|
}
|
|
|
|
function user_is_search_engine() {
|
|
$user_agent = strtolower($_SERVER['HTTP_USER_AGENT']);
|
|
$spider_flag = false;
|
|
if (($user_agent != '') && (strtolower($user_agent) != 'null') && (strlen(trim($user_agent)) > 0)) {
|
|
$spiders = file(CC_ROOT_DIR.'/spiders.txt');
|
|
foreach ($spiders as $spider) {
|
|
if (($spider != '') && (strtolower($spider) != 'null') && (strlen(trim($spider)) > 0)) {
|
|
if (strpos($user_agent, trim($spider)) !== false) {
|
|
$spider_flag = TRUE;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return $spider_flag;
|
|
}
|
|
}
|
|
|
|
?>
|