classes/plsession.php

   1 <?php
   2 /***************************************************************************
   3  *  Copyright (C) 2003-2008 Polytechnique.org                              *
   4  *  http://opensource.polytechnique.org/                                   *
   5  *                                                                         *
   6  *  This program is free software; you can redistribute it and/or modify   *
   7  *  it under the terms of the GNU General Public License as published by   *
   8  *  the Free Software Foundation; either version 2 of the License, or      *
   9  *  (at your option) any later version.                                    *
  10  *                                                                         *
  11  *  This program is distributed in the hope that it will be useful,        *
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of         *
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          *
  14  *  GNU General Public License for more details.                           *
  15  *                                                                         *
  16  *  You should have received a copy of the GNU General Public License      *
  17  *  along with this program; if not, write to the Free Software            *
  18  *  Foundation, Inc.,                                                      *
  19  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA                *
  20  ***************************************************************************/
  21
  22
  23 /** The PlSession is a wrapper around the user session management.
  24  */
  25 abstract class PlSession
  26 {
  27     /** Build a new session object.
  28      * If a session is already started, this just wraps the session... if no
  29      * session is currently started, this set the base session variables.
  30      *  * auth        contains the current authentication level. The level is
  31      *                an integer that grows with the security of the authentication
  32      *                method.
  33      *  * perms       contains the current permission flags of the user. This flags
  34      *                depends on the category of the user.
  35      *  * challenge   contains a random uniq id for authentication.
  36      *  * xsrf_token  contains a random uniq id for xsrf prevention.
  37      *  * user        contains a reference to the current user.
  38      */
  39     public function __construct()
  40     {
  41         session_start();
  42         $this->fillSession();
  43     }
  44
  45     /** Build the session structure with system fields.
  46      */
  47     private function fillSession()
  48     {
  49         S::bootstrap('user', null);
  50         S::bootstrap('auth', AUTH_PUBLIC);
  51         S::bootstrap('challenge', sha1(uniqid(rand(), true)));
  52         S::bootstrap('xsrf_token', rand_url_id());
  53         S::bootstrap('perms', new PlFlagSet());
  54     }
  55
  56     /** Write current session and close it.
  57      */
  58     public function close()
  59     {
  60         session_write_close();
  61     }
  62
  63     /** Kill the current session.
  64      */
  65     public function destroy()
  66     {
  67         session_destroy();
  68         unset($_SESSION);
  69     }
  70
  71     /** Check if the user has at least the given authentication level.
  72      */
  73     public function checkAuth($level)
  74     {
  75         return S::i('auth') >= $level;
  76     }
  77
  78     /** Check if the user has the given permissions.
  79      */
  80     public function checkPerms($perms)
  81     {
  82         return S::v('perms')->hasFlagCombination($perms);
  83     }
  84
  85     /** Run authentication procedure to reach at least the given level.
  86      */
  87     public function start($level)
  88     {
  89         if ($this->checkAuth($level)) {
  90             return true;
  91         }
  92         $user = $this->doAuth($level);
  93         if (is_null($user) || !$this->checkAuth($level)) {
  94             return false;
  95         }
  96         if ($this->startSessionAs($user, $level)) {
  97             if (is_null(S::v('user'))) {
  98                 S::set('user', $user);
  99             }
 100             return true;
 101         } else {
 102             $this->destroy();
 103         }
 104         return false;
 105     }
 106
 107
 108     /*** Abstract methods ***/
 109
 110     /** Run the effectively authentication procedure to reach the given user.
 111      * This method must return a user object (that will be used to fill the
 112      * $_SESSION['user'] field).
 113      *
 114      * If auth failed, the function MUST return null. If auth succeed, the
 115      * field $_SESSION['auth'] MUST be filled to the current effective level.
 116      */
 117     abstract protected function doAuth($level);
 118
 119     /** Set the session environment to the given user and authentication level.
 120      * This function MUST return false if a session is already started and the
 121      * user mismatch.
 122      *
 123      * On succes, this function MUST return true.
 124      * If $level is set to -1, this means you are building a new SUID session.
 125      */
 126     abstract protected function startSessionAs($user, $level);
 127
 128
 129     /*** SUID management ***/
 130
 131     /** Start a new SUID session.
 132      */
 133     public function startSUID($user)
 134     {
 135         if (isset($_SESSION['suid'])) {
 136             return false;
 137         }
 138         $newsession = array();
 139         $backup   =& $_SESSION;
 140         $_SESSION =& $newsession;
 141         $this->fillSession();
 142         S::set('suid', $backup);
 143         if (!$this->startSessionAs($user, -1)) {
 144             $this->stopSUID();
 145             return false;
 146         }
 147         return true;
 148     }
 149
 150     /** Stop a SUID session
 151      */
 152     public function stopSUID()
 153     {
 154         if (!isset($_SESSION['suid'])) {
 155             return false;
 156         }
 157         $_SESSION =& $_SESSION['suid'];
 158         return true;
 159     }
 160
 161
 162     /*** Thresholds ***/
 163
 164     /** Minimum level of authentication that is considered as sure.
 165      */
 166     abstract public function sureLevel();
 167 }
 168
 169 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8:
 170 ?>