initialize repository; add docker config; migrate configuration to new specsHEADmaster

1 files changed, 143 insertions, 0 deletions

diff --git a/public/includes/sessions.php b/public/includes/sessions.php
new file mode 100644
index 0000000..d33aa30
--- /dev/null
+++ b/public/includes/sessions.php
@@ -0,0 +1,143 @@
+<?php
+// reset admin if needed
+/* ---
+  $user = "admin@kallassa.dev";
+  $pass = "1234!@!@";
+  $time = time();
+  $role = 5;
+  $salt = md5(rand(0,9999) .$time. rand(0,9999));
+  $pass = md5($user.$salt.$pass);
+  $name = "Θάλεια Μελίσσα";
+  $acid = 0;
+
+  // init database connection
+  $_dbc = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_DBMS);
+  if ($_dbc->connect_errno) {
+    $_cError = "Database connection failed; Please try in a few minutes. ";
+    if (TESTING) echo $_dbc->connect_error;
+    $_dbc->close(); die();
+  }
+  $_dbc->set_charset("utf8");
+
+  $_hack = $_dbc->prepare("INSERT INTO users (user, salt, pass, acid, role, birthstamp, realname) VALUES (?, ?, ?, ?, ?, ?, ?)");
+  $_hack->bind_param( "sssiids", $user, $salt, $pass, $acid, $role, $time, $name );
+  $_chk = $_hack->execute();
+  if ((TESTING) && (!$_chk))  echo "Database workaround failed; ". $_hack->error;
+  else                        echo "Workaround succeded!";
+  $_hack->close();
+  die();
+--- */
+
+
+
+// -- 00. INITIALIZATION ///////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////////
+
+session_name(MAIN_COOKIE);   // set a custom session name
+session_start();
+
+
+if ( (isset($_SESSION['user_status'])) && ($_SESSION['user_status'] == 1) ) {
+  define("ROLE", $_SESSION['role']);
+}
+else
+  define("ROLE", 0);
+
+// -- 01. Session Functions needed /////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////////
+
+// check session existance -----------------------------------------------------
+////////////////////////////////////////////////////////////////////////////////
+  function check_session_existance__() {
+      // session should exist from the first time of code
+      // what really matters is if has certain keys
+      if (!isset($_SESSION['user_status'])) {
+          $_SESSION['user_status'] = 0;
+      }
+  }
+
+// check and update SESSION ID -------------------------------------------------
+////////////////////////////////////////////////////////////////////////////////
+  function check_update_session__() {
+      if (!isset($_SESSION['sess_update'])) {
+          $_SESSION['sess_update'] = time() + SESSION_UPD;  // set sess_uddate limt if not exist
+      }
+      else if ($_SESSION['sess_update'] < time()) {   // session needs to update id to mitigate session fixation
+          session_regenerate_id();                          // change session ID (invalidate old session ID)
+          $_SESSION['sess_update'] = time() + SESSION_UPD;  // shall re-update after SESS_UPD seconds
+      }
+  }
+
+// check and remove SESSION if expired -----------------------------------------
+////////////////////////////////////////////////////////////////////////////////
+  function check_kill_session__() {
+
+    if (isset($_SESSION['sess_expire']) && ($_SESSION['sess_expire'] < time())) {
+        session_unset();     // unset $_SESSION variable for the run-time
+        session_destroy();   // destroy session data in storage before continue
+        session_start();
+        session_regenerate_id();
+
+        // TODO:
+        // should you save any data|indo before destroy?
+    }
+    $_SESSION['sess_expire'] = time() + SESSION_TTL;	  // set new expire limit;
+  }
+
+// common session data ---------------------------------------------------------
+// format: json | string | array | or other format of data
+// (includes data for user's browser via cookie)
+////////////////////////////////////////////////////////////////////////////////
+  function common_session_data__($format = 'json') {
+
+      if ((isset($_SESSION['uid'])) && (isset($_SESSION['role']))) {
+        $arr = array(
+          "uid"   => $_SESSION['uid'],
+          "name"  => $_SESSION['realname'],
+          "role"  => $_SESSION['role']
+        );
+      }
+      else $arr = array(
+        "uid" => '', "name" => '', "role" => ''
+      );
+
+      switch ($format) {
+        case 'array':
+            return $arr;
+            break;
+
+        case ('semicolon'):
+        case (';'):
+            return implode(";", $arr);
+            break;
+
+        default:
+            return json_encode($arr);
+            break;
+      }
+  }
+
+
+
+
+
+// -- 02. Handle Security Issues ///////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////////
+// do it every time nomater what
+
+check_session_existance__();
+
+check_kill_session__();
+
+check_update_session__();
+
+
+// check_login_attempts__()
+// check_inquire_attempts__()
+    // TODO
+    // all these should become a single function
+    // this function shall validate all session's keys
+    // print_r($_SESSION); die();