1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
<?php
// reset admin if needed
/* ---
$user = "admin@kallassa.dev";
$pass = "1234!@!@";
$time = time();
$role = 5;
$salt = md5(rand(0,9999) .$time. rand(0,9999));
$pass = md5($user.$salt.$pass);
$name = "Θάλεια Μελίσσα";
$acid = 0;
// init database connection
$_dbc = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_DBMS);
if ($_dbc->connect_errno) {
$_cError = "Database connection failed; Please try in a few minutes. ";
if (TESTING) echo $_dbc->connect_error;
$_dbc->close(); die();
}
$_dbc->set_charset("utf8");
$_hack = $_dbc->prepare("INSERT INTO users (user, salt, pass, acid, role, birthstamp, realname) VALUES (?, ?, ?, ?, ?, ?, ?)");
$_hack->bind_param( "sssiids", $user, $salt, $pass, $acid, $role, $time, $name );
$_chk = $_hack->execute();
if ((TESTING) && (!$_chk)) echo "Database workaround failed; ". $_hack->error;
else echo "Workaround succeded!";
$_hack->close();
die();
--- */
// -- 00. INITIALIZATION ///////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
session_name(MAIN_COOKIE); // set a custom session name
session_start();
if ( (isset($_SESSION['user_status'])) && ($_SESSION['user_status'] == 1) ) {
define("ROLE", $_SESSION['role']);
}
else
define("ROLE", 0);
// -- 01. Session Functions needed /////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
// check session existance -----------------------------------------------------
////////////////////////////////////////////////////////////////////////////////
function check_session_existance__() {
// session should exist from the first time of code
// what really matters is if has certain keys
if (!isset($_SESSION['user_status'])) {
$_SESSION['user_status'] = 0;
}
}
// check and update SESSION ID -------------------------------------------------
////////////////////////////////////////////////////////////////////////////////
function check_update_session__() {
if (!isset($_SESSION['sess_update'])) {
$_SESSION['sess_update'] = time() + SESSION_UPD; // set sess_uddate limt if not exist
}
else if ($_SESSION['sess_update'] < time()) { // session needs to update id to mitigate session fixation
session_regenerate_id(); // change session ID (invalidate old session ID)
$_SESSION['sess_update'] = time() + SESSION_UPD; // shall re-update after SESS_UPD seconds
}
}
// check and remove SESSION if expired -----------------------------------------
////////////////////////////////////////////////////////////////////////////////
function check_kill_session__() {
if (isset($_SESSION['sess_expire']) && ($_SESSION['sess_expire'] < time())) {
session_unset(); // unset $_SESSION variable for the run-time
session_destroy(); // destroy session data in storage before continue
session_start();
session_regenerate_id();
// TODO:
// should you save any data|indo before destroy?
}
$_SESSION['sess_expire'] = time() + SESSION_TTL; // set new expire limit;
}
// common session data ---------------------------------------------------------
// format: json | string | array | or other format of data
// (includes data for user's browser via cookie)
////////////////////////////////////////////////////////////////////////////////
function common_session_data__($format = 'json') {
if ((isset($_SESSION['uid'])) && (isset($_SESSION['role']))) {
$arr = array(
"uid" => $_SESSION['uid'],
"name" => $_SESSION['realname'],
"role" => $_SESSION['role']
);
}
else $arr = array(
"uid" => '', "name" => '', "role" => ''
);
switch ($format) {
case 'array':
return $arr;
break;
case ('semicolon'):
case (';'):
return implode(";", $arr);
break;
default:
return json_encode($arr);
break;
}
}
// -- 02. Handle Security Issues ///////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
// do it every time nomater what
check_session_existance__();
check_kill_session__();
check_update_session__();
// check_login_attempts__()
// check_inquire_attempts__()
// TODO
// all these should become a single function
// this function shall validate all session's keys
// print_r($_SESSION); die();
|
