ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: home / beestk / sdx / wp-includes

<?php
/**
 * Session API: WP_Session_Tokens class
 *
 * @package WordPress
 * @subpackage Session
 * @since 4.7.0
 */

/**
 * Abstract class for managing user session tokens.
 *
 * @since 4.0.0
 */
abstract class WP_Session_Tokens {

/**
	 * User ID.
	 *
	 * @since 4.0.0
	 * @var int User ID.
	 */
	protected $user_id;

/**
	 * Protected constructor.
	 *
	 * @since 4.0.0
	 *
	 * @param int $user_id User whose session to manage.
	 */
	protected function __construct( $user_id ) {
		$this->user_id = $user_id;
	}

/**
	 * Retrieves a session token manager instance for a user.
	 *
	 * This method contains a {@see 'session_token_manager'} filter, allowing a plugin to swap out
	 * the session manager for a subclass of `WP_Session_Tokens`.
	 *
	 * @since 4.0.0
	 * @static
	 *
	 * @param int $user_id User whose session to manage.
	 * @return WP_User_Meta_Session_Tokens WP_User_Meta_Session_Tokens class instance by default.
	 */
	final public static function get_instance( $user_id ) {
		/**
		 * Filters the session token manager used.
		 *
		 * @since 4.0.0
		 *
		 * @param string $session Name of class to use as the manager.
		 *                        Default 'WP_User_Meta_Session_Tokens'.
		 */
		$manager = apply_filters( 'session_token_manager', 'WP_User_Meta_Session_Tokens' );
		return new $manager( $user_id );
	}

/**
	 * Hashes a session token for storage.
	 *
	 * @since 4.0.0
	 *
	 * @param string $token Session token to hash.
	 * @return string A hash of the session token (a verifier).
	 */
	final private function hash_token( $token ) {
		// If ext/hash is not present, use sha1() instead.
		if ( function_exists( 'hash' ) ) {
			return hash( 'sha256', $token );
		} else {
			return sha1( $token );
		}
	}

/**
	 * Get a user's session.
	 *
	 * @since 4.0.0
	 *
	 * @param string $token Session token
	 * @return array User session
	 */
	final public function get( $token ) {
		$verifier = $this->hash_token( $token );
		return $this->get_session( $verifier );
	}

/**
	 * Validate a user's session token as authentic.
	 *
	 * Checks that the given token is present and hasn't expired.
	 *
	 * @since 4.0.0
	 *
	 * @param string $token Token to verify.
	 * @return bool Whether the token is valid for the user.
	 */
	final public function verify( $token ) {
		$verifier = $this->hash_token( $token );
		return (bool) $this->get_session( $verifier );
	}

/**
	 * Generate a session token and attach session information to it.
	 *
	 * A session token is a long, random string. It is used in a cookie
	 * link that cookie to an expiration time and to ensure the cookie
	 * becomes invalidated upon logout.
	 *
	 * This function generates a token and stores it with the associated
	 * expiration time (and potentially other session information via the
	 * {@see 'attach_session_information'} filter).
	 *
	 * @since 4.0.0
	 *
	 * @param int $expiration Session expiration timestamp.
	 * @return string Session token.
	 */
	final public function create( $expiration ) {
		/**
		 * Filters the information attached to the newly created session.
		 *
		 * Could be used in the future to attach information such as
		 * IP address or user agent to a session.
		 *
		 * @since 4.0.0
		 *
		 * @param array $session Array of extra data.
		 * @param int   $user_id User ID.
		 */
		$session = apply_filters( 'attach_session_information', array(), $this->user_id );
		$session['expiration'] = $expiration;

// IP address.
		if ( !empty( $_SERVER['REMOTE_ADDR'] ) ) {
			$session['ip'] = $_SERVER['REMOTE_ADDR'];
		}

// User-agent.
		if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) ) {
			$session['ua'] = wp_unslash( $_SERVER['HTTP_USER_AGENT'] );
		}

// Timestamp
		$session['login'] = time();

$token = wp_generate_password( 43, false, false );

$this->update( $token, $session );

return $token;
	}

/**
	 * Update a session token.
	 *
	 * @since 4.0.0
	 *
	 * @param string $token Session token to update.
	 * @param array  $session Session information.
	 */
	final public function update( $token, $session ) {
		$verifier = $this->hash_token( $token );
		$this->update_session( $verifier, $session );
	}

/**
	 * Destroy a session token.
	 *
	 * @since 4.0.0
	 *
	 * @param string $token Session token to destroy.
	 */
	final public function destroy( $token ) {
		$verifier = $this->hash_token( $token );
		$this->update_session( $verifier, null );
	}

/**
	 * Destroy all session tokens for this user,
	 * except a single token, presumably the one in use.
	 *
	 * @since 4.0.0
	 *
	 * @param string $token_to_keep Session token to keep.
	 */
	final public function destroy_others( $token_to_keep ) {
		$verifier = $this->hash_token( $token_to_keep );
		$session = $this->get_session( $verifier );
		if ( $session ) {
			$this->destroy_other_sessions( $verifier );
		} else {
			$this->destroy_all_sessions();
		}
	}

/**
	 * Determine whether a session token is still valid,
	 * based on expiration.
	 *
	 * @since 4.0.0
	 *
	 * @param array $session Session to check.
	 * @return bool Whether session is valid.
	 */
	final protected function is_still_valid( $session ) {
		return $session['expiration'] >= time();
	}

/**
	 * Destroy all session tokens for a user.
	 *
	 * @since 4.0.0
	 */
	final public function destroy_all() {
		$this->destroy_all_sessions();
	}

/**
	 * Destroy all session tokens for all users.
	 *
	 * @since 4.0.0
	 * @static
	 */
	final public static function destroy_all_for_all_users() {
		/** This filter is documented in wp-includes/class-wp-session-tokens.php */
		$manager = apply_filters( 'session_token_manager', 'WP_User_Meta_Session_Tokens' );
		call_user_func( array( $manager, 'drop_sessions' ) );
	}

/**
	 * Retrieve all sessions of a user.
	 *
	 * @since 4.0.0
	 *
	 * @return array Sessions of a user.
	 */
	final public function get_all() {
		return array_values( $this->get_sessions() );
	}

/**
	 * This method should retrieve all sessions of a user, keyed by verifier.
	 *
	 * @since 4.0.0
	 *
	 * @return array Sessions of a user, keyed by verifier.
	 */
	abstract protected function get_sessions();

/**
	 * This method should look up a session by its verifier (token hash).
	 *
	 * @since 4.0.0
	 *
	 * @param string $verifier Verifier of the session to retrieve.
	 * @return array|null The session, or null if it does not exist.
	 */
	abstract protected function get_session( $verifier );

/**
	 * This method should update a session by its verifier.
	 *
	 * Omitting the second argument should destroy the session.
	 *
	 * @since 4.0.0
	 *
	 * @param string $verifier Verifier of the session to update.
	 * @param array  $session  Optional. Session. Omitting this argument destroys the session.
	 */
	abstract protected function update_session( $verifier, $session = null );

/**
	 * This method should destroy all session tokens for this user,
	 * except a single session passed.
	 *
	 * @since 4.0.0
	 *
	 * @param string $verifier Verifier of the session to keep.
	 */
	abstract protected function destroy_other_sessions( $verifier );

/**
	 * This method should destroy all sessions for a user.
	 *
	 * @since 4.0.0
	 */
	abstract protected function destroy_all_sessions();

/**
	 * This static method should destroy all session tokens for all users.
	 *
	 * @since 4.0.0
	 * @static
	 */
	public static function drop_sessions() {}
}

[+] ..
[-] rss.php [open]
[-] shortcodes.php [open]
[-] class-wp-session-tokens.php [open]
[-] user.php [open]
[-] kses.php [open]
[-] default-constants.php [open]
[-] class-wp-widget.php [open]
[-] class-wp-oembed-controller.php [open]
[-] post-template.php [open]
[-] class-wp-metadata-lazyloader.php [open]
[-] feed-rss.php [open]
[-] class-wp-http-encoding.php [open]
[-] locale.php [open]
[-] class-wp-xmlrpc-server.php [open]
[-] template-loader.php [open]
[-] pluggable.php [open]
[+] SimplePie
[-] cache.php [open]
[-] spl-autoload-compat.php [open]
[-] cron.php [open]
[-] class-wp-feed-cache-transient.php [open]
[-] ms-load.php [open]
[-] ms-functions.php [open]
[-] class-simplepie.php [open]
[-] class-wp-term.php [open]
[-] class-IXR.php [open]
[-] meta.php [open]
[+] images
[-] default-filters.php [open]
[-] bookmark-template.php [open]
[-] class-wp-site.php [open]
[-] class-oembed.php [open]
[-] class-wp-customize-section.php [open]
[+] css
[-] embed.php [open]
[-] class-wp-http-streams.php [open]
[-] class-walker-page.php [open]
[-] functions.wp-scripts.php [open]
[-] default-widgets.php [open]
[-] class-wp-locale-switcher.php [open]
[-] date.php [open]
[-] class-wp-widget-factory.php [open]
[-] functions.php [open]
[-] class-walker-category.php [open]
[-] class-wp-dependency.php [open]
[+] ID3
[-] version.php [open]
[-] class-smtp.php [open]
[-] class-wp-network.php [open]
[-] rest-api.php [open]
[-] class-wp-http-response.php [open]
[-] class-wp-user-query.php [open]
[-] class-snoopy.php [open]
[-] update.php [open]
[-] nav-menu.php [open]
[+] widgets
[-] class-wp-simplepie-sanitize-kses.php [open]
[-] class-wp-role.php [open]
[+] pomo
[-] theme.php [open]
[-] class-wp-ajax-response.php [open]
[-] class-wp-admin-bar.php [open]
[-] class-wp-http-ixr-client.php [open]
[-] class-wp-post.php [open]
[-] query.php [open]
[-] functions.wp-styles.php [open]
[+] certificates
[-] admin-bar.php [open]
[-] atomlib.php [open]
[-] general-template.php [open]
[-] class-wp-image-editor-gd.php [open]
[-] feed-atom-comments.php [open]
[-] class-wp-text-diff-renderer-inline.php [open]
[-] nav-menu-template.php [open]
[-] class.wp-scripts.php [open]
[-] class-pop3.php [open]
[-] post-thumbnail-template.php [open]
[-] widgets.php [open]
[-] session.php [open]
[-] class-walker-page-dropdown.php [open]
[-] class-wp-http-curl.php [open]
[-] class-wp-network-query.php [open]
[-] deprecated.php [open]
[-] registration-functions.php [open]
[-] ms-settings.php [open]
[-] wp-diff.php [open]
[-] category-template.php [open]
[-] class-json.php [open]
[+] fonts
[-] class-wp-theme.php [open]
[-] media-template.php [open]
[-] class-wp-roles.php [open]
[-] class-wp-http-requests-response.php [open]
[-] script-loader.php [open]
[-] class-wp-user.php [open]
[-] class-wp-comment-query.php [open]
[-] class-wp-http-proxy.php [open]
[-] class-wp-locale.php [open]
[-] class-wp-user-meta-session-tokens.php [open]
[-] ms-deprecated.php [open]
[-] bookmark.php [open]
[-] class-walker-category-dropdown.php [open]
[-] class-wp-site-query.php [open]
[-] class-wp-customize-control.php [open]
[-] class-wp-query.php [open]
[-] rss-functions.php [open]
[-] canonical.php [open]
[+] js
[-] ms-default-filters.php [open]
[-] class-wp-customize-widgets.php [open]
[-] pluggable-deprecated.php [open]
[-] vars.php [open]
[-] l10n.php [open]
[-] load.php [open]
[-] ms-files.php [open]
[-] class-wp-customize-panel.php [open]
[-] class-wp-taxonomy.php [open]
[-] embed-template.php [open]
[-] ms-default-constants.php [open]
[-] post-formats.php [open]
[-] ms-blogs.php [open]
[-] feed-rss2-comments.php [open]
[-] link-template.php [open]
[-] class-phpmailer.php [open]
[-] class.wp-dependencies.php [open]
[-] revision.php [open]
[-] category.php [open]
[-] class-wp-image-editor-imagick.php [open]
[-] author-template.php [open]
[-] http.php [open]
[-] class-wp-walker.php [open]
[-] class-wp-simplepie-file.php [open]
[-] class-wp-post-type.php [open]
[-] plugin.php [open]
[+] random_compat
[-] class-wp-matchesmapregex.php [open]
[-] wp-db.php [open]
[-] registration.php [open]
[-] class-wp.php [open]
[-] class-http.php [open]
[-] rewrite.php [open]
[+] Text
[-] class-walker-nav-menu.php [open]
[-] class-wp-feed-cache.php [open]
[-] formatting.php [open]
[+] customize
[-] class-wp-list-util.php [open]
[-] feed-atom.php [open]
[-] class-wp-term-query.php [open]
[-] option.php [open]
[-] comment.php [open]
[-] comment-template.php [open]
[-] class-wp-http-cookie.php [open]
[-] class-wp-editor.php [open]
[-] class-wp-meta-query.php [open]
[-] class-wp-image-editor.php [open]
[-] post.php [open]
[-] taxonomy.php [open]
[+] IXR
[-] class-wp-embed.php [open]
[+] theme-compat
[-] class-wp-rewrite.php [open]
[-] class-wp-customize-nav-menus.php [open]
[-] class-wp-error.php [open]
[-] class-requests.php [open]
[-] wlwmanifest.xml [open]
[-] template.php [open]
[-] class-wp-text-diff-renderer-table.php [open]
[-] capabilities.php [open]
[-] class-wp-customize-setting.php [open]
[-] class.wp-styles.php [open]
[-] compat.php [open]
[-] feed.php [open]
[-] class-wp-http-requests-hooks.php [open]
[-] class-wp-hook.php [open]
[+] Requests
[-] class-wp-tax-query.php [open]
[-] class-walker-comment.php [open]
[-] feed-rdf.php [open]
[-] class-wp-comment.php [open]
[-] class-wp-customize-manager.php [open]
[+] rest-api
[-] class-feed.php [open]
[-] media.php [open]
[-] class-phpass.php [open]
[-] feed-rss2.php [open]