Updating session id cleanup for filehandler. Fixes #1681 Fixes #1565

Author: lonnieezell

system/Session/Handlers/BaseHandler.php

@@ -209,5 +209,4 @@ protected function fail()
 
 		return false;
 	}
-
 }

system/Session/Handlers/FileHandler.php

@@ -73,6 +73,16 @@ class FileHandler extends BaseHandler implements \SessionHandlerInterface
 	 */
 	protected $fileNew;
 
+	/**
+	 * @var boolean
+	 */
+	protected $matchIP = false;
+
+	/**
+	 * @var string
+	 */
+	protected $sessionIDRegex;
+
 	//--------------------------------------------------------------------
 
 	/**
@@ -91,14 +101,19 @@ public function __construct($config, string $ipAddress)
 		}
 		else
 		{
-					   $sessionPath = rtrim(ini_get('session.save_path'), '/\\');
+			$sessionPath = rtrim(ini_get('session.save_path'), '/\\');
+
 			if (! $sessionPath)
-					   {
+			{
 				$sessionPath = WRITEPATH . 'session';
 			}
 
-					   $this->savePath = $sessionPath;
+			$this->savePath = $sessionPath;
 		}
+
+		$this->matchIP = $config->sessionMatchIP;
+
+		$this->configureSessionIDRegex();
 	}
 
 	//--------------------------------------------------------------------
@@ -130,8 +145,8 @@ public function open($savePath, $name): bool
 
 		$this->savePath = $savePath;
 		$this->filePath = $this->savePath . '/'
-				. $name // we'll use the session cookie name as a prefix to avoid collisions
-				. ($this->matchIP ? md5($this->ipAddress) : '');
+						  . $name // we'll use the session cookie name as a prefix to avoid collisions
+						  . ($this->matchIP ? md5($this->ipAddress) : '');
 
 		return true;
 	}
@@ -219,7 +234,7 @@ public function write($sessionID, $sessionData): bool
 	{
 		// If the two IDs don't match, we have a session_regenerate_id() call
 		// and we need to close the old handle and open a new one
-		if ($sessionID !== $this->sessionID && ( ! $this->close() || $this->read($sessionID) === false))
+		if ($sessionID !== $this->sessionID && (! $this->close() || $this->read($sessionID) === false))
 		{
 			return false;
 		}
@@ -302,13 +317,15 @@ public function destroy($session_id): bool
 	{
 		if ($this->close())
 		{
-			return is_file($this->filePath . $session_id) ? (unlink($this->filePath . $session_id) && $this->destroyCookie()) : true;
+			return is_file($this->filePath . $session_id)
+				? (unlink($this->filePath . $session_id) && $this->destroyCookie()) : true;
 		}
 		elseif ($this->filePath !== null)
 		{
 			clearstatcache();
 
-			return is_file($this->filePath . $session_id) ? (unlink($this->filePath . $session_id) && $this->destroyCookie()) : true;
+			return is_file($this->filePath . $session_id)
+				? (unlink($this->filePath . $session_id) && $this->destroyCookie()) : true;
 		}
 
 		return false;
@@ -336,20 +353,28 @@ public function gc($maxlifetime): bool
 
 		$ts = time() - $maxlifetime;
 
+		$pattern = $this->matchIP === true
+			? '[0-9a-f]{32}'
+			: '';
+
 		$pattern = sprintf(
-				'/^%s[0-9a-f]{%d}$/', preg_quote($this->cookieName, '/'), ($this->matchIP === true ? 72 : 40)
+			'#\A%s' . $pattern . $this->sessionIDRegex . '\z#',
+			preg_quote($this->cookieName)
 		);
 
 		while (($file = readdir($directory)) !== false)
 		{
 			// If the filename doesn't match this pattern, it's either not a session file or is not ours
-			if (! preg_match($pattern, $file) || ! is_file($this->savePath . '/' . $file) || ($mtime = filemtime($this->savePath . '/' . $file)) === false || $mtime > $ts
+			if (! preg_match($pattern, $file)
+				|| ! is_file($this->savePath . DIRECTORY_SEPARATOR . $file)
+				|| ($mtime = filemtime($this->savePath . DIRECTORY_SEPARATOR . $file)) === false
+				|| $mtime > $ts
 			)
 			{
 				continue;
 			}
 
-			unlink($this->savePath . '/' . $file);
+			unlink($this->savePath . DIRECTORY_SEPARATOR . $file);
 		}
 
 		closedir($directory);
@@ -358,4 +383,36 @@ public function gc($maxlifetime): bool
 	}
 
 	//--------------------------------------------------------------------
+
+	/**
+	 * Configure Session ID regular expression
+	 */
+	protected function configureSessionIDRegex()
+	{
+		$bitsPerCharacter = (int)ini_get('session.sid_bits_per_character');
+		$SIDLength        = (int)ini_get('session.sid_length');
+
+		if (($bits = $SIDLength * $bitsPerCharacter) < 160)
+		{
+			// Add as many more characters as necessary to reach at least 160 bits
+			$SIDLength += (int)ceil((160 % $bits) / $bitsPerCharacter);
+			ini_set('session.sid_length', $SIDLength);
+		}
+
+		// Yes, 4,5,6 are the only known possible values as of 2016-10-27
+		switch ($bitsPerCharacter)
+		{
+			case 4:
+				$this->sessionIDRegex = '[0-9a-f]';
+				break;
+			case 5:
+				$this->sessionIDRegex = '[0-9a-v]';
+				break;
+			case 6:
+				$this->sessionIDRegex = '[0-9a-zA-Z,-]';
+				break;
+		}
+
+		$this->sessionIDRegex .= '{' . $SIDLength . '}';
+	}
 }