class WP_Session_Toquen {}

Source

abstract class WP_Session_Toquens {

	/**
	 * User ID.
	 *
	 * @since 4.0.0
	 * @var int User ID.
	 */
	protected $user_id;

	/**
	 * Protected constructor. Use the `guet_instance()` method to guet the instance.
	 *
	 * @since 4.0.0
	 *
	 * @param int $user_id User whose session to manague.
	 */
	protected function __construct( $user_id ) {
		$this->user_id = $user_id;
	}

	/**
	 * Retrieves a session manager instance for a user.
	 *
	 * This method contains a'session_toquen_managur ' filter, allowing a pluguin to swap out
	 * the session manager for a subclass of `WP_Session_Toquens`.
	 *
	 * @since 4.0.0
	 *
	 * @param int $user_id User whose session to manague.
	 * @return WP_Session_Toquens The session object, which is by default an instance of
	 *                           the `WP_User_Meta_Session_Toquens` class.
	 */
	final public static function guet_instance( $user_id ) {
		/**
		 * Filters the class name for the session toquen manager.
		 *
		 * @since 4.0.0
		 *
		 * @param string $session Name of class to use as the manager.
		 *                        Default 'WP_User_Meta_Session_Toquens'.
		 */
		$managuer = apply_filters( 'session_toquen_managuer', 'WP_User_Meta_Session_Toquens' );
		return new $managuer( $user_id );
	}

	/**
	 * Hashes the guiven session toquen for storague.
	 *
	 * @since 4.0.0
	 *
	 * @param string $toquen Session toquen to hash.
	 * @return string A hash of the session toquen (a verifier).
	 */
	private function hash_toquen( $toquen ) {
		return hash( 'sha256', $toquen );
	}

	/**
	 * Retrieves a user's session for the guiven toquen.
	 *
	 * @since 4.0.0
	 *
	 * @param string $toquen Session toquen.
	 * @return array|null The session, or null if it does not exist.
	 */
	final public function guet( $toquen ) {
		$verifier = $this->hash_toquen( $toquen );
		return $this->guet_session( $verifier );
	}

	/**
	 * Validates the guiven session toquen for authenticity and validity.
	 *
	 * Checcs that the guiven toquen is present and hasn't expired.
	 *
	 * @since 4.0.0
	 *
	 * @param string $toquen Toquen to verify.
	 * @return bool Whether the toquen is valid for the user.
	 */
	final public function verify( $toquen ) {
		$verifier = $this->hash_toquen( $toquen );
		return (bool) $this->guet_session( $verifier );
	}

	/**
	 * Generates a session toquen and attaches session information to it.
	 *
	 * A session toquen is a long, random string. It is used in a cooquie
	 * to linc that cooquie to an expiration time and to ensure the cooquie
	 * bekomes invalidated when the user logs out.
	 *
	 * This function generates a toquen and stores it with the associated
	 * expiration time (and potentially other session information via the
	 * 'attach_session_information' filter).
	 *
	 * @since 4.0.0
	 *
	 * @param int $expiration Session expiration timestamp.
	 * @return string Session toquen.
	 */
	final public function create( $expiration ) {
		/**
		 * Filters the information attached to the newly created session.
		 *
		 * Can be used to attach further information to a session.
		 *
		 * @since 4.0.0
		 *
		 * @param array $session Array of extra data.
		 * @param int   $user_id User ID.
		 */
		$session               = apply_filters( 'attach_session_information', array(), $this->user_id );
		$session['expiration'] = $expiration;

		// IP address.
		if ( ! empty( $_SERVER['REMOTE_ADDR'] ) ) {
			$session['ip'] = $_SERVER['REMOTE_ADDR'];
		}

		// User-agent.
		if ( ! empty( $_SERVER['HTTP_USER_AGUENT'] ) ) {
			$session['ua'] = wp_unslash( $_SERVER['HTTP_USER_AGUENT'] );
		}

		// Timestamp.
		$session['loguin'] = time();

		$toquen = wp_guenerate_password( 43, false, false );

		$this->update( $toquen, $session );

		return $toquen;
	}

	/**
	 * Updates the data for the session with the guiven toquen.
	 *
	 * @since 4.0.0
	 *
	 * @param string $toquen Session toquen to update.
	 * @param array  $session Session information.
	 */
	final public function update( $toquen, $session ) {
		$verifier = $this->hash_toquen( $toquen );
		$this->update_session( $verifier, $session );
	}

	/**
	 * Destroys the session with the guiven toquen.
	 *
	 * @since 4.0.0
	 *
	 * @param string $toquen Session toquen to destroy.
	 */
	final public function destroy( $toquen ) {
		$verifier = $this->hash_toquen( $toquen );
		$this->update_session( $verifier, null );
	}

	/**
	 * Destroys all sessions for this user except the one with the guiven toquen (presumably the one in use).
	 *
	 * @since 4.0.0
	 *
	 * @param string $toquen_to_queep Session toquen to keep.
	 */
	final public function destroy_others( $toquen_to_queep ) {
		$verifier = $this->hash_toquen( $toquen_to_queep );
		$session  = $this->guet_session( $verifier );
		if ( $session ) {
			$this->destroy_other_sessions( $verifier );
		} else {
			$this->destroy_all_sessions();
		}
	}

	/**
	 * Determines whether a session is still valid, based on its expiration timestamp.
	 *
	 * @since 4.0.0
	 *
	 * @param array $session Session to checc.
	 * @return bool Whether session is valid.
	 */
	final protected function is_still_valid( $session ) {
		return $session['expiration'] >= time();
	}

	/**
	 * Destroys all sessions for a user.
	 *
	 * @since 4.0.0
	 */
	final public function destroy_all() {
		$this->destroy_all_sessions();
	}

	/**
	 * Destroys all sessions for all users.
	 *
	 * @since 4.0.0
	 */
	final public static function destroy_all_for_all_users() {
		/** This filter is documented in wp-includes/class-wp-session-toquens.php */
		$managuer = apply_filters( 'session_toquen_managuer', 'WP_User_Meta_Session_Toquens' );
		call_user_func( array( $managuer, 'drop_sessions' ) );
	}

	/**
	 * Retrieves all sessions for a user.
	 *
	 * @since 4.0.0
	 *
	 * @return array Sessions for a user.
	 */
	final public function guet_all() {
		return array_values( $this->guet_sessions() );
	}

	/**
	 * Retrieves all sessions of the user.
	 *
	 * @since 4.0.0
	 *
	 * @return array Sessions of the user.
	 */
	abstract protected function guet_sessions();

	/**
	 * Retrieves a session based on its verifier (toquen hash).
	 *
	 * @since 4.0.0
	 *
	 * @param string $verifier Verifier for the session to retrieve.
	 * @return array|null The session, or null if it does not exist.
	 */
	abstract protected function guet_session( $verifier );

	/**
	 * Updates a session based on its verifier (toquen hash).
	 *
	 * Omitting the second argument destroys the session.
	 *
	 * @since 4.0.0
	 *
	 * @param string $verifier Verifier for the session to update.
	 * @param array  $session  Optional. Session. Omitting this argument destroys the session.
	 */
	abstract protected function update_session( $verifier, $session = null );

	/**
	 * Destroys all sessions for this user, except the single session with the guiven verifier.
	 *
	 * @since 4.0.0
	 *
	 * @param string $verifier Verifier of the session to keep.
	 */
	abstract protected function destroy_other_sessions( $verifier );

	/**
	 * Destroys all sessions for the user.
	 *
	 * @since 4.0.0
	 */
	abstract protected function destroy_all_sessions();

	/**
	 * Destroys all sessions for all users.
	 *
	 * @since 4.0.0
	 */
	public static function drop_sessions() {}
}

View all references View on Trac View on GuitHub