Skip to content

Commit 0c29370

Browse files
otengkwameotengkwame
committed
fix: cookie implementation and drop deprecated functionalities
Signed-off-by: otengkwame <developerkwame@gmail.com>
1 parent fbc389e commit 0c29370

5 files changed

Lines changed: 62 additions & 156 deletions

File tree

‎CodeIgniter/Framework/core/Input.php‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -665,7 +665,11 @@ public function mimetype()
665665
*/
666666
public function cookie($index = null, $xss_clean = false)
667667
{
668-
return $this->_fetch_from_array($_COOKIE, $index, $xss_clean);
668+
$prefix = isset($_COOKIE[$index])
669+
? ''
670+
: config_item('cookie_prefix');
671+
672+
return $this->_fetch_from_array($_COOKIE, $prefix . $index, $xss_clean);
669673
}
670674

671675
// --------------------------------------------------------------------
@@ -820,20 +824,6 @@ public function set_cookie($name, $value = '', $expire = 0, $domain = '', $path
820824
log_message('error', $name . ' cookie sent with SameSite=None, but without Secure attribute.');
821825
}
822826

823-
if (!is_php('7.3')) {
824-
$maxage = $expire - time();
825-
if ($maxage < 1) {
826-
$maxage = 0;
827-
}
828-
829-
$cookie_header = 'Set-Cookie: ' . $prefix . $name . '=' . rawurlencode($value);
830-
$cookie_header .= ($expire === 0 ? '' : '; Expires=' . gmdate('D, d-M-Y H:i:s T', $expire)) . '; Max-Age=' . $maxage;
831-
$cookie_header .= '; Path=' . $path . ($domain !== '' ? '; Domain=' . $domain : '');
832-
$cookie_header .= ($secure ? '; Secure' : '') . ($httponly ? '; HttpOnly' : '') . '; SameSite=' . $samesite;
833-
header($cookie_header);
834-
return;
835-
}
836-
837827
// using setcookie with array option to add cookie 'samesite' attribute
838828
$setcookie_options = [
839829
'expires' => $expire,
@@ -843,6 +833,7 @@ public function set_cookie($name, $value = '', $expire = 0, $domain = '', $path
843833
'httponly' => $httponly,
844834
'samesite' => $samesite,
845835
];
836+
846837
setcookie($prefix . $name, $value, $setcookie_options);
847838
}
848839

‎CodeIgniter/Framework/core/Security.php‎

Lines changed: 13 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@ public function csrf_verify()
267267
* CSRF Set Cookie
268268
*
269269
* @codeCoverageIgnore
270-
* @return CI_Security
270+
* @return CI_Security|bool
271271
*/
272272
public function csrf_set_cookie()
273273
{
@@ -278,32 +278,18 @@ public function csrf_set_cookie()
278278
return false;
279279
}
280280

281-
if (is_php('7.3')) {
282-
setcookie(
283-
$this->_csrf_cookie_name,
284-
$this->_csrf_hash,
285-
[
286-
'expires' => $expire,
287-
'path' => config_item('cookie_path'),
288-
'domain' => config_item('cookie_domain'),
289-
'secure' => $secure_cookie,
290-
'httponly' => config_item('cookie_httponly'),
291-
'samesite' => 'Strict'
292-
]
293-
);
294-
} else {
295-
$domain = trim(config_item('cookie_domain'));
296-
header(
297-
'Set-Cookie: ' . $this->_csrf_cookie_name . '=' . $this->_csrf_hash
298-
. '; Expires=' . gmdate('D, d-M-Y H:i:s T', $expire)
299-
. '; Max-Age=' . $this->_csrf_expire
300-
. '; Path=' . rawurlencode(config_item('cookie_path'))
301-
. ($domain === '' ? '' : '; Domain=' . $domain)
302-
. ($secure_cookie ? '; Secure' : '')
303-
. (config_item('cookie_httponly') ? '; HttpOnly' : '')
304-
. '; SameSite=Strict'
305-
);
306-
}
281+
setcookie(
282+
$this->_csrf_cookie_name,
283+
$this->_csrf_hash,
284+
[
285+
'expires' => $expire,
286+
'path' => config_item('cookie_path'),
287+
'domain' => config_item('cookie_domain'),
288+
'secure' => $secure_cookie,
289+
'httponly' => config_item('cookie_httponly'),
290+
'samesite' => config_item('cookie_samesite') ?: 'Strict'
291+
]
292+
);
307293

308294
log_message('info', 'CSRF cookie sent');
309295

‎CodeIgniter/Framework/helpers/cookie_helper.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,6 @@ function get_cookie($index, $xss_clean = false)
106106
*/
107107
function delete_cookie($name, $domain = '', $path = '/', $prefix = '')
108108
{
109-
set_cookie($name, '', '', $domain, $path, $prefix);
109+
set_cookie($name, '', 0, $domain, $path, $prefix);
110110
}
111111
}

‎CodeIgniter/Framework/libraries/Session/Session.php‎

Lines changed: 37 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -129,27 +129,20 @@ public function __construct(array $params = [])
129129
// unless it is being currently created or regenerated
130130
elseif (isset($_COOKIE[$this->_config['cookie_name']]) && $_COOKIE[$this->_config['cookie_name']] === session_id()) {
131131
$expires = empty($this->_config['cookie_lifetime']) ? 0 : time() + $this->_config['cookie_lifetime'];
132-
if (is_php('7.3')) {
133-
setcookie(
134-
$this->_config['cookie_name'],
135-
session_id(),
136-
[
137-
'expires' => $expires,
138-
'path' => $this->_config['cookie_path'],
139-
'domain' => $this->_config['cookie_domain'],
140-
'secure' => $this->_config['cookie_secure'],
141-
'httponly' => true,
142-
'samesite' => $this->_config['cookie_samesite']
143-
]
144-
);
145-
} else {
146-
$header = 'Set-Cookie: ' . $this->_config['cookie_name'] . '=' . session_id();
147-
$header .= empty($expires) ? '' : '; Expires=' . gmdate('D, d-M-Y H:i:s T', $expires) . '; Max-Age=' . $this->_config['cookie_lifetime'];
148-
$header .= '; Path=' . $this->_config['cookie_path'];
149-
$header .= ($this->_config['cookie_domain'] !== '' ? '; Domain=' . $this->_config['cookie_domain'] : '');
150-
$header .= ($this->_config['cookie_secure'] ? '; Secure' : '') . '; HttpOnly; SameSite=' . $this->_config['cookie_samesite'];
151-
header($header);
152-
}
132+
133+
setcookie(
134+
$this->_config['cookie_name'],
135+
session_id(),
136+
[
137+
'expires' => $expires,
138+
'path' => $this->_config['cookie_path'],
139+
'domain' => $this->_config['cookie_domain'],
140+
'secure' => $this->_config['cookie_secure'],
141+
'httponly' => true,
142+
'samesite' => $this->_config['cookie_samesite']
143+
]
144+
);
145+
153146

154147
if (!$this->_config['cookie_secure'] && $this->_config['cookie_samesite'] === 'None') {
155148
log_message('error', "Session: '" . $this->_config['cookie_name'] . "' cookie sent with SameSite=None, but without Secure attribute.'");
@@ -175,12 +168,8 @@ public function __construct(array $params = [])
175168
*/
176169
protected function _ci_load_classes($driver)
177170
{
178-
// PHP 7 compatibility
179-
interface_exists('SessionUpdateTimestampHandlerInterface', false) or require_once(BASEPATH . 'libraries/Session/SessionUpdateTimestampHandlerInterface.php');
180171

181-
require_once(BASEPATH . 'libraries/Session/CI_Session_driver_interface.php');
182-
$wrapper = is_php('8.0') ? 'PHP8SessionWrapper' : 'OldSessionWrapper';
183-
require_once(BASEPATH . 'libraries/Session/' . $wrapper . '.php');
172+
require_once(BASEPATH . 'libraries/Session/PHP8SessionWrapper.php');
184173

185174
$prefix = config_item('subclass_prefix');
186175

@@ -259,8 +248,9 @@ protected function _configure(&$params)
259248
isset($params['cookie_domain']) or $params['cookie_domain'] = config_item('cookie_domain');
260249
isset($params['cookie_secure']) or $params['cookie_secure'] = (bool) config_item('cookie_secure');
261250

262-
isset($params['cookie_samesite']) or $params['cookie_samesite'] = config_item('sess_samesite');
263-
if (!isset($params['cookie_samesite']) && is_php('7.3')) {
251+
isset($params['cookie_samesite']) or $params['cookie_samesite'] = config_item('cookie_samesite');
252+
253+
if (!isset($params['cookie_samesite'])) {
264254
$params['cookie_samesite'] = ini_get('session.cookie_samesite');
265255
}
266256

@@ -271,24 +261,15 @@ protected function _configure(&$params)
271261
$params['cookie_samesite'] = 'Lax';
272262
}
273263

274-
if (is_php('7.3')) {
275-
session_set_cookie_params([
276-
'lifetime' => $params['cookie_lifetime'],
277-
'path' => $params['cookie_path'],
278-
'domain' => $params['cookie_domain'],
279-
'secure' => $params['cookie_secure'],
280-
'httponly' => true,
281-
'samesite' => $params['cookie_samesite']
282-
]);
283-
} else {
284-
session_set_cookie_params(
285-
$params['cookie_lifetime'],
286-
$params['cookie_path'] . '; SameSite=' . $params['cookie_samesite'],
287-
$params['cookie_domain'],
288-
$params['cookie_secure'],
289-
true // HttpOnly; Yes, this is intentional and not configurable for security reasons
290-
);
291-
}
264+
session_set_cookie_params([
265+
'lifetime' => $params['cookie_lifetime'],
266+
'path' => $params['cookie_path'],
267+
'domain' => $params['cookie_domain'],
268+
'secure' => $params['cookie_secure'],
269+
'httponly' => true,
270+
'samesite' => $params['cookie_samesite']
271+
]);
272+
292273

293274
if (empty($expiration)) {
294275
$params['expiration'] = (int) ini_get('session.gc_maxlifetime');
@@ -309,8 +290,7 @@ protected function _configure(&$params)
309290
ini_set('session.use_cookies', 1);
310291
ini_set('session.use_only_cookies', 1);
311292

312-
// $this->_configure_sid_length();
313-
$this->_polyfill_configure_sid_length();
293+
$this->_configure_sid_length();
314294
}
315295

316296
// ------------------------------------------------------------------------
@@ -332,66 +312,20 @@ protected function _configure(&$params)
332312
*/
333313
protected function _configure_sid_length()
334314
{
335-
if (PHP_VERSION_ID < 70100) {
336-
$hash_function = ini_get('session.hash_function');
337-
if (ctype_digit($hash_function)) {
338-
if ($hash_function !== '1') {
339-
ini_set('session.hash_function', 1);
340-
}
315+
$bits_per_character = (int) ini_get('session.sid_bits_per_character');
316+
$sid_length = (int) ini_get('session.sid_length');
341317

342-
$bits = 160;
343-
} elseif (!in_array($hash_function, hash_algos(), true)) {
344-
ini_set('session.hash_function', 1);
345-
$bits = 160;
346-
} elseif (($bits = strlen(hash($hash_function, 'dummy', false)) * 4) < 160) {
347-
ini_set('session.hash_function', 1);
348-
$bits = 160;
318+
// We force the PHP defaults.
319+
if (PHP_VERSION_ID < 90000) {
320+
if ($bits_per_character !== 4) {
321+
ini_set('session.sid_bits_per_character', '4');
349322
}
350-
351-
$bits_per_character = (int) ini_get('session.hash_bits_per_character');
352-
$sid_length = (int) ceil($bits / $bits_per_character);
353-
} else {
354-
$bits_per_character = (int) ini_get('session.sid_bits_per_character');
355-
$sid_length = (int) ini_get('session.sid_length');
356-
if (($bits = $sid_length * $bits_per_character) < 160) {
357-
// Add as many more characters as necessary to reach at least 160 bits
358-
$sid_length += (int) ceil((160 % $bits) / $bits_per_character);
359-
ini_set('session.sid_length', $sid_length);
323+
if ($sid_length !== 32) {
324+
ini_set('session.sid_length', '32');
360325
}
361326
}
362327

363-
// Yes, 4,5,6 are the only known possible values as of 2016-10-27
364-
switch ($bits_per_character) {
365-
case 4:
366-
$this->_sid_regexp = '[0-9a-f]';
367-
break;
368-
case 5:
369-
$this->_sid_regexp = '[0-9a-v]';
370-
break;
371-
case 6:
372-
$this->_sid_regexp = '[0-9a-zA-Z,-]';
373-
break;
374-
}
375-
376-
$this->_sid_regexp .= '{' . $sid_length . '}';
377-
}
378-
379-
protected function _polyfill_configure_sid_length()
380-
{
381-
$bits_per_character = (int) ini_get('session.sid_bits_per_character');
382-
$sid_length = (int) ini_get('session.sid_length');
383-
384-
// We force the PHP defaults.
385-
if (PHP_VERSION_ID < 90000) {
386-
if ($bits_per_character !== 4) {
387-
ini_set('session.sid_bits_per_character', '4');
388-
}
389-
if ($sid_length !== 32) {
390-
ini_set('session.sid_length', '32');
391-
}
392-
}
393-
394-
$this->_sid_regexp = '[0-9a-f]{32}';
328+
$this->_sid_regexp = '[0-9a-f]{32}';
395329
}
396330

397331
// ------------------------------------------------------------------------

‎CodeIgniter/Framework/libraries/Session/Session_driver.php‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@
5151
abstract class CI_Session_driver
5252
{
5353

54+
/**
55+
* Config values
56+
*
57+
* @var string|array
58+
*/
5459
protected $_config;
5560

5661
/**
@@ -117,16 +122,6 @@ public function __construct(&$params)
117122
*/
118123
protected function _cookie_destroy()
119124
{
120-
if (!is_php('7.3')) {
121-
$header = 'Set-Cookie: ' . $this->_config['cookie_name'] . '=';
122-
$header .= '; Expires=' . gmdate('D, d-M-Y H:i:s T', 1) . '; Max-Age=-1';
123-
$header .= '; Path=' . $this->_config['cookie_path'];
124-
$header .= ($this->_config['cookie_domain'] !== '' ? '; Domain=' . $this->_config['cookie_domain'] : '');
125-
$header .= ($this->_config['cookie_secure'] ? '; Secure' : '') . '; HttpOnly; SameSite=' . $this->_config['cookie_samesite'];
126-
header($header);
127-
return;
128-
}
129-
130125
return setcookie(
131126
$this->_config['cookie_name'],
132127
'',

0 commit comments

Comments
 (0)