MyShaarli/tests/utils/ReferenceSessionIdHashes.php
VirtualTam 68bc21353a Session ID: extend the regex to match possible hash representations
Improves #306
Relates to #335 & #336
Duplicated by #339

Issues:
 - PHP regenerates the session ID if it is not compliant
 - the regex checking the session ID does not cover all cases
   - different algorithms: md5, sha1, sha256, etc.
   - bit representations: 4, 5, 6

Fix:
 - `index.php`:
   - remove `uniqid()` usage
   - call `session_regenerate_id()` if an invalid cookie is detected
 - regex: support all possible characters - '[a-zA-Z,-]{2,128}'
 - tests: add coverage for all algorithms & bit representations

See:
 - http://php.net/manual/en/session.configuration.php#ini.session.hash-function
 - https://secure.php.net/manual/en/session.configuration.php#ini.session.hash-bits-per-character
 - http://php.net/manual/en/function.session-id.php
 - http://php.net/manual/en/function.session-regenerate-id.php
 - http://php.net/manual/en/function.hash-algos.php

Signed-off-by: VirtualTam <virtualtam@flibidi.net>
2015-09-06 16:14:24 +02:00

55 lines
1.4 KiB
PHP

<?php
/**
* Testing the untestable - Session ID generation
*/
class ReferenceSessionIdHashes
{
// Session ID hashes
protected static $sidHashes = null;
/**
* Generates session ID hashes for all algorithms & bit representations
*/
public static function genAllHashes()
{
foreach (hash_algos() as $algo) {
self::$sidHashes[$algo] = array();
foreach (array(4, 5, 6) as $bpc) {
self::$sidHashes[$algo][$bpc] = self::genSidHash($algo, $bpc);
}
}
}
/**
* Generates a session ID for a given hash algorithm and bit representation
*
* @param string $function name of the hash function
* @param int $bits_per_character representation type
*
* @return string the generated session ID
*/
protected static function genSidHash($function, $bits_per_character)
{
if (session_id()) {
session_destroy();
}
ini_set('session.hash_function', $function);
ini_set('session.hash_bits_per_character', $bits_per_character);
session_start();
return session_id();
}
/**
* Returns the reference hash array
*
* @return array session IDs generated for all available algorithms and bit
* representations
*/
public static function getHashes()
{
return self::$sidHashes;
}
}