68bc21353a
Improves #306 Relates to #335 & #336 Duplicated by #339 Issues: - PHP regenerates the session ID if it is not compliant - the regex checking the session ID does not cover all cases - different algorithms: md5, sha1, sha256, etc. - bit representations: 4, 5, 6 Fix: - `index.php`: - remove `uniqid()` usage - call `session_regenerate_id()` if an invalid cookie is detected - regex: support all possible characters - '[a-zA-Z,-]{2,128}' - tests: add coverage for all algorithms & bit representations See: - http://php.net/manual/en/session.configuration.php#ini.session.hash-function - https://secure.php.net/manual/en/session.configuration.php#ini.session.hash-bits-per-character - http://php.net/manual/en/function.session-id.php - http://php.net/manual/en/function.session-regenerate-id.php - http://php.net/manual/en/function.hash-algos.php Signed-off-by: VirtualTam <virtualtam@flibidi.net>
55 lines
1.4 KiB
PHP
55 lines
1.4 KiB
PHP
<?php
|
|
/**
|
|
* Testing the untestable - Session ID generation
|
|
*/
|
|
class ReferenceSessionIdHashes
|
|
{
|
|
// Session ID hashes
|
|
protected static $sidHashes = null;
|
|
|
|
/**
|
|
* Generates session ID hashes for all algorithms & bit representations
|
|
*/
|
|
public static function genAllHashes()
|
|
{
|
|
foreach (hash_algos() as $algo) {
|
|
self::$sidHashes[$algo] = array();
|
|
|
|
foreach (array(4, 5, 6) as $bpc) {
|
|
self::$sidHashes[$algo][$bpc] = self::genSidHash($algo, $bpc);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Generates a session ID for a given hash algorithm and bit representation
|
|
*
|
|
* @param string $function name of the hash function
|
|
* @param int $bits_per_character representation type
|
|
*
|
|
* @return string the generated session ID
|
|
*/
|
|
protected static function genSidHash($function, $bits_per_character)
|
|
{
|
|
if (session_id()) {
|
|
session_destroy();
|
|
}
|
|
|
|
ini_set('session.hash_function', $function);
|
|
ini_set('session.hash_bits_per_character', $bits_per_character);
|
|
|
|
session_start();
|
|
return session_id();
|
|
}
|
|
|
|
/**
|
|
* Returns the reference hash array
|
|
*
|
|
* @return array session IDs generated for all available algorithms and bit
|
|
* representations
|
|
*/
|
|
public static function getHashes()
|
|
{
|
|
return self::$sidHashes;
|
|
}
|
|
}
|