|
Lines 1-130
Link Here
|
| 1 |
--- program/lib/Roundcube/rcube_session.php.orig 2015-09-22 15:24:26.400132239 +0000 |
|
|
| 2 |
+++ program/lib/Roundcube/rcube_session.php 2015-09-22 15:24:08.430133455 +0000 |
| 3 |
@@ -35,7 +35,6 @@ |
| 4 |
private $time_diff = 0; |
| 5 |
private $reloaded = false; |
| 6 |
private $appends = array(); |
| 7 |
- private $unsets = array(); |
| 8 |
private $gc_handlers = array(); |
| 9 |
private $cookiename = 'roundcube_sessauth'; |
| 10 |
private $vars; |
| 11 |
@@ -46,6 +45,7 @@ |
| 12 |
private $logging = false; |
| 13 |
private $storage; |
| 14 |
private $memcache; |
| 15 |
+ private $need_base64 = false; |
| 16 |
|
| 17 |
/** |
| 18 |
* Blocks session data from being written to database. |
| 19 |
@@ -95,6 +95,9 @@ |
| 20 |
else if ($this->storage != 'php') { |
| 21 |
ini_set('session.serialize_handler', 'php'); |
| 22 |
|
| 23 |
+ if (ini_get("suhosin.session.encrypt") !== "1") |
| 24 |
+ $this->need_base64 = true; |
| 25 |
+ |
| 26 |
// set custom functions for PHP session management |
| 27 |
session_set_save_handler( |
| 28 |
array($this, 'open'), |
| 29 |
@@ -192,7 +195,7 @@ |
| 30 |
$this->time_diff = time() - strtotime($sql_arr['ts']); |
| 31 |
$this->changed = strtotime($sql_arr['changed']); |
| 32 |
$this->ip = $sql_arr['ip']; |
| 33 |
- $this->vars = base64_decode($sql_arr['vars']); |
| 34 |
+ $this->vars = $this->_decode($sql_arr['vars']); |
| 35 |
$this->key = $key; |
| 36 |
|
| 37 |
return !empty($this->vars) ? (string) $this->vars : ''; |
| 38 |
@@ -232,12 +235,12 @@ |
| 39 |
} |
| 40 |
|
| 41 |
if ($oldvars !== null) { |
| 42 |
- $newvars = $this->_fixvars($vars, $oldvars); |
| 43 |
+ $newvars = $vars; |
| 44 |
|
| 45 |
if ($newvars !== $oldvars) { |
| 46 |
$this->db->query("UPDATE {$this->table_name} " |
| 47 |
. "SET `changed` = $now, `vars` = ? WHERE `sess_id` = ?", |
| 48 |
- base64_encode($newvars), $key); |
| 49 |
+ $this->_encode($newvars), $key); |
| 50 |
} |
| 51 |
else if ($ts - $this->changed + $this->time_diff > $this->lifetime / 2) { |
| 52 |
$this->db->query("UPDATE {$this->table_name} SET `changed` = $now" |
| 53 |
@@ -248,44 +251,30 @@ |
| 54 |
$this->db->query("INSERT INTO {$this->table_name}" |
| 55 |
. " (`sess_id`, `vars`, `ip`, `created`, `changed`)" |
| 56 |
. " VALUES (?, ?, ?, $now, $now)", |
| 57 |
- $key, base64_encode($vars), (string)$this->ip); |
| 58 |
+ $key, $this->_encode($vars), (string)$this->ip); |
| 59 |
} |
| 60 |
|
| 61 |
return true; |
| 62 |
} |
| 63 |
|
| 64 |
|
| 65 |
- /** |
| 66 |
- * Merge vars with old vars and apply unsets |
| 67 |
- */ |
| 68 |
- private function _fixvars($vars, $oldvars) |
| 69 |
+ private function _encode($vars) |
| 70 |
{ |
| 71 |
- if ($oldvars !== null) { |
| 72 |
- $a_oldvars = $this->unserialize($oldvars); |
| 73 |
- if (is_array($a_oldvars)) { |
| 74 |
- // remove unset keys on oldvars |
| 75 |
- foreach ((array)$this->unsets as $var) { |
| 76 |
- if (isset($a_oldvars[$var])) { |
| 77 |
- unset($a_oldvars[$var]); |
| 78 |
- } |
| 79 |
- else { |
| 80 |
- $path = explode('.', $var); |
| 81 |
- $k = array_pop($path); |
| 82 |
- $node = &$this->get_node($path, $a_oldvars); |
| 83 |
- unset($node[$k]); |
| 84 |
- } |
| 85 |
- } |
| 86 |
- |
| 87 |
- $newvars = $this->serialize(array_merge( |
| 88 |
- (array)$a_oldvars, (array)$this->unserialize($vars))); |
| 89 |
- } |
| 90 |
- else { |
| 91 |
- $newvars = $vars; |
| 92 |
- } |
| 93 |
+ if ($this->need_base64) { |
| 94 |
+ return base64_encode($vars); |
| 95 |
+ } else { |
| 96 |
+ return $vars; |
| 97 |
} |
| 98 |
+ } |
| 99 |
|
| 100 |
- $this->unsets = array(); |
| 101 |
- return $newvars; |
| 102 |
+ |
| 103 |
+ private function _decode($vars) |
| 104 |
+ { |
| 105 |
+ if ($this->need_base64) { |
| 106 |
+ return base64_decode($vars); |
| 107 |
+ } else { |
| 108 |
+ return $vars; |
| 109 |
+ } |
| 110 |
} |
| 111 |
|
| 112 |
|
| 113 |
@@ -350,7 +339,7 @@ |
| 114 |
else // else read data again |
| 115 |
$oldvars = $this->mc_read($key); |
| 116 |
|
| 117 |
- $newvars = $oldvars !== null ? $this->_fixvars($vars, $oldvars) : $vars; |
| 118 |
+ $newvars = $vars; |
| 119 |
|
| 120 |
if ($newvars !== $oldvars || $ts - $this->changed > $this->lifetime / 3) { |
| 121 |
return $this->memcache->set($key, serialize(array('changed' => time(), 'ip' => $this->ip, 'vars' => $newvars)), |
| 122 |
@@ -488,8 +477,6 @@ |
| 123 |
return $this->destroy(session_id()); |
| 124 |
} |
| 125 |
|
| 126 |
- $this->unsets[] = $var; |
| 127 |
- |
| 128 |
if (isset($_SESSION[$var])) { |
| 129 |
unset($_SESSION[$var]); |
| 130 |
} |