15763634671

Committed 19 Jun 2025 05:47PM UTC coverage: 84.375%. Remained the same

Build Type

push

github

Committed by

Commit Message

SimpleAuthenticator: passwords can be hashed

Run Details

2 of 2 new or added lines in 1 file covered. (100.0%)

44 existing lines in 5 files now uncovered.

486 of 576 relevant lines covered (84.38%)

0.84 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

14.81

/src/Bridges/SecurityHttp/SessionStorage.php

<?php

/**
 * This file is part of the Nette Framework (https://nette.org)
 * Copyright (c) 2004 David Grudl (https://davidgrudl.com)
 */

declare(strict_types=1);

namespace Nette\Bridges\SecurityHttp;

use Nette;
use Nette\Http\Session;
use Nette\Http\SessionSection;
use Nette\Security\IIdentity;
use Nette\Security\User;
use function is_bool, time;


/**
 * Session storage for Nette\Security\User object.
 */
final class SessionStorage implements Nette\Security\UserStorage
{
        private string $namespace = '';
        private Session $sessionHandler;
        private ?SessionSection $sessionSection = null;
        private ?int $expireTime = null;
        private bool $expireIdentity = false;


        public function __construct(Session $sessionHandler)
        {
                $this->sessionHandler = $sessionHandler;
        }


        public function saveAuthentication(IIdentity $identity): void
        {
                $section = $this->getSessionSection();
                $section->set('authenticated', true);
                $section->set('reason', null);
                $section->set('authTime', time()); // informative value
                $section->set('identity', $identity);
                $this->setupExpiration();

                // Session Fixation defence
                $this->sessionHandler->regenerateId();
        }


        public function clearAuthentication(bool $clearIdentity): void
        {
                $section = $this->getSessionSection();
                $section->set('authenticated', false);
                $section->set('reason', User::LogoutManual);
                $section->set('authTime', null);
                if ($clearIdentity === true) {
                        $section->set('identity', null);
                }

                // Session Fixation defence
                $this->sessionHandler->regenerateId();
        }


        public function getState(): array
        {
                $section = $this->getSessionSection();
                return $section
                        ? [(bool) $section->get('authenticated'), $section->get('identity'), $section->get('reason')]
                        : [false, null, null];
        }


        public function setExpiration(?string $time, bool $clearIdentity = false): void
        {
                $this->expireTime = $time ? (int) Nette\Utils\DateTime::from($time)->format('U') : null;
                $this->expireIdentity = $clearIdentity;

                if ($this->sessionSection && $this->sessionSection->get('authenticated')) {
                        $this->setupExpiration();
                }
        }


        private function setupExpiration(): void
        {
                $section = $this->sessionSection;
                if ($this->expireTime) {
                        $section->set('expireTime', $this->expireTime);
                        $section->set('expireDelta', $this->expireTime - time());
                } else {
                        $section->remove(['expireTime', 'expireDelta']);
                }

                $section->set('expireIdentity', $this->expireIdentity);
                $section->setExpiration((string) $this->expireTime, 'foo'); // time check
        }


        /**
         * Changes namespace; allows more users to share a session.
         */
        public function setNamespace(string $namespace): static
        {
                if ($this->namespace !== $namespace) {
                        $this->namespace = $namespace;
                        $this->sessionSection = null;
                }

                return $this;
        }


        /**
         * Returns current namespace.
         */
        public function getNamespace(): string
        {
                return $this->namespace;
        }


        /**
         * Returns and initializes $this->sessionSection.
         */
        protected function getSessionSection(): ?SessionSection
        {
                if ($this->sessionSection !== null) {
                        return $this->sessionSection;
                }

                $this->sessionSection = $section = $this->sessionHandler->getSection('Nette.Http.UserStorage/' . $this->namespace);

                if (!$section->get('identity') instanceof IIdentity || !is_bool($section->get('authenticated'))) {
                        $section->remove();
                }

                if ($section->get('authenticated') && $section->get('expireDelta') > 0) { // check time expiration
                        if ($section->get('expireTime') < time()) {
                                $section->set('reason', User::LogoutInactivity);
                                $section->set('authenticated', false);
                                if ($section->get('expireIdentity')) {
                                        $section->remove('identity');
                                }
                        }

                        $section->set('expireTime', time() + $section->get('expireDelta')); // sliding expiration
                }

                if (!$section->get('authenticated')) {
                        $section->remove(['expireTime', 'expireDelta', 'expireIdentity', 'authTime']);
                }

                return $this->sessionSection;
        }
}

1	<?php
2
3	/**
4	* This file is part of the Nette Framework (https://nette.org)
5	* Copyright (c) 2004 David Grudl (https://davidgrudl.com)
6	*/
7
8	declare(strict_types=1);
9
10	namespace Nette\Bridges\SecurityHttp;
11
12	use Nette;
13	use Nette\Http\Session;
14	use Nette\Http\SessionSection;
15	use Nette\Security\IIdentity;
16	use Nette\Security\User;
17	use function is_bool, time;
18
19
20	/**
21	* Session storage for Nette\Security\User object.
22	*/
23	final class SessionStorage implements Nette\Security\UserStorage
24	{
25	private string $namespace = '';
26	private Session $sessionHandler;
27	private ?SessionSection $sessionSection = null;
28	private ?int $expireTime = null;
29	private bool $expireIdentity = false;
30
31
32	public function __construct(Session $sessionHandler)	1✔
33	{
34	$this->sessionHandler = $sessionHandler;	1✔
35	}	1✔
36
37
38	public function saveAuthentication(IIdentity $identity): void
39	{
40	$section = $this->getSessionSection();	×
41	$section->set('authenticated', true);	×
42	$section->set('reason', null);	×
43	$section->set('authTime', time()); // informative value	×
44	$section->set('identity', $identity);	×
UNCOV 45	$this->setupExpiration();	×
46
47	// Session Fixation defence
UNCOV 48	$this->sessionHandler->regenerateId();	×
49	}
50
51
52	public function clearAuthentication(bool $clearIdentity): void
53	{
54	$section = $this->getSessionSection();	×
55	$section->set('authenticated', false);	×
56	$section->set('reason', User::LogoutManual);	×
57	$section->set('authTime', null);	×
58	if ($clearIdentity === true) {	×
UNCOV 59	$section->set('identity', null);	×
60	}
61
62	// Session Fixation defence
UNCOV 63	$this->sessionHandler->regenerateId();	×
64	}
65
66
67	public function getState(): array
68	{
69	$section = $this->getSessionSection();	×
70	return $section	×
71	? [(bool) $section->get('authenticated'), $section->get('identity'), $section->get('reason')]	×
UNCOV 72	: [false, null, null];	×
73	}
74
75
76	public function setExpiration(?string $time, bool $clearIdentity = false): void	1✔
77	{
78	$this->expireTime = $time ? (int) Nette\Utils\DateTime::from($time)->format('U') : null;	1✔
79	$this->expireIdentity = $clearIdentity;	1✔
80
81	if ($this->sessionSection && $this->sessionSection->get('authenticated')) {	1✔
UNCOV 82	$this->setupExpiration();	×
83	}
84	}	1✔
85
86
87	private function setupExpiration(): void
88	{
89	$section = $this->sessionSection;	×
90	if ($this->expireTime) {	×
91	$section->set('expireTime', $this->expireTime);	×
UNCOV 92	$section->set('expireDelta', $this->expireTime - time());	×
93	} else {
UNCOV 94	$section->remove(['expireTime', 'expireDelta']);	×
95	}
96
97	$section->set('expireIdentity', $this->expireIdentity);	×
UNCOV 98	$section->setExpiration((string) $this->expireTime, 'foo'); // time check	×
99	}
100
101
102	/**
103	* Changes namespace; allows more users to share a session.
104	*/
105	public function setNamespace(string $namespace): static
106	{
107	if ($this->namespace !== $namespace) {	×
108	$this->namespace = $namespace;	×
UNCOV 109	$this->sessionSection = null;	×
110	}
111
UNCOV 112	return $this;	×
113	}
114
115
116	/**
117	* Returns current namespace.
118	*/
119	public function getNamespace(): string
120	{
UNCOV 121	return $this->namespace;	×
122	}
123
124
125	/**
126	* Returns and initializes $this->sessionSection.
127	*/
128	protected function getSessionSection(): ?SessionSection
129	{
130	if ($this->sessionSection !== null) {	×
UNCOV 131	return $this->sessionSection;	×
132	}
133
UNCOV 134	$this->sessionSection = $section = $this->sessionHandler->getSection('Nette.Http.UserStorage/' . $this->namespace);	×
135
136	if (!$section->get('identity') instanceof IIdentity \|\| !is_bool($section->get('authenticated'))) {	×
UNCOV 137	$section->remove();	×
138	}
139
140	if ($section->get('authenticated') && $section->get('expireDelta') > 0) { // check time expiration	×
141	if ($section->get('expireTime') < time()) {	×
142	$section->set('reason', User::LogoutInactivity);	×
143	$section->set('authenticated', false);	×
144	if ($section->get('expireIdentity')) {	×
UNCOV 145	$section->remove('identity');	×
146	}
147	}
148
UNCOV 149	$section->set('expireTime', time() + $section->get('expireDelta')); // sliding expiration	×
150	}
151
152	if (!$section->get('authenticated')) {	×
UNCOV 153	$section->remove(['expireTime', 'expireDelta', 'expireIdentity', 'authTime']);	×
154	}
155
UNCOV 156	return $this->sessionSection;	×
157	}
158	}

nette / security / 15763634671

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous