Ticket #20276: sessions-table.php

<?php

add_action( 'plugins_loaded', function() {
        global $wpdb;
        $wpdb->sessions = $wpdb->base_prefix . 'sessions';
        /*
        CREATE TABLE `wp_sessions` (
                `verifier` char(64) NOT NULL,
                `user_id` bigint(20) NOT NULL,
                `ua` varchar(400) NOT NULL,
                `ip` varchar(45) NOT NULL,
                `expiration` int(10) NOT NULL,
                `start` int(10) NOT NULL,
                PRIMARY KEY (`verifier`),
                KEY `user_id` (`user_id`)
        )
        */

        add_filter( 'attach_session_information', function( $info ) {
                $info['ip'] = $_SERVER['REMOTE_ADDR'];
                $info['ua'] = $_SERVER['HTTP_USER_AGENT'];
                $info['start'] = time();
                return $info;
        });

        add_filter( 'session_token_manager', function() {
                return 'Global_Table_Session_Tokens';
        });
});

/**
 * Class for managing a user's session tokens.
 */
class Global_Table_Session_Tokens extends WP_Session_Tokens {

        /**
         * Get all sessions of a user.
         *
         * @since 4.0.0
         *
         * @return array
         */
        public function get_sessions() {
                global $wpdb;
                $_sessions = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM $wpdb->sessions WHERE user_id = %d", $this->user_id ), ARRAY_A );
                if ( ! is_array( $_sessions ) ) {
                        return array();
                }

                $sessions = array();
                foreach ( $_sessions as $session ) {
                        $verifier = $session['verifier'];
                        unset( $session['user_id'], $session['verifier'] );
                        $sessions[ $verifier ] = $session;
                }

                return $sessions;
        }

        /**
         * Update a user's sessions.
         *
         * @since 4.0.0
         *
         * @param array $sessions
         */
        protected function update_sessions( $sessions ) {
                global $wpdb;
                if ( ! $sessions ) {
                        $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->sessions WHERE user_id = %d", $this->user_id ) );
                        return;
                }

                $current_sessions = $this->get_sessions();

                // Find all sessions not yet in the DB that need to be added.
                $new_sessions = array_diff_key( $sessions, $current_sessions );

                // This class doesn't implement session updates (like "last logged in").
                // $changed_sessions = array_diff_assoc( ... )

                // Find all sessions we need to delete, either due to destruction or expiration.
                // Alternatively, we could set an expired flag, and keep it for auditing purposes.
                $to_delete = array();
                $time = time();
                foreach ( $current_sessions as $current_verifier => $current_session ) {
                        if ( ! isset( $sessions[ $current_verifier ] ) ) {
                                $to_delete[] = $current_verifier;
                        } elseif ( $current_session['expiration'] < $time ) {
                                $to_delete[] = $current_verifier;
                        }
                }

                $to_delete = "'" . implode( "', '", esc_sql( $to_delete ) ) . "'";
                $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->sessions WHERE user_id = %d AND verifier IN ($to_delete)", $this->user_id ) );

                foreach ( $new_sessions as $verifier => $new_session ) {
                        $new_session['verifier'] = $verifier;
                        $new_session['user_id'] = $this->user_id;
                        $wpdb->insert( $wpdb->sessions, $new_session );
                }
        }
}