Changeset 29221 for trunk/src/wp-includes/user.php

Timestamp:

07/18/2014 09:12:05 AM (12 years ago)

Author:

nacin

Message:

Tie cookies and nonces to user sessions so they may be invalidated upon logout.

Sessions are stored in usermeta via WP_User_Meta_Session_Tokens, which extends the abstract WP_Session_Tokens class. Extending WP_Session_Tokens can allow for alternative storage, such as a separate table or Redis.

Introduces some simple APIs for session listing and destruction, such as wp_get_active_sessions() and wp_destroy_all_sessions().

This invalidates all existing authentication cookies, as a new segment (the session token) has been added to them.

props duck_, nacin, mdawaffe.
see #20276.

File:

• trunk/src/wp-includes/user.php (modified) (1 diff)

trunk/src/wp-includes/user.php

@@ -2174 +2174 @@
     return $user_id;
 }
+
+/**
+ * Retrieve the current session token from the logged_in cookie.
+ *
+ * @since 4.0.0
+ *
+ * @return string Token.
+ */
+function wp_get_session_token() {
+    $cookie = wp_parse_auth_cookie( '', 'logged_in' );
+    return ! empty( $cookie['token'] ) ? $cookie['token'] : '';
+}
+
+/**
+ * Retrieve a list of sessions for the current user.
+ *
+ * @since 4.0.0
+ * @return array Array of sessions.
+ */
+function wp_get_all_sessions() {
+    $manager = WP_Session_Tokens::get_instance( get_current_user_id() );
+    return $manager->get_all_sessions();
+}
+
+/**
+ * Remove the current session token from the database.
+ *
+ * @since 4.0.0
+ */
+function wp_destroy_current_session() {
+    $token = wp_get_session_token();
+    if ( $token ) {
+        $manager = WP_Session_Tokens::get_instance( get_current_user_id() );
+        $manager->destroy_token( $token );
+    }
+}
+
+/**
+ * Remove all but the current session token for the current user for the database.
+ *
+ * @since 4.0.0
+ */
+function wp_destroy_other_sessions() {
+    $token = wp_get_session_token();
+    if ( $token ) {
+        $manager = WP_Session_Tokens::get_instance( get_current_user_id() );
+        $manager->destroy_other_tokens( $token );
+    }
+}
+
+/**
+ * Remove all session tokens for the current user from the database.
+ *
+ * @since 4.0.0
+ */
+function wp_destroy_all_sessions() {
+    $manager = WP_Session_Tokens::get_instance( get_current_user_id() );
+    $manager->destroy_all_tokens();
+}