Take the 2-minute tour ×
Code Review Stack Exchange is a question and answer site for peer programmer code reviews. It's 100% free, no registration required.
 class session{
//variabile folosite
private static $_sessionStarted = false;
private static $_crypt  = 'qwerty347658@$%AdfSV045*&erT2Erb%6w!07&[.?;ru';
private static $_salt   = 'qwertyAF347658@$%AdfSV045*&erTyUsdfYtrLmncBGhu';
private static $_rand   = 'abcdefghijklmnoqprstuvxwz0123456789!@#$%^&*()_-=;:<>,.';
private static $_rand_pass;
//pornire sesiune, setari(http only, folosire cookie,generare pass random, modificare folder sesiuni)
public static function start(){
    ini_set('session.cookie_httponly',1);
    ini_set('session.use_only_cookies',1);
    session_save_path(SESS_PATH);
    ini_set('session.gc_probability', 2);
    ini_set('session.gc_divisor', 100);
    ini_set('session.gc_maxlifetime', 1440); 
    if(self::$_sessionStarted == false){
        session_start();
        self::$_sessionStarted = true;
        self::rand_pass(self::$_rand);
        self::set('bad_ideea:D', self::$_rand_pass);
    }
    session_regenerate_id(true);
}
//sesion destroy, stergem toate sesiunile
public static function stop(){
    if(self::$_sessionStarted == true){
        foreach($_SESSION as $k){
        unset($_SESSION[$k]);
        }
        session_destroy();
    }      
}
//setare sesiuni, folosim array asociativ multidimensional
public static function set($key, $value){
    $_SESSION[$key] = $value;
}
//setare array associtiv doar criptat folosind aes 128 biti(pt informatii confidentiale)
public static function set_e($key, $value){
    $_SESSION[$key] = self::encrypt($value);
}
// returnam valoare aaray asociativ multidimensional
public static function get($key, $secondKey = false){
    if($secondKey == true){
        if(isset($_SESSION[$key][$secondKey])){
            return $_SESSION[$key][$secondKey];
        }
    }else{
        if(isset($_SESSION[$key])){
            return $_SESSION[$key];
        }
    }

    return false;
}
//returnam valoare decriptata array asociativ
public static function get_e($key, $secondKey = false){
        if(isset($_SESSION[$key])){
            return self::decrypt($_SESSION[$key]);
        }
    return false;
}
//verificam existenta cheii in array si verificam daca valoarea corespunde
public static function check($key, $val){
    foreach($key as $k){
        if(!array_key_exists($k, $_SESSION) || $_SESSION[$k] != array_shift($val)){
            return false;
        }
    }
    return true;
}
  //facem unset la sesiuni parametru string sau array
public static function clean($key){
    if(is_array($key)){
        foreach($key as $k){
            unset($k);
        }
    }else{
        unset($key);
    }
}
//hash ripemd320 pt valori importante la care avem nevoie doar de comparare(browser os ip etc)
public static function sess_hash($key){
    return hash('ripemd320', $key.self::$_crypt);
}
//generare parola aleatoare pt criptare si stocare in $_rand_pass
private static function rand_pass(){
    for($i = 0; $i <= 20; $i++){
            $tmp[] =  self::$_rand[rand(0, strlen(self::$_rand)-1)];
    }
    self::$_rand_pass = implode('',$tmp);
}
//criptare
private static function encrypt($decrypted) {
    $key = hash('SHA256', self::$_salt . self::$_rand_pass, true);
    srand();
    $iv = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC), MCRYPT_RAND);
    if (strlen($iv_base64 = rtrim(base64_encode($iv), '=')) != 22) return false;
    $encrypted = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $decrypted . md5($decrypted), MCRYPT_MODE_CBC, $iv));

    return $iv_base64 . $encrypted;
}
//decriptare
private static function decrypt($encrypted) {
    $key = hash('SHA256', self::$_salt . self::$_rand_pass, true);
    $iv = base64_decode(substr($encrypted, 0, 22) . '==');
    $encrypted = substr($encrypted, 22);
    $decrypted = rtrim(mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, base64_decode($encrypted), MCRYPT_MODE_CBC, $iv), "\0\4");
    $hash = substr($decrypted, -32);
    $decrypted = substr($decrypted, 0, -32);
    if (md5($decrypted) != $hash) return false;

    return $decrypted;
}
//afisam arrayul $_SESSION pt debug
 public static function display(){
    echo '<pre>';
    print_r($_SESSION);
    echo '</pre>';
}

I wrote a small session wrapper class. Is it good for something? For now I'm still trying to figure out where to store the encryption key. I guess MySQL is the best place to save it. I'm going to regenerate the key every 6-12 hours for each user.

share|improve this question
1  
What are you trying to accomplish by encrypting session keys? –  user555 Nov 14 '12 at 18:15
    
I'm just encrypting the value not the keys :d. I need encryption (a light one) for some sensitive data. For the moment i'm storing the ecnrytion key in the session file itself, until i find a good ideea where to save it. I know it's a bad ideea, but i's not final. When i finish the class i'm going to store the encryption key in the db or something like that. I was looking for a way to write to RAM, but i guess it's not possible just with php (simple). And sorry for bad english, i'm using gtranslate. –  danutz0501 Nov 14 '12 at 19:43
    
I still don't understand the point of your class. I hope your not planing to store sensitive data inside a session. You can't write to RAM with PHP. Imagine what could happen if you where be able to write to RAM on a shared host. –  user555 Nov 15 '12 at 0:28

1 Answer 1

  1. You said in a comment that you're storing half of the encryption key alongside the data the data you're encrypting, and the other half in the code itself. What's the point of that? If they have access to the PHP files, they probably have access to the session files, too.

  2. There's basically no point in calling srand() with no arguments. It doesn't make its output "more random". Relevant

  3. The issue with calling session_regenerate_id with every page load is that if you have two pages loading from the same user at the same time, the user will get logged out.

Here's an example:

  1. User sends "GET /page1" and "Cookie: session=cookie1"
  2. User sends "GET /page2" and "Cookie: session=cookie1"
  3. Server receives request for page1; Server changes cookie, sends back "Set-Cookie: session=cookie2".
  4. User receives new cookie and saves it, but it is too late.
  5. Server receives request for page2; since cookie1 != cookie2, the request fails and the user is redirected to the login page.
share|improve this answer
    
If they got access to your php files, i guess session files are your last concern. And i store them in session files until i find a better place(ex:mysql). –  danutz0501 Nov 15 '12 at 14:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.