vendor/kunstmaan/admin-bundle/EventListener/SessionSecurityListener.php line 50

Open in your IDE?
  1. <?php
  3. namespace Kunstmaan\AdminBundle\EventListener;
  5. use Psr\Log\LoggerInterface;
  6. use Symfony\Component\HttpFoundation\Request;
  7. use Symfony\Component\HttpFoundation\Session\SessionInterface;
  8. use Symfony\Component\HttpKernel\Event\RequestEvent;
  9. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  10. use Symfony\Component\HttpKernel\HttpKernelInterface;
  12. class SessionSecurityListener
  13. {
  14.     /**
  15.      * @var LoggerInterface
  16.      */
  17.     private $logger;
  19.     /**
  20.      * @var bool
  21.      */
  22.     private $ipCheck;
  24.     /**
  25.      * @var bool
  26.      */
  27.     private $userAgentCheck;
  29.     /**
  30.      * @var string
  31.      */
  32.     private $ip;
  34.     /**
  35.      * @var string
  36.      */
  37.     private $userAgent;
  39.     /**
  40.      * @param bool $ipCheck
  41.      * @param bool $userAgentCheck
  42.      */
  43.     public function __construct($ipCheck, $userAgentCheck, LoggerInterface $logger)
  44.     {
  45.         $this->ipCheck = $ipCheck;
  46.         $this->userAgentCheck = $userAgentCheck;
  47.         $this->logger = $logger;
  48.     }
  50.     public function onKernelResponse(ResponseEvent $event)
  51.     {
  52.         if (HttpKernelInterface::MAIN_REQUEST !== $event->getRequestType()) {
  53.             return;
  54.         }
  56.         // Make sure the ip and user agent is stored in the session
  57.         $request = $event->getRequest();
  58.         if ($request->hasSession() && $request->getSession()->isStarted()) {
  59.             $session = $request->getSession();
  60.             if ($this->ipCheck && !$session->has('kuma_ip')) {
  61.                 $session->set('kuma_ip', $this->getIp($request));
  62.             }
  63.             if ($this->userAgentCheck && !$session->has('kuma_ua')) {
  64.                 $session->set('kuma_ua', $this->getUserAgent($request));
  65.             }
  66.         }
  67.     }
  69.     public function onKernelRequest(RequestEvent $event)
  70.     {
  71.         if (HttpKernelInterface::MAIN_REQUEST !== $event->getRequestType()) {
  72.             return;
  73.         }
  75.         $request = $event->getRequest();
  76.         if ($request->hasSession() && $request->getSession()->isStarted()) {
  77.             $session = $request->getSession();
  79.             // Check that the ip matches
  80.             if ($this->ipCheck && $session->has('kuma_ip') && $session->get('kuma_ip') != $this->getIp($request)) {
  81.                 $this->logger->error(sprintf(
  82.                     "Session ip '%s' does not match with request ip '%s', invalidating the current session",
  83.                     $session->get('kuma_ip'),
  84.                     $this->getIp($request)
  85.                 ));
  86.                 $this->invalidateSession($session, $request);
  87.             }
  89.             // Check that the user agent matches
  90.             if ($this->userAgentCheck && $session->has('kuma_ua') && $session->get('kuma_ua') != $this->getUserAgent($request)) {
  91.                 $this->logger->error(sprintf(
  92.                     "Session user agent '%s' does not match with request user agent '%s', invalidating the current session",
  93.                     $session->get('kuma_ua'),
  94.                     $this->getUserAgent($request)
  95.                 ));
  96.                 $this->invalidateSession($session, $request);
  97.             }
  98.         }
  99.     }
  101.     private function invalidateSession(SessionInterface $session, Request $request)
  102.     {
  103.         $session->invalidate();
  104.         $session->set('kuma_ip', $this->getIp($request));
  105.         $session->set('kuma_ua', $this->getUserAgent($request));
  106.     }
  108.     private function getIp(Request $request): string
  109.     {
  110.         if (!$this->ip) {
  111.             $forwarded = $request->server->get('HTTP_X_FORWARDED_FOR');
  112.             if (\strlen($forwarded) > 0) {
  113.                 $parts = explode(',', $forwarded);
  114.                 $parts = array_map('trim', $parts);
  115.                 $parts = array_filter($parts);
  116.                 if (\count($parts) > 0) {
  117.                     $ip = $parts[0];
  118.                 }
  119.             }
  120.             if (empty($ip)) {
  121.                 $ip = $request->getClientIp();
  122.             }
  123.             $this->ip = $ip;
  124.         }
  126.         return $this->ip;
  127.     }
  129.     private function getUserAgent(Request $request): array|string
  130.     {
  131.         if (!$this->userAgent) {
  132.             $this->userAgent = $request->headers->get('User-Agent');
  133.         }
  135.         return $this->userAgent;
  136.     }
  137. }