<commit_before><?php
/**
  phpSec - A PHP security library

  @author    <NAME> <<EMAIL>>
  @copyright Copyright (c) <NAME>, 2011
  @link      https://github.com/phpsec/phpSec
  @license   http://opensource.org/licenses/mit-license.php The MIT License
  @package   phpSec
 */

/**
 * Implements a session handler to save session data encrypted.
 */
class phpsecSession {
  private static $_sessIdRegen;
  private static $_savePath;
  private static $_name;
  private static $_keyCookie;
  private static $_secret;
  private static $_currID;
  private static $_newID;

  /**
   * Init the phpSec session handler.
   */
  public static function init($_sessIdRegen) {
  	self::$_sessIdRegen = $_sessIdRegen;

  	ini_set('session.save_handler', 'user');
    session_set_save_handler(
      'phpsecSession::open',
      'phpsecSession::close',
      'phpsecSession::read',
      'phpsecSession::write',
      'phpsecSession::destroy',
      'phpsecSession::gc'
    );

    /* Since we set a session cookie on our session handler, disable the built-in cookies. */
    ini_set('session.use_cookies', 0);

    /* Start a new session. */
    session_start();

    /* Check the fingerprint to see if it matches, if not clear session data. */
    $fingerprint = hash(phpsec::HASH_TYPE, 'phpSec-fingerprint'.$_SERVER['HTTP_USER_AGENT']);
    if(!isset($_SESSION['phpSec-fingerprint'])) {
      $_SESSION['phpSec-fingerprint'] = $fingerprint;
    }
    if($fingerprint != $_SESSION['phpSec-fingerprint']) {
      $_SESSION = array();
    }
  }


  /**
   * Open a session.
   *
   * @param string $path
   * @param string $name
   * @return bool
   */
  public static function open($path, $name) {
    /* Set some variables we need later. */
    self::$_savePath  = $path;
    self::$_name      = $name;
    self::$_keyCookie = $name.'_secret';

    /* Set current and new ID. */
    if(isset($_COOKIE[$name])) {
      self::$_currID = $_COOKIE[$name];
    } else {
      self::$_currID = null;
    }
    if(self::$_sessIdRegen === true || self::$_currID === null) {
    	self::$_newID = phpsecRand::str(128);
    } else {
    	self::$_newID = self::$_currID;
    }

    /* Set cookie with new session ID. */
    $cookieParam = session_get_cookie_params();
    setcookie(
      $name,
      self::$_newID,
      $cookieParam['lifetime'],
      $cookieParam['path'],
      $cookieParam['domain'],
      $cookieParam['secure'],
      $cookieParam['httponly']
    );

    /* If we don't have a encryption key, create one. */
    if(!isset($_COOKIE[self::$_keyCookie])) {
      /* Create a secret used for encryption of session. */
      self::setSecret();
    } else {
      self::$_secret = base64_decode($_COOKIE[self::$_keyCookie]);
    }
    return true;
  }

  /**
   * Close a session.
   *
   * @return bool
   */
  public static function close() {
    return true;
  }

  /**
   * Read and decrypt a session.
   *
   * @param string $id
   * @return mixed
   */
  public static function read($id) {
    /* If no cookie is set, just dropi it! */
    if(!isset($_COOKIE[self::$_name])) {
      return false;
    }

    /* Read from store and decrypt. */
    $sessData = phpsec::$store->read('session', $_COOKIE[self::$_name]);
    if($sessData !== false ) {
      $return = phpsecCrypt::decrypt($sessData, self::$_secret);
    } else {
      $return = false;
    }
    return $return;
  }

  /**
   * Encrypt and save a session.
   *
   * @param string $id
   * @param string $data
   * @return bool
   */
  public static function write($id, $data) {
    /* Encrypt session. */
    $encrypted = phpsecCrypt::encrypt($data, self::$_secret);

    /* Destroy old session. */
    if(self::$_newID != self::$_currID) {
    	self::destroy(self::$_currID);
    }

    /* Write new session, with new ID. */
    return phpsec::$store->write('session', self::$_newID, $encrypted);

  }
  /**
   * Destroy/remove a session.
   *
   * @param string $id
   * @return bool
   */
  public static function destroy($id) {
    return phpsec::$store->delete('session', $id);
  }
  /**
   * Do garbage collection.
   *
   * @param integer $ttl
   * @return bool
   */
  public static function gc($ttl) {
    $Ids = phpsec::$store->listIds('session');
    foreach($Ids as $Id) {
      $data = phpsec::$store->meta('session', $Id);
      if($data->time + $ttl < time()) {
        phpsec::$store->delete('session', $Id);
      }
    }
    return true;
  }

  /**
   * Set the cookie with the secret.
   *
   * @return true
   */
  private static function setSecret() {
    self::$_secret = phpsecRand::bytes(32);
    $cookieParam = session_get_cookie_params();
    setcookie(
      self::$_keyCookie,
      base64_encode(self::$_secret),
      $cookieParam['lifetime'],
      $cookieParam['path'],
      $cookieParam['domain'],
      $cookieParam['secure'],
      $cookieParam['httponly']
    );
    return true;
  }
}
<commit_msg>Adds more characters to the session ID charset.<commit_after><?php
/**
  phpSec - A PHP security library

  @author    <NAME> <<EMAIL>>
  @copyright Copyright (c) <NAME>, 2011
  @link      https://github.com/phpsec/phpSec
  @license   http://opensource.org/licenses/mit-license.php The MIT License
  @package   phpSec
 */

/**
 * Implements a session handler to save session data encrypted.
 */
class phpsecSession {
  private static $_sessIdRegen;
  private static $_savePath;
  private static $_name;
  private static $_keyCookie;
  private static $_secret;
  private static $_currID;
  private static $_newID;

  /**
   * Init the phpSec session handler.
   */
  public static function init($_sessIdRegen) {
  	self::$_sessIdRegen = $_sessIdRegen;

  	ini_set('session.save_handler', 'user');
    session_set_save_handler(
      'phpsecSession::open',
      'phpsecSession::close',
      'phpsecSession::read',
      'phpsecSession::write',
      'phpsecSession::destroy',
      'phpsecSession::gc'
    );

    /* Since we set a session cookie on our session handler, disable the built-in cookies. */
    ini_set('session.use_cookies', 0);

    /* Start a new session. */
    session_start();

    /* Check the fingerprint to see if it matches, if not clear session data. */
    $fingerprint = hash(phpsec::HASH_TYPE, 'phpSec-fingerprint'.$_SERVER['HTTP_USER_AGENT']);
    if(!isset($_SESSION['phpSec-fingerprint'])) {
      $_SESSION['phpSec-fingerprint'] = $fingerprint;
    }
    if($fingerprint != $_SESSION['phpSec-fingerprint']) {
      $_SESSION = array();
    }
  }


  /**
   * Open a session.
   *
   * @param string $path
   * @param string $name
   * @return bool
   */
  public static function open($path, $name) {
    /* Set some variables we need later. */
    self::$_savePath  = $path;
    self::$_name      = $name;
    self::$_keyCookie = $name.'_secret';

    /* Set current and new ID. */
    if(isset($_COOKIE[$name])) {
      self::$_currID = $_COOKIE[$name];
    } else {
      self::$_currID = null;
    }
    if(self::$_sessIdRegen === true || self::$_currID === null) {
    	self::$_newID = phpsecRand::str(128, 'abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ-_.!*#=%');
    } else {
    	self::$_newID = self::$_currID;
    }

    /* Set cookie with new session ID. */
    $cookieParam = session_get_cookie_params();
    setcookie(
      $name,
      self::$_newID,
      $cookieParam['lifetime'],
      $cookieParam['path'],
      $cookieParam['domain'],
      $cookieParam['secure'],
      $cookieParam['httponly']
    );

    /* If we don't have a encryption key, create one. */
    if(!isset($_COOKIE[self::$_keyCookie])) {
      /* Create a secret used for encryption of session. */
      self::setSecret();
    } else {
      self::$_secret = base64_decode($_COOKIE[self::$_keyCookie]);
    }
    return true;
  }

  /**
   * Close a session.
   *
   * @return bool
   */
  public static function close() {
    return true;
  }

  /**
   * Read and decrypt a session.
   *
   * @param string $id
   * @return mixed
   */
  public static function read($id) {
    /* If no cookie is set, just dropi it! */
    if(!isset($_COOKIE[self::$_name])) {
      return false;
    }

    /* Read from store and decrypt. */
    $sessData = phpsec::$store->read('session', $_COOKIE[self::$_name]);
    if($sessData !== false ) {
      $return = phpsecCrypt::decrypt($sessData, self::$_secret);
    } else {
      $return = false;
    }
    return $return;
  }

  /**
   * Encrypt and save a session.
   *
   * @param string $id
   * @param string $data
   * @return bool
   */
  public static function write($id, $data) {
    /* Encrypt session. */
    $encrypted = phpsecCrypt::encrypt($data, self::$_secret);

    /* Destroy old session. */
    if(self::$_newID != self::$_currID) {
    	self::destroy(self::$_currID);
    }

    /* Write new session, with new ID. */
    return phpsec::$store->write('session', self::$_newID, $encrypted);

  }
  /**
   * Destroy/remove a session.
   *
   * @param string $id
   * @return bool
   */
  public static function destroy($id) {
    return phpsec::$store->delete('session', $id);
  }
  /**
   * Do garbage collection.
   *
   * @param integer $ttl
   * @return bool
   */
  public static function gc($ttl) {
    $Ids = phpsec::$store->listIds('session');
    foreach($Ids as $Id) {
      $data = phpsec::$store->meta('session', $Id);
      if($data->time + $ttl < time()) {
        phpsec::$store->delete('session', $Id);
      }
    }
    return true;
  }

  /**
   * Set the cookie with the secret.
   *
   * @return true
   */
  private static function setSecret() {
    self::$_secret = phpsecRand::bytes(32);
    $cookieParam = session_get_cookie_params();
    setcookie(
      self::$_keyCookie,
      base64_encode(self::$_secret),
      $cookieParam['lifetime'],
      $cookieParam['path'],
      $cookieParam['domain'],
      $cookieParam['secure'],
      $cookieParam['httponly']
    );
    return true;
  }
}

{'fraction_non_alphanumeric': 0.16003634894991922, 'fraction_numerical': 0.003836833602584814, 'mean_word_length': 2.7632978723404253, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 25, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2851838', 'n_tokens_mistral': 3330, 'n_tokens_neox': 3213, 'n_words': 744}