File "class.sessionsanity.php"

Full Path: /home/shopalzfdn/public_html/wp-content/mu-plugins/wpengine-common.disable/class.sessionsanity.php
File size: 1.16 KB
MIME-type: text/x-php; charset=us-ascii
Charset: utf-8

<?php

namespace wpe\plugin;

/**
 * Enforce some sanity on expiration times in wp_sessions. This is motivated by 
 * a recent bug in the EDD plugin that caused sessions to be expiring in the 
 * year 2058, which is not going to be even close to the right answer. Instead,
 * we're going to cap the session timeout at 30 days.
 */
class SessionSanity {

	public function register_hooks() {
		add_filter( 'wp_session_expiration', array( $this, 'set_expiration_time' ), 999999 );
	}

	public function set_expiration_time( $expiration ) {
/**
 * Filter the upper bound on "sane" expriration times. IMPORTANT: This is a relative time (i.e., number of 
 * seconds until expiration) and NOT an absolute time (unixtime of expiration). Keep it small. Sessions are
 * not designed to last forever.
 * 
 * @since 2.1.14
 *
 * @param number $max_expiration maximum number of seconds until the session expires.
 */
		$max_expiration = apply_filters( 'wpe_max_session_expiration', 30 * DAY_IN_SECONDS );
		if ( $expiration > $max_expiration ) {
			error_log( "Invalid session timeout: $expiration. Maximum allowed value: {$max_expiration}" );
			return $max_expiration;
		}

		return $expiration;
	}

}