function drupal_session_regenerate in Memcache Storage 7

Called when an anonymous user becomes authenticated or vice-versa.

File

includes/session.inc, line 338

User session handling functions.

Code

function drupal_session_regenerate() {
  global $user, $is_https;

  // Nothing to do if we are not allowed to change the session.
  if (!drupal_save_session()) {
    return;
  }
  if ($is_https && variable_get('https', FALSE)) {
    $insecure_session_name = substr(session_name(), 1);
    if (!isset($GLOBALS['lazy_session']) && isset($_COOKIE[$insecure_session_name])) {
      $old_insecure_session_id = $_COOKIE[$insecure_session_name];
    }
    $params = session_get_cookie_params();
    $session_id = drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55));

    // If a session cookie lifetime is set, the session will expire
    // $params['lifetime'] seconds from the current request. If it is not set,
    // it will expire when the browser is closed.
    $expire = $params['lifetime'] ? REQUEST_TIME + $params['lifetime'] : 0;
    setcookie($insecure_session_name, $session_id, $expire, $params['path'], $params['domain'], FALSE, $params['httponly']);
    $_COOKIE[$insecure_session_name] = $session_id;
  }
  if (drupal_session_started()) {
    $old_session_id = session_id();
  }
  session_id(drupal_hash_base64(uniqid(mt_rand(), TRUE) . drupal_random_bytes(55)));
  if (isset($old_session_id)) {
    $params = session_get_cookie_params();
    $expire = $params['lifetime'] ? REQUEST_TIME + $params['lifetime'] : 0;
    setcookie(session_name(), session_id(), $expire, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
    $session = MemcacheStorageAPI::get($old_session_id, 'sessions');
    $session->sid = session_id();
    if ($is_https) {
      $session->ssid = session_id();

      // If the "secure pages" setting is enabled, use the newly-created
      // insecure session identifier as the regenerated sid.
      if (variable_get('https', FALSE)) {
        $session->sid = $session_id;
      }
    }
    MemcacheStorageAPI::set($session->sid, $session, ini_get('session.gc_maxlifetime'), 'sessions');
    MemcacheStorageAPI::delete($old_session_id, 'sessions');
  }
  elseif (isset($old_insecure_session_id)) {

    // If logging in to the secure site, and there was no active session on the
    // secure site but a session was active on the insecure site, update the
    // insecure session with the new session identifiers.
    $session = MemcacheStorageAPI::get($old_insecure_session_id, 'sessions');
    $session->sid = $session_id;
    $session->ssid = session_id();
    MemcacheStorageAPI::set($session->sid, $session, ini_get('session.gc_maxlifetime'), 'sessions');
    MemcacheStorageAPI::delete($old_insecure_session_id, 'sessions');
  }
  else {

    // Start the session when it doesn't exist yet.
    // Preserve the logged in user, as it will be reset to anonymous
    // by _drupal_session_read.
    $account = $user;
    drupal_session_start();
    $user = $account;
  }
  date_default_timezone_set(drupal_get_user_timezone());
}