' . $this->t('Updates were attempted. If you see no failures below, you may proceed happily back to your site. Otherwise, you may need to update your database manually.', [':url' => Url::fromRoute('
' . $this->t('The update process was aborted prematurely while running update #@version in @module.module.', [ '@version' => $version, @@ -434,9 +439,9 @@ protected function results(Request $request) { ]; // Output a list of info messages. - if (!empty($_SESSION['update_results'])) { + if (!empty($update_results)) { $all_messages = []; - foreach ($_SESSION['update_results'] as $module => $updates) { + foreach ($update_results as $module => $updates) { if ($module != '#abort') { $module_has_message = FALSE; $info_messages = []; @@ -498,9 +503,6 @@ protected function results(Request $request) { ]; } } - unset($_SESSION['update_results']); - unset($_SESSION['update_success']); - unset($_SESSION['update_ignore_warnings']); return $build; } @@ -569,7 +571,7 @@ protected function triggerBatch(Request $request) { $maintenance_mode = $this->state->get('system.maintenance_mode', FALSE); // Store the current maintenance mode status in the session so that it can // be restored at the end of the batch. - $_SESSION['maintenance_mode'] = $maintenance_mode; + $request->getSession()->set('maintenance_mode', $maintenance_mode); // During the update, always put the site into maintenance mode so that // in-progress schema changes do not affect visiting users. if (empty($maintenance_mode)) { @@ -649,16 +651,16 @@ public static function batchFinished($success, $results, $operations) { // No updates to run, so caches won't get flushed later. Clear them now. drupal_flush_all_caches(); - $_SESSION['update_results'] = $results; - $_SESSION['update_success'] = $success; - $_SESSION['updates_remaining'] = $operations; + $request = \Drupal::request(); + $request->getSession()->set('update_results', $results); + $request->getSession()->set('update_success', $success); + $request->getSession()->set('updates_remaining', $operations); // Now that the update is done, we can put the site back online if it was // previously not in maintenance mode. - if (empty($_SESSION['maintenance_mode'])) { + if (!$request->getSession()->remove('maintenance_mode')) { \Drupal::state()->set('system.maintenance_mode', FALSE); } - unset($_SESSION['maintenance_mode']); } /** diff --git a/core/modules/system/src/Tests/Session/SessionTest.php b/core/modules/system/src/Tests/Session/SessionTest.php index 1be9561b36..396f725279 100644 --- a/core/modules/system/src/Tests/Session/SessionTest.php +++ b/core/modules/system/src/Tests/Session/SessionTest.php @@ -140,7 +140,7 @@ public function testSessionPersistenceOnLogin() { $user = $this->drupalCreateUser(); $this->drupalLogin($user); // Test property added to session object form hook_user_login(). - $this->drupalGet('session-test/get-from-session-object'); + $this->drupalGet('session-test/get'); $this->assertText('foobar', 'Session data is saved in Session() object.', 'Session'); } @@ -311,7 +311,7 @@ public function assertSessionCookie($sent) { } /** - * Assert whether $_SESSION is empty at the beginning of the request. + * Assert whether the user's session is empty at the beginning of the request. */ public function assertSessionEmpty($empty) { if ($empty) { diff --git a/core/modules/system/system.install b/core/modules/system/system.install index a7f964539f..e265eece9c 100644 --- a/core/modules/system/system.install +++ b/core/modules/system/system.install @@ -1132,7 +1132,7 @@ function system_schema() { 'default' => 0, ], 'session' => [ - 'description' => 'The serialized contents of $_SESSION, an array of name/value pairs that persists across page requests by this session ID. Drupal loads $_SESSION from here at the start of each request and saves it at the end.', + 'description' => 'The serialized contents of the user\'s session, an array of name/value pairs that persists across page requests by this session ID. Drupal loads the user\'s session from here at the start of each request and saves it at the end.', 'type' => 'blob', 'not null' => FALSE, 'size' => 'big', diff --git a/core/modules/system/system.module b/core/modules/system/system.module index bb82d4b19f..45db82c31d 100644 --- a/core/modules/system/system.module +++ b/core/modules/system/system.module @@ -430,13 +430,14 @@ function template_preprocess_entity_add_list(&$variables) { /** * Setup a given callback to run via authorize.php with elevated privileges. * - * To use authorize.php, certain variables must be stashed into $_SESSION. This - * function sets up all the necessary $_SESSION variables. The calling function - * should then redirect to authorize.php, using the full path returned by - * system_authorized_get_url(). That initiates the workflow that will eventually - * lead to the callback being invoked. The callback will be invoked at a low - * bootstrap level, without all modules being invoked, so it needs to be careful - * not to assume any code exists. Example (system_authorized_run()): + * To use authorize.php, certain variables must be stashed in the user's + * session. This function sets up all the necessary session variables. The + * calling function should then redirect to authorize.php, using the full path + * returned by system_authorized_get_url(). That initiates the workflow that + * will eventually lead to the callback being invoked. The callback will be + * invoked at a low bootstrap level, without all modules being invoked, so it + * needs to be careful not to assume any code exists. + * Example (system_authorized_run()): * @code * system_authorized_init($callback, $file, $arguments, $page_title); * return new RedirectResponse(system_authorized_get_url()->toString()); @@ -463,20 +464,21 @@ function template_preprocess_entity_add_list(&$variables) { * Nothing, this function just initializes variables in the user's session. */ function system_authorized_init($callback, $file, $arguments = [], $page_title = NULL) { + $request = \Drupal::request(); // First, figure out what file transfer backends the site supports, and put // all of those in the SESSION so that authorize.php has access to all of // them via the class autoloader, even without a full bootstrap. - $_SESSION['authorize_filetransfer_info'] = drupal_get_filetransfer_info(); + $request->getSession()->set('authorize_filetransfer_info', drupal_get_filetransfer_info()); // Now, define the callback to invoke. - $_SESSION['authorize_operation'] = [ + $request->getSession()->set('authorize_operation', [ 'callback' => $callback, 'file' => $file, 'arguments' => $arguments, - ]; + ]); if (isset($page_title)) { - $_SESSION['authorize_page_title'] = $page_title; + $request->getSession()->set('authorize_page_title', $page_title); } } diff --git a/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php b/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php index f81658d537..e2aa0b7d35 100644 --- a/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php +++ b/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php @@ -37,7 +37,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { if (empty($storage)) { $user_input = $form_state->getUserInput(); if (empty($user_input)) { - $_SESSION['constructions'] = 0; + $this->getRequest()->getSession()->set('constructions', 0); } // Put the initial thing into the storage $storage = [ @@ -49,8 +49,12 @@ public function buildForm(array $form, FormStateInterface $form_state) { $form_state->setStorage($storage); } // Count how often the form is constructed. - $_SESSION['constructions']++; - drupal_set_message("Form constructions: " . $_SESSION['constructions']); + $this->getRequest()->getSession()->set( + 'constructions', + $this->getRequest()->getSession()->get('constructions', 0) + 1 + ); + + drupal_set_message("Form constructions: " . $this->getRequest()->getSession()->get('constructions')); $form['title'] = [ '#type' => 'textfield', @@ -137,7 +141,7 @@ public function continueSubmitForm(array &$form, FormStateInterface $form_state) */ public function submitForm(array &$form, FormStateInterface $form_state) { drupal_set_message("Title: " . Html::escape($form_state->getValue('title'))); - drupal_set_message("Form constructions: " . $_SESSION['constructions']); + drupal_set_message("Form constructions: " . $this->getRequest()->getSession()->get('constructions')); if ($form_state->has(['thing', 'changed'])) { drupal_set_message("The thing has been changed."); } diff --git a/core/modules/system/tests/modules/menu_test/menu_test.services.yml b/core/modules/system/tests/modules/menu_test/menu_test.services.yml index 81f1f50b95..e1a0aa059b 100644 --- a/core/modules/system/tests/modules/menu_test/menu_test.services.yml +++ b/core/modules/system/tests/modules/menu_test/menu_test.services.yml @@ -6,5 +6,6 @@ services: access_check.menu_test_session: class: Drupal\menu_test\Access\AccessCheck + arguments: ['@request_stack'] tags: - { name: access_check, applies_to: _menu_test_session_access } diff --git a/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php b/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php index 1b67579eba..8ba743e032 100644 --- a/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php +++ b/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php @@ -4,12 +4,30 @@ use Drupal\Core\Access\AccessResult; use Drupal\Core\Routing\Access\AccessInterface; +use Symfony\Component\HttpFoundation\RequestStack; /** * Checks access based on the 'menu_test' key in session. */ class AccessCheck implements AccessInterface { + /** + * The request stack. + * + * @var \Symfony\Component\HttpFoundation\RequestStack + */ + protected $requestStack; + + /** + * Constructs a new AccessCheck class. + * + * @param \Symfony\Component\HttpFoundation\RequestStack $request_stack + * The request stack. + */ + public function __construct(RequestStack $request_stack) { + $this->requestStack = $request_stack; + } + /** * Check to see if user accessed this page. * @@ -17,12 +35,9 @@ class AccessCheck implements AccessInterface { * The access result. */ public function access() { - if (!isset($_SESSION['menu_test'])) { - $result = AccessResult::allowed(); - } - else { - $result = AccessResult::allowedIf($_SESSION['menu_test'] < 2); - } + $result = AccessResult::allowedIf( + $this->requestStack->getMasterRequest()->getSession()->get('menu_test', 0) < 2 + ); return $result->setCacheMaxAge(0); } diff --git a/core/modules/system/tests/modules/menu_test/src/TestControllers.php b/core/modules/system/tests/modules/menu_test/src/TestControllers.php index 31fb341afb..2ecd4e6c51 100644 --- a/core/modules/system/tests/modules/menu_test/src/TestControllers.php +++ b/core/modules/system/tests/modules/menu_test/src/TestControllers.php @@ -3,6 +3,7 @@ namespace Drupal\menu_test; use Drupal\Component\Utility\SafeMarkup; +use Symfony\Component\HttpFoundation\Request; /** * Controllers for testing the menu integration routing system. @@ -32,13 +33,19 @@ public function test2() { /** * Prints out test data. + * + * @param \Symfony\Component\HttpFoundation\Request $request + * The request. + * + * @return array + * Render array. */ - public function testSession() { - if (!isset($_SESSION['menu_test'])) { - $_SESSION['menu_test'] = 0; - } - $_SESSION['menu_test']++; - return ['#markup' => SafeMarkup::format('Session menu_test is @count', ['@count' => $_SESSION['menu_test']])]; + public function testSession(Request $request) { + $request->getSession()->set( + 'menu_test', + $request->getSession()->get('menu_test', 0) + 1 + ); + return ['#markup' => SafeMarkup::format('Session menu_test is @count', ['@count' => $request->getSession()->get('menu_test')])]; } /** diff --git a/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module b/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module index 60d2452836..2be874da7a 100644 --- a/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module +++ b/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module @@ -23,7 +23,8 @@ function session_exists_cache_context_test_page_top(array &$page_top) { ], ]; - if (\Drupal::request()->query->get('trigger_session')) { - $_SESSION['session_exists_cache_context_test'] = TRUE; + $request = \Drupal::request(); + if ($request->query->get('trigger_session')) { + $request->getSession()->set('session_exists_cache_context_test', TRUE); } } diff --git a/core/modules/system/tests/modules/session_test/session_test.module b/core/modules/system/tests/modules/session_test/session_test.module index b3ceff80a5..7906595541 100644 --- a/core/modules/system/tests/modules/session_test/session_test.module +++ b/core/modules/system/tests/modules/session_test/session_test.module @@ -15,5 +15,5 @@ function session_test_user_login($account) { exit; } // Add some data in the session for retrieval testing purpose. - \Drupal::request()->getSession()->set("session_test_key", "foobar"); + \Drupal::request()->getSession()->set("session_test_value", "foobar"); } diff --git a/core/modules/system/tests/modules/session_test/session_test.routing.yml b/core/modules/system/tests/modules/session_test/session_test.routing.yml index 84978c9474..0a4edbc53d 100644 --- a/core/modules/system/tests/modules/session_test/session_test.routing.yml +++ b/core/modules/system/tests/modules/session_test/session_test.routing.yml @@ -7,15 +7,6 @@ session_test.get: no_cache: TRUE requirements: _access: 'TRUE' -session_test.get_from_session_object: - path: '/session-test/get-from-session-object' - defaults: - _title: 'Session value' - _controller: '\Drupal\session_test\Controller\SessionTestController::getFromSessionObject' - options: - no_cache: TRUE - requirements: - _access: 'TRUE' session_test.id: path: '/session-test/id' defaults: diff --git a/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php b/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php index 76a5462942..f8b1af8399 100644 --- a/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php +++ b/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php @@ -12,29 +12,17 @@ */ class SessionTestController extends ControllerBase { - /** - * Prints the stored session value to the screen. - * - * @return string - * A notification message. - */ - public function get() { - return empty($_SESSION['session_test_value']) - ? [] - : ['#markup' => $this->t('The current value of the stored session variable is: %val', ['%val' => $_SESSION['session_test_value']])]; - } - /** * Prints the stored session value to the screen. * * @param \Symfony\Component\HttpFoundation\Request $request * The incoming request. * - * @return string + * @return array * A notification message. */ - public function getFromSessionObject(Request $request) { - $value = $request->getSession()->get("session_test_key"); + public function get(Request $request) { + $value = $request->getSession()->get("session_test_value"); return empty($value) ? [] : ['#markup' => $this->t('The current value of the stored session variable is: %val', ['%val' => $value])]; @@ -50,9 +38,9 @@ public function getFromSessionObject(Request $request) { * A notification message with session ID. */ public function getId(Request $request) { - // Set a value in $_SESSION, so that SessionManager::save() will start - // a session. - $_SESSION['test'] = 'test'; + // Set a value in the user's session, so that SessionManager::save() will + // start a session. + $request->getSession()->set('test', 'test'); $request->getSession()->save(); @@ -73,7 +61,7 @@ public function getIdFromCookie(Request $request) { } /** - * Stores a value in $_SESSION['session_test_value']. + * Stores a value in the user's session. * * @param string $test_value * A session value. @@ -81,8 +69,8 @@ public function getIdFromCookie(Request $request) { * @return string * A notification message. */ - public function set($test_value) { - $_SESSION['session_test_value'] = $test_value; + public function set($test_value, Request $request) { + $request->getSession()->set('session_test_value', $test_value); return ['#markup' => $this->t('The current value of the stored session variable has been set to %val', ['%val' => $test_value])]; } @@ -97,9 +85,9 @@ public function set($test_value) { * @return string * A notification message. */ - public function noSet($test_value) { + public function noSet($test_value, Request $request) { \Drupal::service('session_handler.write_safe')->setSessionWritable(FALSE); - $this->set($test_value); + $this->set($test_value, $request); return ['#markup' => $this->t('session saving was disabled, and then %val was set', ['%val' => $test_value])]; } @@ -149,14 +137,9 @@ public function isLoggedIn() { * The response. */ public function traceHandler(Request $request) { - // Start a session if necessary, set a value and then save and close it. - $request->getSession()->start(); - if (empty($_SESSION['trace-handler'])) { - $_SESSION['trace-handler'] = 1; - } - else { - $_SESSION['trace-handler']++; - } + $session = $request->getSession(); + $session->set('trace-handler', $session->get('trace-handler', 0) + 1); + // Close the session to create the trace. $request->getSession()->save(); // Collect traces and return them in JSON format. diff --git a/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php b/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php index 47c8c5b110..625dfe5b8d 100644 --- a/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php +++ b/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php @@ -13,7 +13,7 @@ class SessionTestSubscriber implements EventSubscriberInterface { /** - * Stores whether $_SESSION is empty at the beginning of the request. + * Stores whether the user's session is empty at the beginning of the request. * * @var bool */ diff --git a/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php b/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php index b3f9b310b3..6a6d8d3f26 100644 --- a/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php +++ b/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php @@ -31,7 +31,7 @@ protected function setUp() { * Initializing authorize.php needs to happen in the child Drupal * installation, not the parent. So, we visit a menu callback provided by * system_test.module which calls system_authorized_init() to initialize the - * $_SESSION inside the test site, not the framework site. This callback + * user's session inside the test site, not the framework site. This callback * redirects to authorize.php when it's done initializing. * * @see system_authorized_init() diff --git a/core/modules/update/src/Form/UpdateReady.php b/core/modules/update/src/Form/UpdateReady.php index 15a9ddd3f5..95947c5d3e 100644 --- a/core/modules/update/src/Form/UpdateReady.php +++ b/core/modules/update/src/Form/UpdateReady.php @@ -118,21 +118,21 @@ public function buildForm(array $form, FormStateInterface $form_state) { * {@inheritdoc} */ public function submitForm(array &$form, FormStateInterface $form_state) { + $session = $this->getRequest()->getSession(); // Store maintenance_mode setting so we can restore it when done. - $_SESSION['maintenance_mode'] = $this->state->get('system.maintenance_mode'); + $session->set('maintenance_mode', $this->state->get('system.maintenance_mode')); if ($form_state->getValue('maintenance_mode') == TRUE) { $this->state->set('system.maintenance_mode', TRUE); } - if (!empty($_SESSION['update_manager_update_projects'])) { + if ($session->has('update_manager_update_projects')) { // Make sure the Updater registry is loaded. drupal_get_updaters(); $updates = []; $directory = _update_manager_extract_directory(); - $projects = $_SESSION['update_manager_update_projects']; - unset($_SESSION['update_manager_update_projects']); + $projects = $session->remove('update_manager_update_projects'); $project_real_location = NULL; foreach ($projects as $project => $url) { diff --git a/core/modules/update/update.authorize.inc b/core/modules/update/update.authorize.inc index 1c2cc60fb2..0e4d14ce0d 100644 --- a/core/modules/update/update.authorize.inc +++ b/core/modules/update/update.authorize.inc @@ -60,7 +60,7 @@ function update_authorize_run_update($filetransfer, $projects) { // Since authorize.php has its own method for setting the page title, set it // manually here rather than passing it in to batch_set() as would normally // be done. - $_SESSION['authorize_page_title'] = t('Installing updates'); + \Drupal::request()->getSession()->set('authorize_page_title', t('Installing updates')); // Invoke the batch via authorize.php. return system_authorized_batch_process(); @@ -114,7 +114,7 @@ function update_authorize_run_install($filetransfer, $project, $updater_name, $l // Since authorize.php has its own method for setting the page title, set it // manually here rather than passing it in to batch_set() as would normally // be done. - $_SESSION['authorize_page_title'] = t('Installing %project', ['%project' => $project]); + \Drupal::request()->getSession()->set('authorize_page_title', t('Installing %project', ['%project' => $project])); // Invoke the batch via authorize.php. return system_authorized_batch_process(); @@ -213,13 +213,16 @@ function update_authorize_update_batch_finished($success, $results) { } } $offline = \Drupal::state()->get('system.maintenance_mode'); + $session = \Drupal::request()->getSession(); + // Unset the variable since it is no longer needed. + $maintenance_mode = $session->remove('maintenance_mode'); if ($success) { // Now that the update completed, we need to clear the available update data // and recompute our status, so prevent show bogus results. _update_authorize_clear_update_status(); // Take the site out of maintenance mode if it was previously that way. - if ($offline && isset($_SESSION['maintenance_mode']) && $_SESSION['maintenance_mode'] == FALSE) { + if ($offline && $maintenance_mode === FALSE) { \Drupal::state()->set('system.maintenance_mode', FALSE); $page_message = [ 'message' => t('Update was completed successfully. Your site has been taken out of maintenance mode.'), @@ -264,15 +267,14 @@ function update_authorize_update_batch_finished($success, $results) { '#access' => $url->access(\Drupal::currentUser()) ]; - // Unset the variable since it is no longer needed. - unset($_SESSION['maintenance_mode']); - // Set all these values into the SESSION so authorize.php can display them. - $_SESSION['authorize_results']['success'] = $success; - $_SESSION['authorize_results']['page_message'] = $page_message; - $_SESSION['authorize_results']['messages'] = $results['log']; - $_SESSION['authorize_results']['tasks'] = $results['tasks']; - $_SESSION['authorize_page_title'] = t('Update manager'); + $session->set('authorize_results', [ + 'success' => $success, + 'page_message' => $page_message, + 'messages' => $results['log'], + 'tasks' => $results['tasks'] + ]); + $session->set('authorize_page_title', t('Update manager')); } /** @@ -296,9 +298,12 @@ function update_authorize_install_batch_finished($success, $results) { } } $offline = \Drupal::state()->get('system.maintenance_mode'); + $session = \Drupal::request()->getSession(); + // Unset the variable since it is no longer needed. + $maintenance_mode = $session->remove('maintenance_mode'); if ($success) { // Take the site out of maintenance mode if it was previously that way. - if ($offline && isset($_SESSION['maintenance_mode']) && $_SESSION['maintenance_mode'] == FALSE) { + if ($offline && $maintenance_mode === FALSE) { \Drupal::state()->set('system.maintenance_mode', FALSE); $page_message = [ 'message' => t('Installation was completed successfully. Your site has been taken out of maintenance mode.'), @@ -325,15 +330,14 @@ function update_authorize_install_batch_finished($success, $results) { ]; } - // Unset the variable since it is no longer needed. - unset($_SESSION['maintenance_mode']); - // Set all these values into the SESSION so authorize.php can display them. - $_SESSION['authorize_results']['success'] = $success; - $_SESSION['authorize_results']['page_message'] = $page_message; - $_SESSION['authorize_results']['messages'] = $results['log']; - $_SESSION['authorize_results']['tasks'] = $results['tasks']; - $_SESSION['authorize_page_title'] = t('Update manager'); + $session->set('authorize_results', [ + 'success' => $success, + 'page_message' => $page_message, + 'messages' => $results['log'], + 'tasks' => $results['tasks'] + ]); + $session->set('authorize_page_title', t('Update manager')); } /** diff --git a/core/modules/update/update.manager.inc b/core/modules/update/update.manager.inc index 2229f0a205..5a6d9816be 100644 --- a/core/modules/update/update.manager.inc +++ b/core/modules/update/update.manager.inc @@ -57,7 +57,7 @@ function update_manager_download_batch_finished($success, $results) { } elseif ($success) { drupal_set_message(t('Updates downloaded successfully.')); - $_SESSION['update_manager_update_projects'] = $results['projects']; + \Drupal::request()->getSession()->set('update_manager_update_projects', $results['projects']); return new RedirectResponse(\Drupal::url('update.confirmation_page', [], ['absolute' => TRUE])); } else { diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php index d6959681f4..8962c1b51f 100644 --- a/core/modules/user/src/AccountForm.php +++ b/core/modules/user/src/AccountForm.php @@ -118,9 +118,11 @@ public function form(array $form, FormStateInterface $form_state) { // To skip the current password field, the user must have logged in via a // one-time link and have the token in the URL. Store this in $form_state // so it persists even on subsequent Ajax requests. - if (!$form_state->get('user_pass_reset') && ($token = $this->getRequest()->get('pass-reset-token'))) { + $request = $this->getRequest(); + if (!$form_state->get('user_pass_reset') && ($token = $request->get('pass-reset-token'))) { $session_key = 'pass_reset_' . $account->id(); - $user_pass_reset = isset($_SESSION[$session_key]) && Crypt::hashEquals($_SESSION[$session_key], $token); + $session_value = $request->getSession()->get($session_key); + $user_pass_reset = isset($session_value) && Crypt::hashEquals($session_value, $token); $form_state->set('user_pass_reset', $user_pass_reset); } @@ -383,9 +385,7 @@ public function submitForm(array &$form, FormStateInterface $form_state) { $user = $this->getEntity($form_state); // If there's a session set to the users id, remove the password reset tag // since a new password was saved. - if (isset($_SESSION['pass_reset_' . $user->id()])) { - unset($_SESSION['pass_reset_' . $user->id()]); - } + $this->getRequest()->getSession()->remove('pass_reset_' . $user->id()); } } diff --git a/core/modules/user/src/Controller/UserController.php b/core/modules/user/src/Controller/UserController.php index be15fac4ab..77dce9aab6 100644 --- a/core/modules/user/src/Controller/UserController.php +++ b/core/modules/user/src/Controller/UserController.php @@ -192,6 +192,8 @@ public function getResetPassForm(Request $request, $uid) { * The current timestamp. * @param string $hash * Login link hash. + * @param \Symfony\Component\HttpFoundation\Request $request + * The request. * * @return \Symfony\Component\HttpFoundation\RedirectResponse * Returns a redirect to the user edit form if the information is correct. @@ -201,7 +203,7 @@ public function getResetPassForm(Request $request, $uid) { * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException * If $uid is for a blocked user or invalid user ID. */ - public function resetPassLogin($uid, $timestamp, $hash) { + public function resetPassLogin($uid, $timestamp, $hash, Request $request) { // The current user is not logged in, so check the parameters. $current = REQUEST_TIME; /** @var \Drupal\user\UserInterface $user */ @@ -228,7 +230,7 @@ public function resetPassLogin($uid, $timestamp, $hash) { // Let the user's password be changed without the current password // check. $token = Crypt::randomBytesBase64(55); - $_SESSION['pass_reset_' . $user->id()] = $token; + $request->getSession()->set('pass_reset_' . $user->id(), $token); return $this->redirect( 'entity.user.edit_form', ['user' => $user->id()], diff --git a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php index 13d6b1122c..7711b6aa50 100644 --- a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php +++ b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php @@ -319,9 +319,12 @@ public function resetForm(&$form, FormStateInterface $form_state) { // remember settings. $display_id = ($this->view->display_handler->isDefaulted('filters')) ? 'default' : $this->view->current_display; - if (isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - unset($_SESSION['views'][$this->view->storage->id()][$display_id]); + $session = \Drupal::request()->getSession(); + $views_session = $session->get('views', []); + if (isset($views_session[$this->view->storage->id()][$display_id])) { + unset($views_session[$this->view->storage->id()][$display_id]); } + $session->set('views', $views_session); // Set the form to allow redirect. if (empty($this->view->live_preview) && !\Drupal::request()->isXmlHttpRequest()) { diff --git a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php index fd273ddfa8..ec652ef849 100644 --- a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php +++ b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php @@ -1351,22 +1351,20 @@ public function storeGroupInput($input, $status) { // False means that we got a setting that means to recurse ourselves, // so we should erase whatever happened to be there. - if ($status === FALSE && isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; - - if (isset($session[$this->options['group_info']['identifier']])) { - unset($session[$this->options['group_info']['identifier']]); - } + $session = \Drupal::request()->getSession(); + $views_session = $session->get('views', []); + if ($status === FALSE && isset($views_session[$this->view->storage->id()][$display_id])) { + unset($views_session[$this->view->storage->id()][$display_id][$this->options['group_info']['identifier']]); } if ($status !== FALSE) { - if (!isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $_SESSION['views'][$this->view->storage->id()][$display_id] = []; + if (!isset($views_session[$this->view->storage->id()][$display_id])) { + $views_session[$this->view->storage->id()][$display_id] = []; } - - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; - - $session[$this->options['group_info']['identifier']] = $input[$this->options['group_info']['identifier']]; + $views_session[$this->view->storage->id()][$display_id][$this->options['group_info']['identifier']] = $input[$this->options['group_info']['identifier']]; + } + if (!empty($views_session)) { + $session->set('views', $views_session); } } @@ -1454,29 +1452,34 @@ public function storeExposedInput($input, $status) { // False means that we got a setting that means to recurse ourselves, // so we should erase whatever happened to be there. - if (!$status && isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; - if ($operator && isset($session[$this->options['expose']['operator_id']])) { - unset($session[$this->options['expose']['operator_id']]); + $session = \Drupal::request()->getSession(); + $views_session = $session->get('views', []); + if (!$status && isset($views_session[$this->view->storage->id()][$display_id])) { + $session_ref = &$views_session[$this->view->storage->id()][$display_id]; + if ($operator && isset($session_ref[$this->options['expose']['operator_id']])) { + unset($session_ref[$this->options['expose']['operator_id']]); } - if (isset($session[$this->options['expose']['identifier']])) { - unset($session[$this->options['expose']['identifier']]); + if (isset($session_ref[$this->options['expose']['identifier']])) { + unset($session_ref[$this->options['expose']['identifier']]); } } if ($status) { - if (!isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $_SESSION['views'][$this->view->storage->id()][$display_id] = []; + if (!isset($views_session[$this->view->storage->id()][$display_id])) { + $views_session[$this->view->storage->id()][$display_id] = []; } - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; + $session_ref = &$views_session[$this->view->storage->id()][$display_id]; if ($operator && isset($input[$this->options['expose']['operator_id']])) { - $session[$this->options['expose']['operator_id']] = $input[$this->options['expose']['operator_id']]; + $session_ref[$this->options['expose']['operator_id']] = $input[$this->options['expose']['operator_id']]; } - $session[$this->options['expose']['identifier']] = $input[$this->options['expose']['identifier']]; + $session_ref[$this->options['expose']['identifier']] = $input[$this->options['expose']['identifier']]; + } + if (!empty($views_session)) { + $session->set('views', $views_session); } } diff --git a/core/modules/views/src/ViewExecutable.php b/core/modules/views/src/ViewExecutable.php index 16b89f370e..ad88db2fb9 100644 --- a/core/modules/views/src/ViewExecutable.php +++ b/core/modules/views/src/ViewExecutable.php @@ -705,8 +705,11 @@ public function getExposedInput() { // remember settings. $display_id = ($this->display_handler->isDefaulted('filters')) ? 'default' : $this->current_display; - if (empty($this->exposed_input) && !empty($_SESSION['views'][$this->storage->id()][$display_id])) { - $this->exposed_input = $_SESSION['views'][$this->storage->id()][$display_id]; + if (empty($this->exposed_input) && $this->getRequest()->hasSession()) { + $views_session = $this->getRequest()->getSession()->get('views', []); + if (!empty($views_session[$this->storage->id()][$display_id])) { + $this->exposed_input = $views_session[$this->storage->id()][$display_id]; + } } } diff --git a/core/tests/Drupal/KernelTests/Core/EventSubscriber/IgnoreReplicaSubscriberTest.php b/core/tests/Drupal/KernelTests/Core/EventSubscriber/IgnoreReplicaSubscriberTest.php index 7ce994a944..8a2905f8d0 100644 --- a/core/tests/Drupal/KernelTests/Core/EventSubscriber/IgnoreReplicaSubscriberTest.php +++ b/core/tests/Drupal/KernelTests/Core/EventSubscriber/IgnoreReplicaSubscriberTest.php @@ -4,9 +4,7 @@ use Drupal\Core\Database\Database; use Drupal\Core\EventSubscriber\ReplicaDatabaseIgnoreSubscriber; -use Drupal\Core\DrupalKernel; use Drupal\KernelTests\KernelTestBase; -use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpKernel\HttpKernelInterface; use Symfony\Component\HttpKernel\Event\GetResponseEvent; @@ -27,10 +25,10 @@ public function testSystemInitIgnoresSecondaries() { $connection_info = Database::getConnectionInfo('default'); Database::addConnectionInfo('default', 'replica', $connection_info['default']); + $request = \Drupal::request(); + $request->setSession($this->container->get('session')); db_ignore_replica(); - $class_loader = require \Drupal::root() . '/autoload.php'; - $kernel = new DrupalKernel('testing', $class_loader, FALSE); - $event = new GetResponseEvent($kernel, Request::create('http://example.com'), HttpKernelInterface::MASTER_REQUEST); + $event = new GetResponseEvent($this->container->get('kernel'), $request, HttpKernelInterface::MASTER_REQUEST); $subscriber = new ReplicaDatabaseIgnoreSubscriber(); $subscriber->checkReplicaServer($event);