' . $this->t('Updates were attempted. If you see no failures below, you may proceed happily back to your site. Otherwise, you may need to update your database manually.', [':url' => Url::fromRoute('
' . $this->t('The update process was aborted prematurely while running update #@version in @module.module.', [ '@version' => $version, @@ -434,9 +439,9 @@ protected function results(Request $request) { ]; // Output a list of info messages. - if (!empty($_SESSION['update_results'])) { + if (!empty($update_results)) { $all_messages = []; - foreach ($_SESSION['update_results'] as $module => $updates) { + foreach ($update_results as $module => $updates) { if ($module != '#abort') { $module_has_message = FALSE; $info_messages = []; @@ -498,9 +503,6 @@ protected function results(Request $request) { ]; } } - unset($_SESSION['update_results']); - unset($_SESSION['update_success']); - unset($_SESSION['update_ignore_warnings']); return $build; } @@ -569,7 +571,7 @@ protected function triggerBatch(Request $request) { $maintenance_mode = $this->state->get('system.maintenance_mode', FALSE); // Store the current maintenance mode status in the session so that it can // be restored at the end of the batch. - $_SESSION['maintenance_mode'] = $maintenance_mode; + $request->getSession()->set('maintenance_mode', $maintenance_mode); // During the update, always put the site into maintenance mode so that // in-progress schema changes do not affect visiting users. if (empty($maintenance_mode)) { @@ -649,16 +651,16 @@ public static function batchFinished($success, $results, $operations) { // No updates to run, so caches won't get flushed later. Clear them now. drupal_flush_all_caches(); - $_SESSION['update_results'] = $results; - $_SESSION['update_success'] = $success; - $_SESSION['updates_remaining'] = $operations; + $request = \Drupal::request(); + $request->getSession()->set('update_results', $results); + $request->getSession()->set('update_success', $success); + $request->getSession()->set('updates_remaining', $operations); // Now that the update is done, we can put the site back online if it was // previously not in maintenance mode. - if (empty($_SESSION['maintenance_mode'])) { + if (!$request->getSession()->remove('maintenance_mode')) { \Drupal::state()->set('system.maintenance_mode', FALSE); } - unset($_SESSION['maintenance_mode']); } /** diff --git a/core/modules/system/system.install b/core/modules/system/system.install index 960bb7d..5421cb2 100644 --- a/core/modules/system/system.install +++ b/core/modules/system/system.install @@ -1162,7 +1162,7 @@ function system_schema() { 'default' => 0, ], 'session' => [ - 'description' => 'The serialized contents of $_SESSION, an array of name/value pairs that persists across page requests by this session ID. Drupal loads $_SESSION from here at the start of each request and saves it at the end.', + 'description' => 'The serialized contents of the user\'s session, an array of name/value pairs that persists across page requests by this session ID. Drupal loads the user\'s session from here at the start of each request and saves it at the end.', 'type' => 'blob', 'not null' => FALSE, 'size' => 'big', diff --git a/core/modules/system/system.module b/core/modules/system/system.module index 57f297b..320d35d 100644 --- a/core/modules/system/system.module +++ b/core/modules/system/system.module @@ -432,13 +432,14 @@ function template_preprocess_entity_add_list(&$variables) { /** * Setup a given callback to run via authorize.php with elevated privileges. * - * To use authorize.php, certain variables must be stashed into $_SESSION. This - * function sets up all the necessary $_SESSION variables. The calling function - * should then redirect to authorize.php, using the full path returned by - * system_authorized_get_url(). That initiates the workflow that will eventually - * lead to the callback being invoked. The callback will be invoked at a low - * bootstrap level, without all modules being invoked, so it needs to be careful - * not to assume any code exists. Example (system_authorized_run()): + * To use authorize.php, certain variables must be stashed in the user's + * session. This function sets up all the necessary session variables. The + * calling function should then redirect to authorize.php, using the full path + * returned by system_authorized_get_url(). That initiates the workflow that + * will eventually lead to the callback being invoked. The callback will be + * invoked at a low bootstrap level, without all modules being invoked, so it + * needs to be careful not to assume any code exists. + * Example (system_authorized_run()): * @code * system_authorized_init($callback, $file, $arguments, $page_title); * return new RedirectResponse(system_authorized_get_url()->toString()); @@ -465,20 +466,21 @@ function template_preprocess_entity_add_list(&$variables) { * Nothing, this function just initializes variables in the user's session. */ function system_authorized_init($callback, $file, $arguments = [], $page_title = NULL) { + $request = \Drupal::request(); // First, figure out what file transfer backends the site supports, and put // all of those in the SESSION so that authorize.php has access to all of // them via the class autoloader, even without a full bootstrap. - $_SESSION['authorize_filetransfer_info'] = drupal_get_filetransfer_info(); + $request->getSession()->set('authorize_filetransfer_info', drupal_get_filetransfer_info()); // Now, define the callback to invoke. - $_SESSION['authorize_operation'] = [ + $request->getSession()->set('authorize_operation', [ 'callback' => $callback, 'file' => $file, 'arguments' => $arguments, - ]; + ]); if (isset($page_title)) { - $_SESSION['authorize_page_title'] = $page_title; + $request->getSession()->set('authorize_page_title', $page_title); } } diff --git a/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php b/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php index 5cc09b7..1dddcbe 100644 --- a/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php +++ b/core/modules/system/tests/modules/form_test/src/Form/FormTestStorageForm.php @@ -37,7 +37,7 @@ public function buildForm(array $form, FormStateInterface $form_state) { if (empty($storage)) { $user_input = $form_state->getUserInput(); if (empty($user_input)) { - $_SESSION['constructions'] = 0; + $this->getRequest()->getSession()->set('constructions', 0); } // Put the initial thing into the storage $storage = [ @@ -49,8 +49,12 @@ public function buildForm(array $form, FormStateInterface $form_state) { $form_state->setStorage($storage); } // Count how often the form is constructed. - $_SESSION['constructions']++; - $this->messenger()->addStatus("Form constructions: " . $_SESSION['constructions']); + $this->getRequest()->getSession()->set( + 'constructions', + $this->getRequest()->getSession()->get('constructions', 0) + 1 + ); + + $this->messenger()->addStatus("Form constructions: " . $this->getRequest()->getSession()->get('constructions')); $form['title'] = [ '#type' => 'textfield', @@ -137,7 +141,7 @@ public function continueSubmitForm(array &$form, FormStateInterface $form_state) */ public function submitForm(array &$form, FormStateInterface $form_state) { $this->messenger()->addStatus("Title: " . Html::escape($form_state->getValue('title'))); - $this->messenger()->addStatus("Form constructions: " . $_SESSION['constructions']); + $this->messenger()->addStatus("Form constructions: " . $this->getRequest()->getSession()->get('constructions')); if ($form_state->has(['thing', 'changed'])) { $this->messenger()->addStatus("The thing has been changed."); } diff --git a/core/modules/system/tests/modules/menu_test/menu_test.services.yml b/core/modules/system/tests/modules/menu_test/menu_test.services.yml index 81f1f50..e1a0aa0 100644 --- a/core/modules/system/tests/modules/menu_test/menu_test.services.yml +++ b/core/modules/system/tests/modules/menu_test/menu_test.services.yml @@ -6,5 +6,6 @@ services: access_check.menu_test_session: class: Drupal\menu_test\Access\AccessCheck + arguments: ['@request_stack'] tags: - { name: access_check, applies_to: _menu_test_session_access } diff --git a/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php b/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php index e87fcfa..cd60aac 100644 --- a/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php +++ b/core/modules/system/tests/modules/menu_test/src/Access/AccessCheck.php @@ -3,12 +3,41 @@ namespace Drupal\menu_test\Access; use Drupal\Core\Access\AccessResult; +use Drupal\Core\DependencyInjection\ContainerInjectionInterface; use Drupal\Core\Routing\Access\AccessInterface; +use Symfony\Component\DependencyInjection\ContainerInterface; +use Symfony\Component\HttpFoundation\RequestStack; /** * Checks access based on the 'menu_test' key in session. */ -class AccessCheck implements AccessInterface { +class AccessCheck implements AccessInterface, ContainerInjectionInterface { + + /** + * The request stack. + * + * @var \Symfony\Component\HttpFoundation\RequestStack + */ + protected $requestStack; + + /** + * Constructs a new AccessCheck class. + * + * @param \Symfony\Component\HttpFoundation\RequestStack $request_stack + * The request stack. + */ + public function __construct(RequestStack $request_stack) { + $this->requestStack = $request_stack; + } + + /** + * {@inheritdoc} + */ + public static function create(ContainerInterface $container) { + return new static( + $container->get('request_stack') + ); + } /** * Check to see if user accessed this page. @@ -17,12 +46,9 @@ class AccessCheck implements AccessInterface { * The access result. */ public function access() { - if (!isset($_SESSION['menu_test'])) { - $result = AccessResult::allowed(); - } - else { - $result = AccessResult::allowedIf($_SESSION['menu_test'] < 2); - } + $result = AccessResult::allowedIf( + $this->requestStack->getCurrentRequest()->getSession()->get('menu_test', 0) < 2 + ); return $result->setCacheMaxAge(0); } diff --git a/core/modules/system/tests/modules/menu_test/src/TestControllers.php b/core/modules/system/tests/modules/menu_test/src/TestControllers.php index dafaab0..d1339e9 100644 --- a/core/modules/system/tests/modules/menu_test/src/TestControllers.php +++ b/core/modules/system/tests/modules/menu_test/src/TestControllers.php @@ -3,6 +3,7 @@ namespace Drupal\menu_test; use Drupal\Component\Render\FormattableMarkup; +use Symfony\Component\HttpFoundation\Request; /** * Controllers for testing the menu integration routing system. @@ -32,13 +33,19 @@ public function test2() { /** * Prints out test data. + * + * @param \Symfony\Component\HttpFoundation\Request $request + * The request. + * + * @return array + * Render array. */ - public function testSession() { - if (!isset($_SESSION['menu_test'])) { - $_SESSION['menu_test'] = 0; - } - $_SESSION['menu_test']++; - return ['#markup' => new FormattableMarkup('Session menu_test is @count', ['@count' => $_SESSION['menu_test']])]; + public function testSession(Request $request) { + $request->getSession()->set( + 'menu_test', + $request->getSession()->get('menu_test', 0) + 1 + ); + return ['#markup' => new FormattableMarkup('Session menu_test is @count', ['@count' => $request->getSession()->get('menu_test')])]; } /** diff --git a/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module b/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module index 60d2452..2be874d 100644 --- a/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module +++ b/core/modules/system/tests/modules/session_exists_cache_context_test/session_exists_cache_context_test.module @@ -23,7 +23,8 @@ function session_exists_cache_context_test_page_top(array &$page_top) { ], ]; - if (\Drupal::request()->query->get('trigger_session')) { - $_SESSION['session_exists_cache_context_test'] = TRUE; + $request = \Drupal::request(); + if ($request->query->get('trigger_session')) { + $request->getSession()->set('session_exists_cache_context_test', TRUE); } } diff --git a/core/modules/system/tests/modules/session_test/session_test.module b/core/modules/system/tests/modules/session_test/session_test.module index 1555f9c..e1cb4aa 100644 --- a/core/modules/system/tests/modules/session_test/session_test.module +++ b/core/modules/system/tests/modules/session_test/session_test.module @@ -17,5 +17,5 @@ function session_test_user_login(UserInterface $account) { exit; } // Add some data in the session for retrieval testing purpose. - \Drupal::request()->getSession()->set("session_test_key", "foobar"); + \Drupal::request()->getSession()->set("session_test_value", "foobar"); } diff --git a/core/modules/system/tests/modules/session_test/session_test.routing.yml b/core/modules/system/tests/modules/session_test/session_test.routing.yml index 84978c9..0a4edbc 100644 --- a/core/modules/system/tests/modules/session_test/session_test.routing.yml +++ b/core/modules/system/tests/modules/session_test/session_test.routing.yml @@ -7,15 +7,6 @@ session_test.get: no_cache: TRUE requirements: _access: 'TRUE' -session_test.get_from_session_object: - path: '/session-test/get-from-session-object' - defaults: - _title: 'Session value' - _controller: '\Drupal\session_test\Controller\SessionTestController::getFromSessionObject' - options: - no_cache: TRUE - requirements: - _access: 'TRUE' session_test.id: path: '/session-test/id' defaults: diff --git a/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php b/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php index 1094522..8e95858 100644 --- a/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php +++ b/core/modules/system/tests/modules/session_test/src/Controller/SessionTestController.php @@ -15,26 +15,14 @@ class SessionTestController extends ControllerBase { /** * Prints the stored session value to the screen. * - * @return string - * A notification message. - */ - public function get() { - return empty($_SESSION['session_test_value']) - ? [] - : ['#markup' => $this->t('The current value of the stored session variable is: %val', ['%val' => $_SESSION['session_test_value']])]; - } - - /** - * Prints the stored session value to the screen. - * * @param \Symfony\Component\HttpFoundation\Request $request * The incoming request. * - * @return string + * @return array * A notification message. */ - public function getFromSessionObject(Request $request) { - $value = $request->getSession()->get("session_test_key"); + public function get(Request $request) { + $value = $request->getSession()->get("session_test_value"); return empty($value) ? [] : ['#markup' => $this->t('The current value of the stored session variable is: %val', ['%val' => $value])]; @@ -50,9 +38,9 @@ public function getFromSessionObject(Request $request) { * A notification message with session ID. */ public function getId(Request $request) { - // Set a value in $_SESSION, so that SessionManager::save() will start - // a session. - $_SESSION['test'] = 'test'; + // Set a value in the user's session, so that SessionManager::save() will + // start a session. + $request->getSession()->set('test', 'test'); $request->getSession()->save(); @@ -73,7 +61,7 @@ public function getIdFromCookie(Request $request) { } /** - * Stores a value in $_SESSION['session_test_value']. + * Stores a value in the user's session. * * @param string $test_value * A session value. @@ -81,8 +69,8 @@ public function getIdFromCookie(Request $request) { * @return string * A notification message. */ - public function set($test_value) { - $_SESSION['session_test_value'] = $test_value; + public function set($test_value, Request $request) { + $request->getSession()->set('session_test_value', $test_value); return ['#markup' => $this->t('The current value of the stored session variable has been set to %val', ['%val' => $test_value])]; } @@ -97,9 +85,9 @@ public function set($test_value) { * @return string * A notification message. */ - public function noSet($test_value) { + public function noSet($test_value, Request $request) { \Drupal::service('session_handler.write_safe')->setSessionWritable(FALSE); - $this->set($test_value); + $this->set($test_value, $request); return ['#markup' => $this->t('session saving was disabled, and then %val was set', ['%val' => $test_value])]; } @@ -149,14 +137,9 @@ public function isLoggedIn() { * The response. */ public function traceHandler(Request $request) { - // Start a session if necessary, set a value and then save and close it. - $request->getSession()->start(); - if (empty($_SESSION['trace-handler'])) { - $_SESSION['trace-handler'] = 1; - } - else { - $_SESSION['trace-handler']++; - } + $session = $request->getSession(); + $session->set('trace-handler', $session->get('trace-handler', 0) + 1); + // Close the session to create the trace. $request->getSession()->save(); // Collect traces and return them in JSON format. diff --git a/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php b/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php index 47c8c5b..625dfe5 100644 --- a/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php +++ b/core/modules/system/tests/modules/session_test/src/EventSubscriber/SessionTestSubscriber.php @@ -13,7 +13,7 @@ class SessionTestSubscriber implements EventSubscriberInterface { /** - * Stores whether $_SESSION is empty at the beginning of the request. + * Stores whether the user's session is empty at the beginning of the request. * * @var bool */ diff --git a/core/modules/system/tests/src/Functional/Session/SessionTest.php b/core/modules/system/tests/src/Functional/Session/SessionTest.php index 0cee31f..ac26801 100644 --- a/core/modules/system/tests/src/Functional/Session/SessionTest.php +++ b/core/modules/system/tests/src/Functional/Session/SessionTest.php @@ -151,7 +151,7 @@ public function testSessionPersistenceOnLogin() { $user = $this->drupalCreateUser(); $this->drupalLogin($user); // Test property added to session object form hook_user_login(). - $this->drupalGet('session-test/get-from-session-object'); + $this->drupalGet('session-test/get'); $this->assertText('foobar', 'Session data is saved in Session() object.', 'Session'); } @@ -313,7 +313,7 @@ public function assertSessionCookie($sent) { } /** - * Assert whether $_SESSION is empty at the beginning of the request. + * Assert whether the user's session is empty at the beginning of the request. */ public function assertSessionEmpty($empty) { if ($empty) { diff --git a/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php b/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php index b3f9b31..6a6d8d3 100644 --- a/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php +++ b/core/modules/system/tests/src/Functional/System/SystemAuthorizeTest.php @@ -31,7 +31,7 @@ protected function setUp() { * Initializing authorize.php needs to happen in the child Drupal * installation, not the parent. So, we visit a menu callback provided by * system_test.module which calls system_authorized_init() to initialize the - * $_SESSION inside the test site, not the framework site. This callback + * user's session inside the test site, not the framework site. This callback * redirects to authorize.php when it's done initializing. * * @see system_authorized_init() diff --git a/core/modules/update/src/Form/UpdateReady.php b/core/modules/update/src/Form/UpdateReady.php index 15a9ddd..95947c5 100644 --- a/core/modules/update/src/Form/UpdateReady.php +++ b/core/modules/update/src/Form/UpdateReady.php @@ -118,21 +118,21 @@ public function buildForm(array $form, FormStateInterface $form_state) { * {@inheritdoc} */ public function submitForm(array &$form, FormStateInterface $form_state) { + $session = $this->getRequest()->getSession(); // Store maintenance_mode setting so we can restore it when done. - $_SESSION['maintenance_mode'] = $this->state->get('system.maintenance_mode'); + $session->set('maintenance_mode', $this->state->get('system.maintenance_mode')); if ($form_state->getValue('maintenance_mode') == TRUE) { $this->state->set('system.maintenance_mode', TRUE); } - if (!empty($_SESSION['update_manager_update_projects'])) { + if ($session->has('update_manager_update_projects')) { // Make sure the Updater registry is loaded. drupal_get_updaters(); $updates = []; $directory = _update_manager_extract_directory(); - $projects = $_SESSION['update_manager_update_projects']; - unset($_SESSION['update_manager_update_projects']); + $projects = $session->remove('update_manager_update_projects'); $project_real_location = NULL; foreach ($projects as $project => $url) { diff --git a/core/modules/update/update.authorize.inc b/core/modules/update/update.authorize.inc index fea365a..4f2a2f5 100644 --- a/core/modules/update/update.authorize.inc +++ b/core/modules/update/update.authorize.inc @@ -60,7 +60,7 @@ function update_authorize_run_update($filetransfer, $projects) { // Since authorize.php has its own method for setting the page title, set it // manually here rather than passing it in to batch_set() as would normally // be done. - $_SESSION['authorize_page_title'] = t('Installing updates'); + \Drupal::request()->getSession()->set('authorize_page_title', t('Installing updates')); // Invoke the batch via authorize.php. return system_authorized_batch_process(); @@ -114,7 +114,7 @@ function update_authorize_run_install($filetransfer, $project, $updater_name, $l // Since authorize.php has its own method for setting the page title, set it // manually here rather than passing it in to batch_set() as would normally // be done. - $_SESSION['authorize_page_title'] = t('Installing %project', ['%project' => $project]); + \Drupal::request()->getSession()->set('authorize_page_title', t('Installing %project', ['%project' => $project])); // Invoke the batch via authorize.php. return system_authorized_batch_process(); @@ -213,13 +213,16 @@ function update_authorize_update_batch_finished($success, $results) { } } $offline = \Drupal::state()->get('system.maintenance_mode'); + $session = \Drupal::request()->getSession(); + // Unset the variable since it is no longer needed. + $maintenance_mode = $session->remove('maintenance_mode'); if ($success) { // Now that the update completed, we need to clear the available update data // and recompute our status, so prevent show bogus results. _update_authorize_clear_update_status(); // Take the site out of maintenance mode if it was previously that way. - if ($offline && isset($_SESSION['maintenance_mode']) && $_SESSION['maintenance_mode'] == FALSE) { + if ($offline && $maintenance_mode === FALSE) { \Drupal::state()->set('system.maintenance_mode', FALSE); $page_message = [ 'message' => t('Update was completed successfully. Your site has been taken out of maintenance mode.'), @@ -264,15 +267,14 @@ function update_authorize_update_batch_finished($success, $results) { '#access' => $url->access(\Drupal::currentUser()), ]; - // Unset the variable since it is no longer needed. - unset($_SESSION['maintenance_mode']); - // Set all these values into the SESSION so authorize.php can display them. - $_SESSION['authorize_results']['success'] = $success; - $_SESSION['authorize_results']['page_message'] = $page_message; - $_SESSION['authorize_results']['messages'] = $results['log']; - $_SESSION['authorize_results']['tasks'] = $results['tasks']; - $_SESSION['authorize_page_title'] = t('Update manager'); + $session->set('authorize_results', [ + 'success' => $success, + 'page_message' => $page_message, + 'messages' => $results['log'], + 'tasks' => $results['tasks'] + ]); + $session->set('authorize_page_title', t('Update manager')); } /** @@ -296,9 +298,12 @@ function update_authorize_install_batch_finished($success, $results) { } } $offline = \Drupal::state()->get('system.maintenance_mode'); + $session = \Drupal::request()->getSession(); + // Unset the variable since it is no longer needed. + $maintenance_mode = $session->remove('maintenance_mode'); if ($success) { // Take the site out of maintenance mode if it was previously that way. - if ($offline && isset($_SESSION['maintenance_mode']) && $_SESSION['maintenance_mode'] == FALSE) { + if ($offline && $maintenance_mode === FALSE) { \Drupal::state()->set('system.maintenance_mode', FALSE); $page_message = [ 'message' => t('Installation was completed successfully. Your site has been taken out of maintenance mode.'), @@ -325,15 +330,14 @@ function update_authorize_install_batch_finished($success, $results) { ]; } - // Unset the variable since it is no longer needed. - unset($_SESSION['maintenance_mode']); - // Set all these values into the SESSION so authorize.php can display them. - $_SESSION['authorize_results']['success'] = $success; - $_SESSION['authorize_results']['page_message'] = $page_message; - $_SESSION['authorize_results']['messages'] = $results['log']; - $_SESSION['authorize_results']['tasks'] = $results['tasks']; - $_SESSION['authorize_page_title'] = t('Update manager'); + $session->set('authorize_results', [ + 'success' => $success, + 'page_message' => $page_message, + 'messages' => $results['log'], + 'tasks' => $results['tasks'] + ]); + $session->set('authorize_page_title', t('Update manager')); } /** diff --git a/core/modules/update/update.manager.inc b/core/modules/update/update.manager.inc index 2b2aef2..e0b6c22 100644 --- a/core/modules/update/update.manager.inc +++ b/core/modules/update/update.manager.inc @@ -58,7 +58,7 @@ function update_manager_download_batch_finished($success, $results) { } elseif ($success) { \Drupal::messenger()->addStatus(t('Updates downloaded successfully.')); - $_SESSION['update_manager_update_projects'] = $results['projects']; + \Drupal::request()->getSession()->set('update_manager_update_projects', $results['projects']); return new RedirectResponse(\Drupal::url('update.confirmation_page', [], ['absolute' => TRUE])); } else { diff --git a/core/modules/user/src/AccountForm.php b/core/modules/user/src/AccountForm.php index 20eeabd..ab6d6d1 100644 --- a/core/modules/user/src/AccountForm.php +++ b/core/modules/user/src/AccountForm.php @@ -129,9 +129,11 @@ public function form(array $form, FormStateInterface $form_state) { // To skip the current password field, the user must have logged in via a // one-time link and have the token in the URL. Store this in $form_state // so it persists even on subsequent Ajax requests. - if (!$form_state->get('user_pass_reset') && ($token = $this->getRequest()->get('pass-reset-token'))) { + $request = $this->getRequest(); + if (!$form_state->get('user_pass_reset') && ($token = $request->get('pass-reset-token'))) { $session_key = 'pass_reset_' . $account->id(); - $user_pass_reset = isset($_SESSION[$session_key]) && Crypt::hashEquals($_SESSION[$session_key], $token); + $session_value = $request->getSession()->get($session_key); + $user_pass_reset = isset($session_value) && Crypt::hashEquals($session_value, $token); $form_state->set('user_pass_reset', $user_pass_reset); } @@ -394,9 +396,7 @@ public function submitForm(array &$form, FormStateInterface $form_state) { $user = $this->getEntity($form_state); // If there's a session set to the users id, remove the password reset tag // since a new password was saved. - if (isset($_SESSION['pass_reset_' . $user->id()])) { - unset($_SESSION['pass_reset_' . $user->id()]); - } + $this->getRequest()->getSession()->remove('pass_reset_' . $user->id()); } } diff --git a/core/modules/user/src/Controller/UserController.php b/core/modules/user/src/Controller/UserController.php index 0531668..3981912 100644 --- a/core/modules/user/src/Controller/UserController.php +++ b/core/modules/user/src/Controller/UserController.php @@ -197,6 +197,8 @@ public function getResetPassForm(Request $request, $uid) { * The current timestamp. * @param string $hash * Login link hash. + * @param \Symfony\Component\HttpFoundation\Request $request + * The request. * * @return \Symfony\Component\HttpFoundation\RedirectResponse * Returns a redirect to the user edit form if the information is correct. @@ -206,7 +208,7 @@ public function getResetPassForm(Request $request, $uid) { * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException * If $uid is for a blocked user or invalid user ID. */ - public function resetPassLogin($uid, $timestamp, $hash) { + public function resetPassLogin($uid, $timestamp, $hash, Request $request) { // The current user is not logged in, so check the parameters. $current = REQUEST_TIME; /** @var \Drupal\user\UserInterface $user */ @@ -233,7 +235,7 @@ public function resetPassLogin($uid, $timestamp, $hash) { // Let the user's password be changed without the current password // check. $token = Crypt::randomBytesBase64(55); - $_SESSION['pass_reset_' . $user->id()] = $token; + $request->getSession()->set('pass_reset_' . $user->id(), $token); return $this->redirect( 'entity.user.edit_form', ['user' => $user->id()], diff --git a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php index 13d6b11..7711b6a 100644 --- a/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php +++ b/core/modules/views/src/Plugin/views/exposed_form/ExposedFormPluginBase.php @@ -319,9 +319,12 @@ public function resetForm(&$form, FormStateInterface $form_state) { // remember settings. $display_id = ($this->view->display_handler->isDefaulted('filters')) ? 'default' : $this->view->current_display; - if (isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - unset($_SESSION['views'][$this->view->storage->id()][$display_id]); + $session = \Drupal::request()->getSession(); + $views_session = $session->get('views', []); + if (isset($views_session[$this->view->storage->id()][$display_id])) { + unset($views_session[$this->view->storage->id()][$display_id]); } + $session->set('views', $views_session); // Set the form to allow redirect. if (empty($this->view->live_preview) && !\Drupal::request()->isXmlHttpRequest()) { diff --git a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php index 8821ea8..d465166 100644 --- a/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php +++ b/core/modules/views/src/Plugin/views/filter/FilterPluginBase.php @@ -1339,22 +1339,20 @@ public function storeGroupInput($input, $status) { // False means that we got a setting that means to recurse ourselves, // so we should erase whatever happened to be there. - if ($status === FALSE && isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; - - if (isset($session[$this->options['group_info']['identifier']])) { - unset($session[$this->options['group_info']['identifier']]); - } + $session = \Drupal::request()->getSession(); + $views_session = $session->get('views', []); + if ($status === FALSE && isset($views_session[$this->view->storage->id()][$display_id])) { + unset($views_session[$this->view->storage->id()][$display_id][$this->options['group_info']['identifier']]); } if ($status !== FALSE) { - if (!isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $_SESSION['views'][$this->view->storage->id()][$display_id] = []; + if (!isset($views_session[$this->view->storage->id()][$display_id])) { + $views_session[$this->view->storage->id()][$display_id] = []; } - - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; - - $session[$this->options['group_info']['identifier']] = $input[$this->options['group_info']['identifier']]; + $views_session[$this->view->storage->id()][$display_id][$this->options['group_info']['identifier']] = $input[$this->options['group_info']['identifier']]; + } + if (!empty($views_session)) { + $session->set('views', $views_session); } } @@ -1442,29 +1440,34 @@ public function storeExposedInput($input, $status) { // False means that we got a setting that means to recurse ourselves, // so we should erase whatever happened to be there. - if (!$status && isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; - if ($operator && isset($session[$this->options['expose']['operator_id']])) { - unset($session[$this->options['expose']['operator_id']]); + $session = \Drupal::request()->getSession(); + $views_session = $session->get('views', []); + if (!$status && isset($views_session[$this->view->storage->id()][$display_id])) { + $session_ref = &$views_session[$this->view->storage->id()][$display_id]; + if ($operator && isset($session_ref[$this->options['expose']['operator_id']])) { + unset($session_ref[$this->options['expose']['operator_id']]); } - if (isset($session[$this->options['expose']['identifier']])) { - unset($session[$this->options['expose']['identifier']]); + if (isset($session_ref[$this->options['expose']['identifier']])) { + unset($session_ref[$this->options['expose']['identifier']]); } } if ($status) { - if (!isset($_SESSION['views'][$this->view->storage->id()][$display_id])) { - $_SESSION['views'][$this->view->storage->id()][$display_id] = []; + if (!isset($views_session[$this->view->storage->id()][$display_id])) { + $views_session[$this->view->storage->id()][$display_id] = []; } - $session = &$_SESSION['views'][$this->view->storage->id()][$display_id]; + $session_ref = &$views_session[$this->view->storage->id()][$display_id]; if ($operator && isset($input[$this->options['expose']['operator_id']])) { - $session[$this->options['expose']['operator_id']] = $input[$this->options['expose']['operator_id']]; + $session_ref[$this->options['expose']['operator_id']] = $input[$this->options['expose']['operator_id']]; } - $session[$this->options['expose']['identifier']] = $input[$this->options['expose']['identifier']]; + $session_ref[$this->options['expose']['identifier']] = $input[$this->options['expose']['identifier']]; + } + if (!empty($views_session)) { + $session->set('views', $views_session); } } diff --git a/core/modules/views/src/ViewExecutable.php b/core/modules/views/src/ViewExecutable.php index 9ee3704..f00fc52 100644 --- a/core/modules/views/src/ViewExecutable.php +++ b/core/modules/views/src/ViewExecutable.php @@ -705,8 +705,11 @@ public function getExposedInput() { // remember settings. $display_id = ($this->display_handler->isDefaulted('filters')) ? 'default' : $this->current_display; - if (empty($this->exposed_input) && !empty($_SESSION['views'][$this->storage->id()][$display_id])) { - $this->exposed_input = $_SESSION['views'][$this->storage->id()][$display_id]; + if (empty($this->exposed_input) && $this->getRequest()->hasSession()) { + $views_session = $this->getRequest()->getSession()->get('views', []); + if (!empty($views_session[$this->storage->id()][$display_id])) { + $this->exposed_input = $views_session[$this->storage->id()][$display_id]; + } } } diff --git a/core/tests/Drupal/KernelTests/Core/Database/ReplicaKillSwitchTest.php b/core/tests/Drupal/KernelTests/Core/Database/ReplicaKillSwitchTest.php index b2cdf72..a04ae7e 100644 --- a/core/tests/Drupal/KernelTests/Core/Database/ReplicaKillSwitchTest.php +++ b/core/tests/Drupal/KernelTests/Core/Database/ReplicaKillSwitchTest.php @@ -6,7 +6,6 @@ use Drupal\Core\DrupalKernel; use Drupal\Core\Site\Settings; use Drupal\KernelTests\KernelTestBase; -use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpKernel\HttpKernelInterface; use Symfony\Component\HttpKernel\Event\GetResponseEvent; @@ -27,12 +26,14 @@ public function testSystemInitIgnoresSecondaries() { $connection_info = Database::getConnectionInfo('default'); Database::addConnectionInfo('default', 'replica', $connection_info['default']); + $request = \Drupal::request(); + $request->setSession($this->container->get('session')); /** @var \Drupal\Core\Database\ReplicaKillSwitch $service */ $service = \Drupal::service('database.replica_kill_switch'); $service->trigger(); $class_loader = require $this->root . '/autoload.php'; $kernel = new DrupalKernel('testing', $class_loader, FALSE); - $event = new GetResponseEvent($kernel, Request::create('http://example.com'), HttpKernelInterface::MASTER_REQUEST); + $event = new GetResponseEvent($kernel, $request, HttpKernelInterface::MASTER_REQUEST); $service->checkReplicaServer($event); $db1 = Database::getConnection('default', 'default');