public function check(Users $user, string $sessionId, string $userIp, int $pageId): Users
    {
        $currentTime = time();

        $pageId = (int) $pageId;

        //
        // session_id exists so go ahead and attempt to grab all
        // data in preparation
        //
        $sql = "SELECT user.*, session.*
                FROM Baka\Auth\Models\Sessions session, Baka\Auth\Models\Users user
                WHERE session.id = :session_id:
                    AND user.id = session.users_id";

        $result = $this->getModelsManager()->createQuery($sql);
        $result = $result->execute([
                'session_id' => $sessionId,
            ]);

        //session data
        $userData = $result->getFirst();

        if (empty($userData)) {
            throw new Exception('Invalid Session');
        }

        //wtf? how did you get this token to mimic another user?
        if ($userData->user->getId() != $user->getId()) {
            throw new Exception('Invalid Token');
        }

        //
        // Did the session exist in the DB?
        //
        if ($userData->user) {
            //
            // Do not check IP assuming equivalence, if IPv4 we'll check only first 24
            // bits ... I've been told (by vHiker) this should alleviate problems with
            // load balanced et al proxies while retaining some reliance on IP security.
            /**
             * @todo reviar esto del chekeo de las ips
             */
            $ip_check_s = substr($userData->session->ip, 0, 6);
            $ip_check_u = substr($userIp, 0, 6);

            if ($ip_check_s == $ip_check_u) {
                //
                // Only update session DB a minute or so after last update
                //
                if ($currentTime - $userData->session->time > 60) {
                    //update the user session
                    $session = self::findFirstById($sessionId);
                    $session->session_time = $currentTime;
                    $session->session_page = $pageId;

                    if (!$session->update()) {
                        throw new Exception(current($session->getMessages()));
                    }

                    //update user
                    $user->users_id = $userData->user->getId();
                    $user->session_time = $currentTime;
                    $user->session_page = $pageId;
                    $user->update();

                    $this->clean($sessionId);
                }

                $user->session_id = $sessionId;

                return $user;
            }
        }

        throw new Exception(_('No Session Token Found'));
    }
public function check(Users $user, string $sessionId, string $userIp, int $pageId): Users
    {
        $currentTime = time();

        $pageId = (int) $pageId;

        //
        // session_id exists so go ahead and attempt to grab all
        // data in preparation
        //
        $sql = "SELECT user.*, session.*
                FROM Baka\Auth\Models\Sessions session, Baka\Auth\Models\Users user
                WHERE session.id = :session_id:
                    AND user.id = session.users_id";

        $result = $this->getModelsManager()->createQuery($sql);
        $result = $result->execute([
                'session_id' => $sessionId,
            ]);

        //session data
        $userData = $result->getFirst();

        if (empty($userData)) {
            throw new Exception('Invalid Session');
        }

        //wtf? how did you get this token to mimic another user?
        if ($userData->user->getId() != $user->getId()) {
            throw new Exception('Invalid Token');
        }

        //
        // Did the session exist in the DB?
        //
        if ($userData->user) {
            //
            // Do not check IP assuming equivalence, if IPv4 we'll check only first 24
            // bits ... I've been told (by vHiker) this should alleviate problems with
            // load balanced et al proxies while retaining some reliance on IP security.
            /**
             * @todo reviar esto del chekeo de las ips
             */
            $ip_check_s = substr($userData->session->ip, 0, 6);
            $ip_check_u = substr($userIp, 0, 6);

            if ($ip_check_s == $ip_check_u) {
                //
                // Only update session DB a minute or so after last update
                //
                if ($currentTime - $userData->session->time > 60) {
                    //update the user session
                    $session = self::findFirstById($sessionId);
                    $session->session_time = $currentTime;
                    $session->session_page = $pageId;

                    if (!$session->update()) {
                        throw new Exception(current($session->getMessages()));
                    }

                    //update user
                    $user->users_id = $userData->user->getId();
                    $user->session_time = $currentTime;
                    $user->session_page = $pageId;
                    $user->update();

                    $this->clean($sessionId);
                }

                $user->session_id = $sessionId;

                return $user;
            }
        }

        throw new Exception(_('No Session Token Found'));
    }
public function check ( Users $ user , string $ sessionId , string $ userIp , int $ pageId ) : Users { $ currentTime = time ( ) ; $ pageId = ( int ) $ pageId ; // // session_id exists so go ahead and attempt to grab all // data in preparation // $ sql = "SELECT user.*, session.*
                FROM Baka\Auth\Models\Sessions session, Baka\Auth\Models\Users user
                WHERE session.id = :session_id:
                    AND user.id = session.users_id" ; $ result = $ this -> getModelsManager ( ) -> createQuery ( $ sql ) ; $ result = $ result -> execute ( [ 'session_id' => $ sessionId , ] ) ; //session data $ userData = $ result -> getFirst ( ) ; if ( empty ( $ userData ) ) { throw new Exception ( 'Invalid Session' ) ; } //wtf? how did you get this token to mimic another user? if ( $ userData -> user -> getId ( ) != $ user -> getId ( ) ) { throw new Exception ( 'Invalid Token' ) ; } // // Did the session exist in the DB? // if ( $ userData -> user ) { // // Do not check IP assuming equivalence, if IPv4 we'll check only first 24 // bits ... I've been told (by vHiker) this should alleviate problems with // load balanced et al proxies while retaining some reliance on IP security. /**
             * @todo reviar esto del chekeo de las ips
             */ $ ip_check_s = substr ( $ userData -> session -> ip , 0 , 6 ) ; $ ip_check_u = substr ( $ userIp , 0 , 6 ) ; if ( $ ip_check_s == $ ip_check_u ) { // // Only update session DB a minute or so after last update // if ( $ currentTime - $ userData -> session -> time > 60 ) { //update the user session $ session = self :: findFirstById ( $ sessionId ) ; $ session -> session_time = $ currentTime ; $ session -> session_page = $ pageId ; if ( ! $ session -> update ( ) ) { throw new Exception ( current ( $ session -> getMessages ( ) ) ) ; } //update user $ user -> users_id = $ userData -> user -> getId ( ) ; $ user -> session_time = $ currentTime ; $ user -> session_page = $ pageId ; $ user -> update ( ) ; $ this -> clean ( $ sessionId ) ; } $ user -> session_id = $ sessionId ; return $ user ; } } throw new Exception ( _ ( 'No Session Token Found' ) ) ; }
Checks for a given user session, tidies session table and updates user
sessions at each page refresh

@param Users $user
@param string $sessionId
@param string $userIp
@param integer $pageId
@return Users
Checks for a given user session tidies session table and updates user sessions at each page refresh