NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): implement SOC 2 & ISO 27001 audit logging, password policy, and session timeout

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 15:35:47 +02:00
parent 88ec1418cf
commit 0942a94edd
12 changed files with 283 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
users.php
+9
View File
@@ -39,6 +39,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Verstuur de gestylede uitnodigingsmail direct via SMTP
$mailResult = FocizMailer::sendInvitationEmail($email, $adminUser['name'], $role, $generatedLink);
fociz_log_audit((int)$adminUser['id'], 'USER_INVITED', 'invite', null, ['email' => $email, 'role' => $role], 'SUCCESS', $adminUser['email']);
if ($mailResult['success']) {
$message = "Uitnodigingslink succesvol aangemaakt én per e-mail verzonden naar {$email}!";
} else {
@@ -55,6 +56,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$baseUrl = rtrim(APP_URL, '/');
$link = "{$baseUrl}/auth/invite.php?token={$inv['token']}";
$mailResult = FocizMailer::sendInvitationEmail($inv['email'], $adminUser['name'], $inv['role'], $link);
fociz_log_audit((int)$adminUser['id'], 'INVITE_RESENT', 'invite', $inviteId, ['email' => $inv['email'], 'role' => $inv['role']], 'SUCCESS', $adminUser['email']);
if ($mailResult['success']) {
$message = "Uitnodiging succesvol opnieuw per e-mail verzonden naar {$inv['email']}!";
} else {
@@ -67,13 +69,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$inviteId = (int)($_POST['invite_id'] ?? 0);
$stmtDel = $db->prepare("DELETE FROM invites WHERE id = ?");
$stmtDel->execute([$inviteId]);
fociz_log_audit((int)$adminUser['id'], 'INVITE_REVOKED', 'invite', $inviteId, [], 'SUCCESS', $adminUser['email']);
header('Location: /users.php');
exit;
} elseif ($action === 'delete_user') {
$delUserId = (int)($_POST['user_id'] ?? 0);
if ($delUserId !== (int)$adminUser['id']) {
$stmtUserToDel = $db->prepare("SELECT email, name FROM users WHERE id = ?");
$stmtUserToDel->execute([$delUserId]);
$delUser = $stmtUserToDel->fetch();
$stmtDelUser = $db->prepare("DELETE FROM users WHERE id = ?");
$stmtDelUser->execute([$delUserId]);
fociz_log_audit((int)$adminUser['id'], 'USER_DELETED', 'user', $delUserId, ['deleted_email' => $delUser['email'] ?? null, 'deleted_name' => $delUser['name'] ?? null], 'SUCCESS', $adminUser['email']);
}
header('Location: /users.php');
exit;