NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement session expiration enforcement: clear remember cookies and redirect to login on session expiry; update header script for daily re-login requirement.

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-09 16:49:29 +02:00
parent 1487b680f1
commit 1b6c8e4afd
7 changed files with 71 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/callback_microsoft.php
+1 -1
View File
@@ -29,7 +29,7 @@ if (empty($_SESSION['user_id']) && $stateUserId) {
$_SESSION['is_2fa_verified'] = true;
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
issue_remember_token((int)$recoveredUser['id']);
clear_remember_cookie();
}
} catch (Throwable $e) {
// Foutafhandeling
auth/invite.php
+1 -1
View File
@@ -83,7 +83,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$_SESSION['is_2fa_verified'] = true;
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
issue_remember_token($newUserId);
clear_remember_cookie();
unset($_SESSION['invite_totp_secret']);
header('Location: /planner.php');
auth/login.php
+2 -2
View File
@@ -108,8 +108,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
// Activeer dagspecifieke remember token (verloopt vannacht om 23:59:59)
issue_remember_token((int)$user['id']);
// Zorg dat er geen persistente remember cookies worden gebruikt
clear_remember_cookie();
unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name']);
auth/setup.php
+1 -1
View File
@@ -70,7 +70,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$_SESSION['is_2fa_verified'] = true;
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
issue_remember_token($adminId);
clear_remember_cookie();
unset($_SESSION['setup_totp_secret']);
$success = true;