NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix consistentie benamingen.

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 22:14:50 +02:00
parent deba8463b8
commit 38701bf06a
12 changed files with 1746 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/auth.php
+47 -4
View File
@@ -343,6 +343,11 @@ function ensure_remember_token_columns(PDO $db): void {
// Schoon uitsluitend verlopen tokens van gisteren op, wis NOOIT actieve tokens van vandaag
$db->exec("UPDATE `users` SET `remember_token` = NULL, `remember_token_expires_at` = NULL WHERE `remember_token_expires_at` IS NOT NULL AND `remember_token_expires_at` < NOW()");
}
$resActivity = $db->query("SHOW COLUMNS FROM `users` LIKE 'last_activity_at'");
if (!$resActivity || $resActivity->rowCount() === 0) {
$db->exec("ALTER TABLE `users` ADD COLUMN `last_activity_at` DATETIME NULL AFTER `remember_token_expires_at`");
}
} catch (Throwable $e) {
// Stil negeren indien al aanwezig of tijdens migraties
}
@@ -532,7 +537,7 @@ function issue_day_session_token(int $userId): string {
$db = get_db_connection();
ensure_remember_token_columns($db);
$stmt = $db->prepare("UPDATE users SET remember_token = ?, remember_token_expires_at = ? WHERE id = ?");
$stmt = $db->prepare("UPDATE users SET remember_token = ?, remember_token_expires_at = ?, last_activity_at = NOW() WHERE id = ?");
$stmt->execute([$token, $expiresAt, $userId]);
$isSecure = is_https_request();
@@ -591,6 +596,14 @@ function get_logged_in_user(): ?array {
$today = date('Y-m-d');
$now = time();
// Bepaal of dit een geautomatiseerde achtergrond poll is (zoals notifications, live sync of outlook polling)
$isBackgroundPoll = !empty($_SERVER['HTTP_X_BACKGROUND_POLL']) ||
(isset($_SERVER['REQUEST_URI']) && (
strpos($_SERVER['REQUEST_URI'], '/api/live_sync.php') !== false ||
(strpos($_SERVER['REQUEST_URI'], '/api/notifications.php') !== false && ($_GET['action'] ?? '') === 'get_events') ||
(strpos($_SERVER['REQUEST_URI'], '/api/planner.php') !== false && ($_GET['action'] ?? '') === 'check_outlook_sync')
));
// 1. Controleer of de huidige sessie van een eerdere dag is (dagwissel om middernacht)
if (!empty($_SESSION['auth_date']) && $_SESSION['auth_date'] !== $today) {
$_SESSION = ['session_was_expired' => true];
@@ -668,7 +681,19 @@ function get_logged_in_user(): ?array {
$_SESSION['auth_date'] = $today;
$_SESSION['auth_fingerprint'] = $clientFingerprint;
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
$_SESSION['last_activity'] = $now;
// Achtergrondpolls verversen last_activity NIET; alleen daadwerkelijke gebruikersinteractie houdt de sessie actief
if (!$isBackgroundPoll) {
$_SESSION['last_activity'] = $now;
if (empty($_SESSION['last_db_activity_update']) || ($now - (int)$_SESSION['last_db_activity_update']) > 60) {
$_SESSION['last_db_activity_update'] = $now;
try {
$stmtAct = $db->prepare("UPDATE users SET last_activity_at = NOW() WHERE id = ?");
$stmtAct->execute([$_SESSION['user_id']]);
} catch (Throwable $e) {}
}
}
$user['avatar_url'] = fociz_get_valid_avatar_url($user['avatar_url'] ?? null, (int)$user['id']);
$_SESSION['user_avatar_url'] = $user['avatar_url'];
return $user;
@@ -679,13 +704,25 @@ function get_logged_in_user(): ?array {
return null;
}
// 3. Fallback dagsessie-token: herstelt sessie na browserherstart (uitsluitend vandaag!)
// 3. Fallback dagsessie-token: herstelt sessie na browserherstart (uitsluitend vandaag én mits niet inactief!)
$dayToken = $_COOKIE['fociz_day_session'] ?? ($_COOKIE['fociz_remember'] ?? null);
if (!empty($dayToken) && is_string($dayToken)) {
$stmt = $db->prepare("SELECT id, name, email, role, two_factor_enabled, avatar_url, theme, notification_settings, default_jira_filter_code, fociz_widget_layout, created_at FROM users WHERE remember_token = ? AND remember_token_expires_at >= NOW() AND DATE(remember_token_expires_at) = ?");
$stmt = $db->prepare("SELECT id, name, email, role, two_factor_enabled, avatar_url, theme, notification_settings, default_jira_filter_code, fociz_widget_layout, last_activity_at, last_login_at, created_at FROM users WHERE remember_token = ? AND remember_token_expires_at >= NOW() AND DATE(remember_token_expires_at) = ?");
$stmt->execute([$dayToken, $today]);
$user = $stmt->fetch();
if ($user) {
$maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
// Controleer inactiviteit: als gebruiker te lang inactief is geweest, herstel weigeren en opnieuw inloggen
$lastActTime = !empty($user['last_activity_at']) ? strtotime($user['last_activity_at']) : (!empty($user['last_login_at']) ? strtotime($user['last_login_at']) : 0);
if ($lastActTime > 0 && ($now - $lastActTime) > $maxIdleSeconds) {
fociz_log_audit((int)$user['id'], 'SESSION_IDLE_TIMEOUT_COOKIE', 'users', (int)$user['id'], ['idle_seconds' => $now - $lastActTime, 'max_idle' => $maxIdleSeconds], 'WARNING');
$stmtClear = $db->prepare("UPDATE users SET remember_token = NULL, remember_token_expires_at = NULL WHERE id = ?");
$stmtClear->execute([$user['id']]);
$_SESSION = ['session_was_expired' => true, 'idle_timeout' => true];
clear_day_session_cookie();
return null;
}
$currentIp = fociz_get_client_ip();
// Als het token op een ander, onbekend IP wordt aangeboden, weiger de automatische herstel
if (!fociz_is_ip_known_for_user((int)$user['id'], $currentIp)) {
@@ -705,6 +742,12 @@ function get_logged_in_user(): ?array {
$_SESSION['last_activity'] = $now;
$_SESSION['login_time'] = $now;
$_SESSION['last_rotated'] = $now;
$_SESSION['last_db_activity_update'] = $now;
try {
$stmtAct = $db->prepare("UPDATE users SET last_activity_at = NOW() WHERE id = ?");
$stmtAct->execute([$user['id']]);
} catch (Throwable $e) {}
$user['avatar_url'] = fociz_get_valid_avatar_url($user['avatar_url'] ?? null, (int)$user['id']);
$_SESSION['user_avatar_url'] = $user['avatar_url'];
return $user;