NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): implement IP verification and encryption for sensitive tokens

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 13:17:12 +02:00
parent c3001cdd0a
commit 55618ffaed
10 changed files with 437 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/integrations/jira.php
+2 -1
View File
@@ -866,7 +866,8 @@ function jira_get_dashboard_data(int $userId, bool $forceRefresh = false): array
$settings = json_decode($integration['settings'] ?? '{}', true) ?: [];
$domain = !empty($settings['jira_domain']) ? $settings['jira_domain'] : jira_get_company_domain();
$email = $settings['jira_email'] ?? fociz_env('JIRA_EMAIL', '');
$apiToken = $settings['jira_api_token'] ?? fociz_env('JIRA_API_TOKEN', '');
$apiTokenRaw = $settings['jira_api_token'] ?? fociz_env('JIRA_API_TOKEN', '');
$apiToken = fociz_decrypt($apiTokenRaw);
$accName = $settings['account_name'] ?? 'Atlassian Gebruiker';
if (empty($domain) || empty($email) || empty($apiToken)) {
includes/integrations/microsoft.php
+13 -6
View File
@@ -218,23 +218,25 @@ function microsoft_get_valid_token(int $userId, bool $forceRefresh = false): ?st
return null;
}
$accessToken = fociz_decrypt($integration['access_token']);
$refreshToken = fociz_decrypt($integration['refresh_token'] ?? '');
$settings = json_decode($integration['settings'] ?? '{}', true) ?: [];
$expiresAt = (int)($settings['expires_at'] ?? 0);
// Als token nog minstens 4 minuten geldig is én we niet forceren, direct retourneren
if (!$forceRefresh && $expiresAt > (time() + 240)) {
return $integration['access_token'];
return $accessToken;
}
// Token is verlopen of forceRefresh gevraagd; refresh met refresh_token
$refreshToken = $integration['refresh_token'] ?? '';
$appConfig = microsoft_get_app_config();
$clientId = !empty($settings['client_id']) ? $settings['client_id'] : $appConfig['client_id'];
$clientSecret = !empty($settings['client_secret']) ? $settings['client_secret'] : $appConfig['client_secret'];
$tenantId = !empty($settings['tenant_id']) ? $settings['tenant_id'] : $appConfig['tenant_id'];
if (empty($refreshToken) || empty($clientId) || empty($clientSecret)) {
return !$forceRefresh ? ($integration['access_token'] ?? null) : null;
return !$forceRefresh ? $accessToken : null;
}
$cleanTenant = (!empty($tenantId) && $tenantId !== 'common') ? $tenantId : 'planningsagenda.nl';
@@ -264,15 +266,20 @@ function microsoft_get_valid_token(int $userId, bool $forceRefresh = false): ?st
SET access_token = ?, refresh_token = ?, settings = ?, last_sync_at = NOW()
WHERE id = ?
");
$updateStmt->execute([$newAccessToken, $newRefreshToken, json_encode($settings), $integration['id']]);
$updateStmt->execute([
fociz_encrypt($newAccessToken),
fociz_encrypt($newRefreshToken),
json_encode($settings),
$integration['id']
]);
return $newAccessToken;
}
error_log("Microsoft token refresh mislukt voor user {$userId}: " . ($response['error'] ?? json_encode($response['json'])));
// Fallback: indien het huidige token nog aanwezig is, probeer dit toch te gebruiken
if (!empty($integration['access_token'])) {
return $integration['access_token'];
if (!empty($accessToken)) {
return $accessToken;
}
return null;
}