NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 22:20:29 +02:00
parent 38701bf06a
commit fc1a211c73
9 changed files with 478 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/session.php
+46
View File
@@ -56,6 +56,7 @@ if ($action === 'logout') {
$stmt = $db->prepare("UPDATE users SET remember_token = NULL, remember_token_expires_at = NULL WHERE id = ?");
$stmt->execute([$userId]);
fociz_terminate_session(session_id());
fociz_log_audit($userId, 'LOGOUT_SESSION_GUARD', 'users', $userId, ['ip' => fociz_get_client_ip()], 'SUCCESS', $currentUser['email'] ?? null);
} catch (Throwable $e) {
error_log("Session guard logout error: " . $e->getMessage());
@@ -72,6 +73,51 @@ if ($action === 'logout') {
exit;
}
// Haal actieve apparaten en sessies op (SOC 2 CC6.1 / ISO 27001 A.9.4.2)
if ($action === 'get_active_sessions') {
$sessions = fociz_get_user_active_sessions($userId, session_id());
echo json_encode([
'success' => true,
'sessions' => $sessions,
'timestamp' => $now
], JSON_UNESCAPED_UNICODE);
exit;
}
// Beëindig alle overige actieve sessies (SOC 2 CC6.1)
if ($action === 'revoke_other_sessions') {
if (!verify_csrf_token($_POST['csrf_token'] ?? null)) {
http_response_code(403);
echo json_encode(['success' => false, 'error' => 'Ongeldig CSRF beveiligingstoken.'], JSON_UNESCAPED_UNICODE);
exit;
}
$count = fociz_revoke_other_sessions($userId, session_id());
echo json_encode([
'success' => true,
'revoked_count' => $count,
'message' => "Succesvol {$count} andere actieve sessie(s) op afstand beëindigd."
], JSON_UNESCAPED_UNICODE);
exit;
}
// Beëindig specifieke sessie op afstand
if ($action === 'revoke_session') {
if (!verify_csrf_token($_POST['csrf_token'] ?? null)) {
http_response_code(403);
echo json_encode(['success' => false, 'error' => 'Ongeldig CSRF beveiligingstoken.'], JSON_UNESCAPED_UNICODE);
exit;
}
$sessionDbId = (int)($_POST['session_id'] ?? 0);
$ok = fociz_revoke_session_by_id($userId, $sessionDbId);
echo json_encode([
'success' => $ok,
'message' => $ok ? 'Sessie succesvol op afstand beëindigd.' : 'Kan sessie niet intrekken.'
], JSON_UNESCAPED_UNICODE);
exit;
}
http_response_code(400);
echo json_encode(['success' => false, 'error' => 'Onbekende sessieactie.'], JSON_UNESCAPED_UNICODE);
exit;