NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 22:20:29 +02:00
parent 38701bf06a
commit fc1a211c73
9 changed files with 478 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/invite.php
+13 -1
View File
@@ -77,15 +77,27 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
fociz_log_audit($newUserId, 'USER_REGISTERED_VIA_INVITE', 'user', $newUserId, ['email' => $invite['email'], 'role' => $invite['role']], 'SUCCESS', $invite['email']);
// Start dagsessie (geldig tot 23:59:59)
// Start dagsessie met verse sessie ID (OWASP ASVS v4.0 §3.3.1 / SOC 2 CC6.6)
if (session_status() === PHP_SESSION_ACTIVE) {
session_regenerate_id(true);
}
$newSessionId = session_id();
$_SESSION['user_id'] = $newUserId;
$_SESSION['user_name'] = $name;
$_SESSION['user_email'] = $invite['email'];
$_SESSION['user_role'] = $invite['role'];
$_SESSION['is_2fa_verified'] = true;
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['auth_fingerprint'] = fociz_get_client_fingerprint();
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
$_SESSION['last_activity'] = time();
$_SESSION['login_time'] = time();
$_SESSION['last_rotated'] = time();
clear_remember_cookie();
issue_day_session_token($newUserId);
$maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
fociz_register_active_session($newUserId, $newSessionId, $maxIdleSeconds);
unset($_SESSION['invite_totp_secret']);
header('Location: /planner.php');
auth/login.php
+14
View File
@@ -24,6 +24,9 @@ $infoMessage = null;
if (isset($_GET['expired'])) {
$infoMessage = "Uw sessie is beëindigd wegens inactiviteit of een dagwissel. Log opnieuw in om verder te gaan.";
}
if (isset($_GET['revoked'])) {
$infoMessage = "Uw sessie is op afstand beëindigd of ingetrokken. Log opnieuw in om verder te gaan.";
}
if (isset($_GET['ip_changed'])) {
$infoMessage = "U bent ingelogd vanaf een andere netwerklocatie. Uit veiligheidsoverwegingen dient u opnieuw in te loggen met 2FA.";
}
@@ -148,6 +151,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Volledige login succesvol (geldig tot 23:59:59 van vandaag)
fociz_register_user_ip((int)$user['id'], $clientIp, true);
// Session Fixation Beveiliging (OWASP ASVS v4.0 §3.3.1 / SOC 2 CC6.6):
// Genereer direct een nieuw cryptografisch sessie-ID en vernietig de pre-auth sessie
if (session_status() === PHP_SESSION_ACTIVE) {
session_regenerate_id(true);
}
$newSessionId = session_id();
$_SESSION['user_id'] = $user['id'];
$_SESSION['user_name'] = $user['name'];
$_SESSION['user_email'] = $user['email'];
@@ -163,6 +173,10 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Dagsessie-token uitgeven (strikt geldig tot 23:59:59 van vandaag)
issue_day_session_token((int)$user['id']);
// Registreer actieve sessie in user_sessions (SOC 2 / ISO 27001)
$maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
fociz_register_active_session((int)$user['id'], $newSessionId, $maxIdleSeconds);
fociz_log_audit((int)$user['id'], 'LOGIN_SUCCESS', 'user', (int)$user['id'], ['ip' => $clientIp, 'auth_method' => 'PASSWORD+2FA'], 'SUCCESS', $user['email']);
unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name']);
auth/logout.php
+6 -2
View File
@@ -6,13 +6,17 @@
require_once __DIR__ . '/../includes/auth.php';
start_secure_session();
// Vernietig persistente login in database
// Vernietig persistente login en sessie in database (SOC 2 CC6.1 / ISO 27001 A.9.4.2)
if (!empty($_SESSION['user_id'])) {
$uid = (int)$_SESSION['user_id'];
try {
$db = get_db_connection();
ensure_remember_token_columns($db);
$stmt = $db->prepare("UPDATE users SET remember_token = NULL, remember_token_expires_at = NULL WHERE id = ?");
$stmt->execute([$_SESSION['user_id']]);
$stmt->execute([$uid]);
fociz_terminate_session(session_id());
fociz_log_audit($uid, 'SESSION_TERMINATED_LOGOUT', 'users', $uid, ['ip' => fociz_get_client_ip()], 'SUCCESS', $_SESSION['user_email'] ?? null);
} catch (Throwable $e) {
// Stil negeren bij uitloggen
}
auth/setup.php
+13 -1
View File
@@ -62,15 +62,27 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$adminId = (int)$db->lastInsertId();
// Automatische dagsessie starten (geldig tot 23:59:59)
// Automatische dagsessie starten met verse sessie ID (OWASP ASVS v4.0 §3.3.1)
if (session_status() === PHP_SESSION_ACTIVE) {
session_regenerate_id(true);
}
$newSessionId = session_id();
$_SESSION['user_id'] = $adminId;
$_SESSION['user_name'] = $name;
$_SESSION['user_email'] = $email;
$_SESSION['user_role'] = 'ADMIN';
$_SESSION['is_2fa_verified'] = true;
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['auth_fingerprint'] = fociz_get_client_fingerprint();
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
$_SESSION['last_activity'] = time();
$_SESSION['login_time'] = time();
$_SESSION['last_rotated'] = time();
clear_remember_cookie();
issue_day_session_token($adminId);
$maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
fociz_register_active_session($adminId, $newSessionId, $maxIdleSeconds);
unset($_SESSION['setup_totp_secret']);
fociz_log_audit($adminId, 'INITIAL_ADMIN_SETUP', 'user', $adminId, ['email' => $email, 'name' => $name], 'SUCCESS', $email);