NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 22:20:29 +02:00
parent 38701bf06a
commit fc1a211c73
9 changed files with 478 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/invite.php
+13 -1
View File
@@ -77,15 +77,27 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
fociz_log_audit($newUserId, 'USER_REGISTERED_VIA_INVITE', 'user', $newUserId, ['email' => $invite['email'], 'role' => $invite['role']], 'SUCCESS', $invite['email']);
// Start dagsessie (geldig tot 23:59:59)
// Start dagsessie met verse sessie ID (OWASP ASVS v4.0 §3.3.1 / SOC 2 CC6.6)
if (session_status() === PHP_SESSION_ACTIVE) {
session_regenerate_id(true);
}
$newSessionId = session_id();
$_SESSION['user_id'] = $newUserId;
$_SESSION['user_name'] = $name;
$_SESSION['user_email'] = $invite['email'];
$_SESSION['user_role'] = $invite['role'];
$_SESSION['is_2fa_verified'] = true;
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['auth_fingerprint'] = fociz_get_client_fingerprint();
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
$_SESSION['last_activity'] = time();
$_SESSION['login_time'] = time();
$_SESSION['last_rotated'] = time();
clear_remember_cookie();
issue_day_session_token($newUserId);
$maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
fociz_register_active_session($newUserId, $newSessionId, $maxIdleSeconds);
unset($_SESSION['invite_totp_secret']);
header('Location: /planner.php');