NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 22:20:29 +02:00
parent 38701bf06a
commit fc1a211c73
9 changed files with 478 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/setup.php
+13 -1
View File
@@ -62,15 +62,27 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$adminId = (int)$db->lastInsertId();
// Automatische dagsessie starten (geldig tot 23:59:59)
// Automatische dagsessie starten met verse sessie ID (OWASP ASVS v4.0 §3.3.1)
if (session_status() === PHP_SESSION_ACTIVE) {
session_regenerate_id(true);
}
$newSessionId = session_id();
$_SESSION['user_id'] = $adminId;
$_SESSION['user_name'] = $name;
$_SESSION['user_email'] = $email;
$_SESSION['user_role'] = 'ADMIN';
$_SESSION['is_2fa_verified'] = true;
$_SESSION['auth_date'] = date('Y-m-d');
$_SESSION['auth_fingerprint'] = fociz_get_client_fingerprint();
$_SESSION['session_expires_at'] = strtotime('today 23:59:59');
$_SESSION['last_activity'] = time();
$_SESSION['login_time'] = time();
$_SESSION['last_rotated'] = time();
clear_remember_cookie();
issue_day_session_token($adminId);
$maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
fociz_register_active_session($adminId, $newSessionId, $maxIdleSeconds);
unset($_SESSION['setup_totp_secret']);
fociz_log_audit($adminId, 'INITIAL_ADMIN_SETUP', 'user', $adminId, ['email' => $email, 'name' => $name], 'SUCCESS', $email);