prepare(" INSERT INTO users (name, email, password_hash, role, two_factor_secret, two_factor_enabled, backup_codes) VALUES (?, ?, ?, 'ADMIN', ?, 1, ?) "); $stmt->execute([ $name, $email, $passwordHash, $secret, json_encode($backupCodes) ]); $adminId = (int)$db->lastInsertId(); // Automatische dagsessie starten met verse sessie ID (OWASP ASVS v4.0 §3.3.1) if (session_status() === PHP_SESSION_ACTIVE) { session_regenerate_id(true); } $newSessionId = session_id(); $_SESSION['user_id'] = $adminId; $_SESSION['user_name'] = $name; $_SESSION['user_email'] = $email; $_SESSION['user_role'] = 'ADMIN'; $_SESSION['is_2fa_verified'] = true; $_SESSION['auth_date'] = date('Y-m-d'); $_SESSION['auth_fingerprint'] = fociz_get_client_fingerprint(); $_SESSION['session_expires_at'] = strtotime('today 23:59:59'); $_SESSION['last_activity'] = time(); $_SESSION['login_time'] = time(); $_SESSION['last_rotated'] = time(); clear_remember_cookie(); issue_day_session_token($adminId); $maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800; fociz_register_active_session($adminId, $newSessionId, $maxIdleSeconds); unset($_SESSION['setup_totp_secret']); fociz_log_audit($adminId, 'INITIAL_ADMIN_SETUP', 'user', $adminId, ['email' => $email, 'name' => $name], 'SUCCESS', $email); $success = true; } catch (Exception $e) { $error = "Fout bij aanmaken beheerder in MariaDB: " . $e->getMessage(); } } } $otpAuthUrl = TOTP::getOtpAuthUrl(!empty($email) ? $email : 'admin@fociz.local', $secret, 'Fociz'); $qrCodeUrl = TOTP::getQrCodeUrl($otpAuthUrl, 200); $pageTitle = "Fociz — Eerste Initialisatie"; ?> <?= htmlspecialchars($pageTitle) ?>

Fociz Initialisatie

Eenmalige configuratie van het hoofdbeheerdersaccount met verplichte 2FA

Beheerder Geïnstalleerd!

Uw account is aangemaakt en direct beveiligd met 2FA. Bewaar deze eenmalige herstelcodes veilig:

HERSTELCODES (NOODGEBRUIK):
Start met Fociz Dagplanning

Tweestapsverificatie (2FA) Koppelen

Scan onderstaande QR-code met uw authenticator app (Google Authenticator, Microsoft Authenticator of 1Password):

Sleutel: