hyzen/freedoms4-backend-public
1
0
Fork 0
mirror of https://github.com/hyzendust/freedoms4-backend-public.git synced 2026-09-19 02:33:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: auto-logout sessions + another minor hardening

Browse Source
This commit is contained in:
hyzen
2026-07-29 00:34:25 +02:00
parent 9037354195
commit 8c291e0c84
4 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
auth.php
View File

@@ -37,7 +37,6 @@ define('PROSODY_HOST', $env['PROSODY_HOST'] ?? 'freedoms4.org');
define('SESSION_NAME', 'f4_session');
define('SESSION_SECURE', true);
define('SESSION_SAMESITE', 'None');
define('SESSION_TTL', 86400); // 24 hours
define('OTP_FROM', 'no-reply@freedoms4.org');
define('OTP_TTL', 600); // 10 minutes
@@ -79,6 +78,7 @@ function json_out(array $data, int $status = 200): never {
function start_session(): void {
if (session_status() === PHP_SESSION_NONE) {
ini_set('session.gc_maxlifetime', (string) SESSION_TTL);
session_name(SESSION_NAME);
session_set_cookie_params([
'lifetime' => 0,
@@ -600,17 +600,24 @@ if ($action === 'check_session') {
json_out(['valid' => false]);
}
// Verify user still exists in DB
// Verify user still exists in DB and isn't blocked
try {
$pdo = db_connect();
$stmt = $pdo->prepare('SELECT 1 FROM users WHERE id = :id LIMIT 1');
$stmt = $pdo->prepare('SELECT blocked FROM users WHERE id = :id LIMIT 1');
$stmt->execute([':id' => $_SESSION['user_id']]);
if (!$stmt->fetch()) {
$row = $stmt->fetch();
if (!$row) {
// User deleted — destroy session
$_SESSION = [];
session_destroy();
json_out(['valid' => false]);
}
if ($row['blocked'] === true || $row['blocked'] === 't') {
// User blocked — destroy session
$_SESSION = [];
session_destroy();
json_out(['valid' => false]);
}
} catch (Exception $e) {
// DB unavailable — don't force logout, just report invalid so frontend can retry
json_out(['valid' => false, 'db_error' => true]);