hyzen/freedoms4-backend-public
1
0
Fork 0
mirror of https://github.com/hyzendust/freedoms4-backend-public.git synced 2026-09-19 10:43:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: auto-logout sessions + another minor hardening

Browse Source
This commit is contained in:
hyzen
2026-07-29 00:34:25 +02:00
parent 9037354195
commit 8c291e0c84
4 changed files with 28 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
comments.php
View File

@@ -84,6 +84,7 @@ function db_connect(): PDO {
function start_session(): void {
if (session_status() === PHP_SESSION_NONE) {
ini_set('session.gc_maxlifetime', (string) SESSION_TTL);
session_name(SESSION_NAME);
session_set_cookie_params([
'lifetime' => 0,
@@ -171,6 +172,15 @@ function send_notification(string $type, string $actor, string $body, string $po
function logged_in_user(): ?array {
if (empty($_SESSION['user_id']) || empty($_SESSION['username'])) return null;
// Enforce same TTL as auth.php
$last_seen = $_SESSION['last_seen'] ?? 0;
if (time() - $last_seen > SESSION_TTL) {
$_SESSION = [];
session_destroy();
return null;
}
// Verify the user still exists in the DB (handles deleted accounts / wiped DB)
try {
$pdo = db_connect();