hyzen/freedoms4-backend-public
1
0
Fork 0
mirror of https://github.com/hyzendust/freedoms4-backend-public.git synced 2026-09-19 02:33:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: auto-logout sessions + another minor hardening

Browse Source
This commit is contained in:
hyzen
2026-07-29 11:31:47 +02:00
parent 9037354195
commit a2bd99465a
4 changed files with 32 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
admin.php
View File

@@ -218,6 +218,7 @@ function xmpp_delete_backup(string $username): void {
// ── Session + admin check ──
if (session_status() === PHP_SESSION_NONE) {
ini_set('session.gc_maxlifetime', (string) SESSION_TTL);
session_name(SESSION_NAME);
session_set_cookie_params([
'lifetime' => 0,

21
auth.php
View File

@@ -37,7 +37,6 @@ define('PROSODY_HOST', $env['PROSODY_HOST'] ?? 'freedoms4.org');
define('SESSION_NAME', 'f4_session');
define('SESSION_SECURE', true);
define('SESSION_SAMESITE', 'None');
define('SESSION_TTL', 86400); // 24 hours
define('OTP_FROM', 'no-reply@freedoms4.org');
define('OTP_TTL', 600); // 10 minutes
@@ -79,6 +78,7 @@ function json_out(array $data, int $status = 200): never {
function start_session(): void {
if (session_status() === PHP_SESSION_NONE) {
ini_set('session.gc_maxlifetime', (string) SESSION_TTL);
session_name(SESSION_NAME);
session_set_cookie_params([
'lifetime' => 0,
@@ -300,8 +300,10 @@ start_session();
$now = time();
$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
if (!rate_limit($ip, 20, 900)) {
json_out(['success' => false, 'message' => 'Too many requests. Please wait a few minutes.'], 429);
if ($action !== 'check_session' && $action !== 'logout') {
if (!rate_limit($ip, 20, 900)) {
json_out(['success' => false, 'message' => 'Too many requests. Please wait a few minutes.'], 429);
}
}
// ── 24 h session expiry ──
@@ -600,17 +602,24 @@ if ($action === 'check_session') {
json_out(['valid' => false]);
}
// Verify user still exists in DB
// Verify user still exists in DB and isn't blocked
try {
$pdo = db_connect();
$stmt = $pdo->prepare('SELECT 1 FROM users WHERE id = :id LIMIT 1');
$stmt = $pdo->prepare('SELECT blocked FROM users WHERE id = :id LIMIT 1');
$stmt->execute([':id' => $_SESSION['user_id']]);
if (!$stmt->fetch()) {
$row = $stmt->fetch();
if (!$row) {
// User deleted — destroy session
$_SESSION = [];
session_destroy();
json_out(['valid' => false]);
}
if ($row['blocked'] === true || $row['blocked'] === 't') {
// User blocked — destroy session
$_SESSION = [];
session_destroy();
json_out(['valid' => false]);
}
} catch (Exception $e) {
// DB unavailable — don't force logout, just report invalid so frontend can retry
json_out(['valid' => false, 'db_error' => true]);

10
comments.php
View File

@@ -84,6 +84,7 @@ function db_connect(): PDO {
function start_session(): void {
if (session_status() === PHP_SESSION_NONE) {
ini_set('session.gc_maxlifetime', (string) SESSION_TTL);
session_name(SESSION_NAME);
session_set_cookie_params([
'lifetime' => 0,
@@ -171,6 +172,15 @@ function send_notification(string $type, string $actor, string $body, string $po
function logged_in_user(): ?array {
if (empty($_SESSION['user_id']) || empty($_SESSION['username'])) return null;
// Enforce same TTL as auth.php
$last_seen = $_SESSION['last_seen'] ?? 0;
if (time() - $last_seen > SESSION_TTL) {
$_SESSION = [];
session_destroy();
return null;
}
// Verify the user still exists in the DB (handles deleted accounts / wiped DB)
try {
$pdo = db_connect();

7
full-setup.sh
View File

@@ -21,12 +21,14 @@ DB_USER=""
DB_PASS=""
PROSODY_DB_USER=""
PROSODY_DB_PASS="" # must match /etc/prosody/prosody.cfg.lua
DOMAIN=""
DOMAIN="backend.freedoms4.org"
CERTBOT_EMAIL=""
API_DIR=""
ENV_FILE=""
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
OTP_FROM="" # for example: no-reply@freedoms4.org
SESSION_GC_MAXLIFETIME=86400 # time to auto-logout a session in seconds
# Must run as root
if [[ $EUID -ne 0 ]]; then
@@ -365,6 +367,7 @@ fi
mkdir -p "${API_DIR}"
cp "${SCRIPT_DIR}/auth.php" "${API_DIR}/auth.php"
sed -i "/define('SESSION_SAMESITE',/a define('SESSION_TTL', ${SESSION_GC_MAXLIFETIME});" "${API_DIR}/auth.php"
chown -R www-data:www-data "${API_DIR}"
chmod 640 "${API_DIR}/auth.php"
success "auth.php deployed."
@@ -373,6 +376,7 @@ if [[ ! -f "${SCRIPT_DIR}/comments.php" ]]; then
error "comments.php not found in ${SCRIPT_DIR}."
fi
cp "${SCRIPT_DIR}/comments.php" "${API_DIR}/comments.php"
sed -i "/define('SESSION_SAMESITE',/a define('SESSION_TTL', ${SESSION_GC_MAXLIFETIME});" "${API_DIR}/comments.php"
chown www-data:www-data "${API_DIR}/comments.php"
chmod 640 "${API_DIR}/comments.php"
success "comments.php deployed."
@@ -381,6 +385,7 @@ if [[ ! -f "${SCRIPT_DIR}/admin.php" ]]; then
error "admin.php not found in ${SCRIPT_DIR}."
fi
cp "${SCRIPT_DIR}/admin.php" "${API_DIR}/admin.php"
sed -i "/define('SESSION_SAMESITE',/a define('SESSION_TTL', ${SESSION_GC_MAXLIFETIME});" "${API_DIR}/admin.php"
chown www-data:www-data "${API_DIR}/admin.php"
chmod 640 "${API_DIR}/admin.php"
success "admin.php deployed."