hyzen/freedoms4-backend-public
1
0
Fork 0
mirror of https://github.com/hyzendust/freedoms4-backend-public.git synced 2026-09-19 10:43:06 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: auto-logout sessions + another minor hardening

Browse Source
This commit is contained in:
hyzen
2026-07-29 11:31:47 +02:00
parent 9037354195
commit a2bd99465a
4 changed files with 32 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
auth.php
View File

@@ -37,7 +37,6 @@ define('PROSODY_HOST', $env['PROSODY_HOST'] ?? 'freedoms4.org');
define('SESSION_NAME', 'f4_session');
define('SESSION_SECURE', true);
define('SESSION_SAMESITE', 'None');
define('SESSION_TTL', 86400); // 24 hours
define('OTP_FROM', 'no-reply@freedoms4.org');
define('OTP_TTL', 600); // 10 minutes
@@ -79,6 +78,7 @@ function json_out(array $data, int $status = 200): never {
function start_session(): void {
if (session_status() === PHP_SESSION_NONE) {
ini_set('session.gc_maxlifetime', (string) SESSION_TTL);
session_name(SESSION_NAME);
session_set_cookie_params([
'lifetime' => 0,
@@ -300,8 +300,10 @@ start_session();
$now = time();
$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
if (!rate_limit($ip, 20, 900)) {
json_out(['success' => false, 'message' => 'Too many requests. Please wait a few minutes.'], 429);
if ($action !== 'check_session' && $action !== 'logout') {
if (!rate_limit($ip, 20, 900)) {
json_out(['success' => false, 'message' => 'Too many requests. Please wait a few minutes.'], 429);
}
}
// ── 24 h session expiry ──
@@ -600,17 +602,24 @@ if ($action === 'check_session') {
json_out(['valid' => false]);
}
// Verify user still exists in DB
// Verify user still exists in DB and isn't blocked
try {
$pdo = db_connect();
$stmt = $pdo->prepare('SELECT 1 FROM users WHERE id = :id LIMIT 1');
$stmt = $pdo->prepare('SELECT blocked FROM users WHERE id = :id LIMIT 1');
$stmt->execute([':id' => $_SESSION['user_id']]);
if (!$stmt->fetch()) {
$row = $stmt->fetch();
if (!$row) {
// User deleted — destroy session
$_SESSION = [];
session_destroy();
json_out(['valid' => false]);
}
if ($row['blocked'] === true || $row['blocked'] === 't') {
// User blocked — destroy session
$_SESSION = [];
session_destroy();
json_out(['valid' => false]);
}
} catch (Exception $e) {
// DB unavailable — don't force logout, just report invalid so frontend can retry
json_out(['valid' => false, 'db_error' => true]);