maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

fix session-timeout not being set

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2022-12-08 10:05:44 +01:00
parent 34e3290497
commit 4d908ff6ee
2 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
lib/Froxlor/UI/Panel/UI.php
View File

@@ -77,10 +77,7 @@ class UI
private static $install_mode = false; private static $install_mode = false;
/** public static function requestIsHttps(): bool
* send various security related headers
*/
public static function sendHeaders()
{ {
$isHttps = $isHttps =
$_SERVER['HTTPS'] $_SERVER['HTTPS']
@@ -88,15 +85,18 @@ class UI
?? $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? $_SERVER['HTTP_X_FORWARDED_PROTO']
?? null; ?? null;
$isHttps = return $isHttps && (strcasecmp('on', $isHttps) == 0 || strcasecmp('https', $isHttps) == 0);
$isHttps && (strcasecmp('on', $isHttps) == 0 }
|| strcasecmp('https', $isHttps) == 0 /**
); * send various security related headers
*/
public static function sendHeaders()
{
session_set_cookie_params([ session_set_cookie_params([
'lifetime' => 60, // will be renewed based on settings in lib/init.php
'path' => '/', 'path' => '/',
'domain' => $_SERVER['HTTP_HOST'], 'domain' => $_SERVER['HTTP_HOST'],
'secure' => $isHttps, 'secure' => self::requestIsHttps(),
'httponly' => true, 'httponly' => true,
'samesite' => 'Strict' 'samesite' => 'Strict'
]); ]);

13
lib/init.php
View File

@@ -179,7 +179,8 @@ if (@file_exists('templates/' . $theme . '/config.json')) {
} }
// check for existence of variant in theme // check for existence of variant in theme
if (is_array($_themeoptions) && (!array_key_exists('variants', $_themeoptions) || !array_key_exists($themevariant, $_themeoptions['variants']))) { if (is_array($_themeoptions) && (!array_key_exists('variants', $_themeoptions) || !array_key_exists($themevariant,
$_themeoptions['variants']))) {
$themevariant = "default"; $themevariant = "default";
} }
@@ -322,4 +323,14 @@ if (CurrentUser::hasSession()) {
} }
} }
CurrentUser::setField('csrf_token', $new_token); CurrentUser::setField('csrf_token', $new_token);
// update cookie lifetime
$cookie_params = [
'expires' => time() + Settings::Get('session.sessiontimeout'),
'path' => '/',
'domain' => $_SERVER['HTTP_HOST'],
'secure' => UI::requestIsHttps(),
'httponly' => true,
'samesite' => 'Strict'
];
setcookie(session_name(), $_COOKIE[session_name()], $cookie_params);
} }