tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Check editor accounts.

Browse Source 
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 5d657d7e45
commit 3df88e0b4c
10 changed files with 217 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
session.lib.php
+23 -2
View File
@@ -10,6 +10,10 @@ if (isset($_SERVER['HTTPS'])) {
session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
session_start();
// An editor whose account was removed is logged out
if (isset($_SESSION['editor']) && !editor_exists($_SESSION['editor']))
unset($_SESSION['editor']);
if (isset($_SESSION['editor'])) {
$is_admin = TRUE;
$username = $_SESSION['editor'];
@@ -29,7 +33,8 @@ if (isset($_SERVER['HTTPS'])) {
/*
* Persistent logins: the cookie holds "username|key", and the database
* holds only a SHA-256 of the key, so a copy of the table cannot be used
* to log in. Each device has its own row.
* to log in. Each device has its own row. A key works once, for a year
* after it was made, and only while the editor account exists.
*/
function persistent_cookie() {
$cookie_data = $_COOKIE['PersistentAuth'] ?? '';
@@ -54,7 +59,8 @@ function check_persistent_login() {
$key_hash = persistent_key_hash($key);
open_db('open');
$query = "SELECT * FROM $table WHERE username = ? AND session = ? LIMIT 1";
$query = "SELECT p.username, p.session FROM $table p JOIN editors e ON e.username = p.username" .
" WHERE p.username = ? AND p.session = ? AND p.created > DATE_SUB(now(), INTERVAL 1 YEAR) LIMIT 1";
$getid = $db->execute_query($query, array($username, $key_hash)) or db_fail();
$row = $getid->fetch_assoc();
open_db('close');
@@ -66,9 +72,24 @@ function check_persistent_login() {
create_persistent_login($username);
return true;
}
// A wrong, expired or revoked key: remove it and its cookie
delete_persistent_login();
return false;
}
/*
* Remove an editor account, with its persistent logins. Its sessions end
* at their next request, when editor_exists() fails.
*/
function remove_editor($username) {
global $db;
$opened = open_db('open');
$db->execute_query("DELETE FROM persistent_sessions WHERE username = ?", array($username)) or db_fail();
$db->execute_query("DELETE FROM editors WHERE username = ?", array($username)) or db_fail();
if ($opened)
open_db('close');
}
function create_persistent_login($username) {
$validity = strtotime('+1 year'); // Time to keep the session valid
global $db, $is_admin;