diff --git a/app/includes/session_middleware.php b/app/includes/session_middleware.php index e51e7e8..c5d52a5 100644 --- a/app/includes/session_middleware.php +++ b/app/includes/session_middleware.php @@ -18,57 +18,22 @@ function applySessionMiddleware($config, $app_root) { 'cookie_httponly' => 1, 'cookie_secure' => 1, 'cookie_samesite' => 'Strict', - 'gc_maxlifetime' => 1440 // 24 minutes + 'gc_maxlifetime' => 7200 // 2 hours ]); } } - // Check if user is logged in - if (!isset($_SESSION['user_id'])) { - if (!$isTest) { - header('Location: ' . $app_root . '?page=login'); - exit(); - } + // Check if user is logged in with all required session variables + if (!isset($_SESSION['user_id']) || !isset($_SESSION['username'])) { + cleanupSession($config, $app_root, $isTest); return false; } // Check session timeout - $session_timeout = isset($_SESSION['REMEMBER_ME']) ? (30 * 24 * 60 * 60) : 1440; // 30 days or 24 minutes + $session_timeout = isset($_SESSION['REMEMBER_ME']) ? (30 * 24 * 60 * 60) : 7200; // 30 days or 2 hours if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > $session_timeout)) { // Session has expired - $oldSessionData = $_SESSION; - $_SESSION = array(); - - if (!$isTest && session_status() === PHP_SESSION_ACTIVE) { - session_unset(); - session_destroy(); - - // Start a new session to prevent errors - if (!headers_sent()) { - session_start([ - 'cookie_httponly' => 1, - 'cookie_secure' => 1, - 'cookie_samesite' => 'Strict', - 'gc_maxlifetime' => 1440 - ]); - } - } - - if (!$isTest && !headers_sent()) { - setcookie('username', '', [ - 'expires' => time() - 3600, - 'path' => $config['folder'], - 'domain' => $config['domain'], - 'secure' => isset($_SERVER['HTTPS']), - 'httponly' => true, - 'samesite' => 'Strict' - ]); - } - - if (!$isTest) { - header('Location: ' . $app_root . '?page=login&timeout=1'); - exit(); - } + cleanupSession($config, $app_root, $isTest); return false; } @@ -90,3 +55,43 @@ function applySessionMiddleware($config, $app_root) { return true; } + +/** + * Helper function to clean up session data and redirect + */ +function cleanupSession($config, $app_root, $isTest) { + if (!$isTest) { + // Clear session data + $_SESSION = array(); + + if (session_status() === PHP_SESSION_ACTIVE) { + session_unset(); + session_destroy(); + + // Start a new session to prevent errors + if (!headers_sent()) { + session_start([ + 'cookie_httponly' => 1, + 'cookie_secure' => 1, + 'cookie_samesite' => 'Strict', + 'gc_maxlifetime' => 7200 + ]); + } + } + + // Clear cookies + if (!headers_sent()) { + setcookie('username', '', [ + 'expires' => time() - 3600, + 'path' => $config['folder'], + 'domain' => $config['domain'], + 'secure' => isset($_SERVER['HTTPS']), + 'httponly' => true, + 'samesite' => 'Strict' + ]); + } + + header('Location: ' . $app_root . '?page=login&timeout=1'); + exit(); + } +} diff --git a/app/templates/page-menu.php b/app/templates/page-menu.php index ca8e8ac..fef4266 100644 --- a/app/templates/page-menu.php +++ b/app/templates/page-menu.php @@ -6,13 +6,19 @@