mirror/php-auth
1
0
Fork 0
mirror of https://github.com/delight-im/PHP-Auth.git synced 2025-08-03 14:47:30 +02:00
Code Issues Releases Wiki Activity

Perform logout for user whenever 'force_logout' has been incremented

Browse Source
This commit is contained in:
Marco
2018-03-24 18:15:21 +01:00
parent 235008fdb8
commit 62f4b39dcf
1 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
src/Auth.php
View File

@@ -156,7 +156,7 @@ final class Auth extends UserManager {
// fetch the authoritative data from the database again
try {
$authoritativeData = $this->db->selectRow(
'SELECT email, username, status, roles_mask FROM ' . $this->dbTablePrefix . 'users WHERE id = ?',
'SELECT email, username, status, roles_mask, force_logout FROM ' . $this->dbTablePrefix . 'users WHERE id = ?',
[ $this->getUserId() ]
);
}
@@ -166,20 +166,33 @@ final class Auth extends UserManager {
// if the user's data has been found
if (!empty($authoritativeData)) {
// update the session data
$_SESSION[self::SESSION_FIELD_EMAIL] = $authoritativeData['email'];
$_SESSION[self::SESSION_FIELD_USERNAME] = $authoritativeData['username'];
$_SESSION[self::SESSION_FIELD_STATUS] = (int) $authoritativeData['status'];
$_SESSION[self::SESSION_FIELD_ROLES] = (int) $authoritativeData['roles_mask'];
// the session field may not have been initialized for sessions that had already existed before the introduction of this feature
if (!isset($_SESSION[self::SESSION_FIELD_FORCE_LOGOUT])) {
$_SESSION[self::SESSION_FIELD_FORCE_LOGOUT] = 0;
}
// if the counter that keeps track of forced logouts has been incremented
if ($authoritativeData['force_logout'] > $_SESSION[self::SESSION_FIELD_FORCE_LOGOUT]) {
// the user must be signed out
$this->logOut();
}
// if the counter that keeps track of forced logouts has remained unchanged
else {
// the session data needs to be updated
$_SESSION[self::SESSION_FIELD_EMAIL] = $authoritativeData['email'];
$_SESSION[self::SESSION_FIELD_USERNAME] = $authoritativeData['username'];
$_SESSION[self::SESSION_FIELD_STATUS] = (int) $authoritativeData['status'];
$_SESSION[self::SESSION_FIELD_ROLES] = (int) $authoritativeData['roles_mask'];
// remember that we've just performed the required resynchronization
$_SESSION[self::SESSION_FIELD_LAST_RESYNC] = \time();
}
}
// if no data has been found for the user
else {
// their account may have been deleted so they should be signed out
$this->logOut();
}
// remember that we've just performed resynchronization
$_SESSION[self::SESSION_FIELD_LAST_RESYNC] = \time();
}
}
}