[TikiWiki-commits] [Git][tikiwiki/tiki][28.x] [BP][FIX] Invalidate active sessions after password change

Elifeleti Mukisa Dan pushed to branch 28.x at Tiki Wiki CMS Groupware / Tiki


Commits:
742abd9b by Elifeleti Mukisa Dan at 2026-02-04T10:59:12+00:00
[BP][FIX] Invalidate active sessions after password change
---
* [FIX] Invalidate active sessions after password change
---
* [FIX] Invalidate active sessions after password change
---
* [FIX] Invalidate active sessions after password change


(cherry picked from commit 62e036368b65d3c1e71f913576e5ead2e19966d4)

b5d525fd [FIX] Invalidate active sessions after password change
52c8049d Redirect to login page after session invalidation
db0ea077 Avoid HTTP redirect when invalidating session in CLI mode

Co-authored-by: Yves Ngalamulume <[email protected]>

See merge request tikiwiki/tiki!9486


(cherry picked from commit 7ca463d750ca8f19a27b112209ec7881dc6988f9)

fd258658 [FIX] Invalidate active sessions after password change

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9488


(cherry picked from commit c9fc494fc78eee669d1240bb03b4c3f8e1a1f3cc)

f41f1dcd [FIX] Invalidate active sessions after password change

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9492

- - - - -


3 changed files:

- tiki-login.php
- tiki-setup.php
- tiki-user_preferences.php


Changes:

=====================================
tiki-login.php
=====================================
@@ -368,6 +368,7 @@ if ($isvalid && ($isOpenIdValid || $access->checkCsrf(null, null, null, null, nu
         TikiLib::lib('login')->activateSession($user);
 
         $url = $_SESSION['loginfrom'];
+        $_SESSION['login_time'] = time();
 
         // When logging into a multi-lingual Tiki, $_SESSION['loginfrom'] contains the main-language page, and not the translated one
         //  This only applies if feature_best_language and only seems to affect SEFURL


=====================================
tiki-setup.php
=====================================
@@ -65,6 +65,18 @@ $tiki_timer->start();
 
 require_once('tiki-setup_base.php'); //Starting here composer autoloading is available
 
+if (! empty($user) && isset($_SESSION['login_time'])) {
+    $userInfo = $userlib->get_user_info($user);
+
+    if (! empty($userInfo['lastLogin']) && $_SESSION['login_time'] < $userInfo['lastLogin']) {
+        TikiLib::lib('login')->logout();
+        if (! defined('TIKI_CONSOLE') && PHP_SAPI !== 'cli') {
+            header('Location:tiki-login_scr.php');
+        }
+        exit;
+    }
+}
+
 if (version_compare(PHP_VERSION, TIKI_MIN_PHP_VERSION, '<')) {
     if (PHP_SAPI !== 'cli') {                   // if not running a command line version of php, show requirements
         header('location: tiki-install.php');


=====================================
tiki-user_preferences.php
=====================================
@@ -448,6 +448,7 @@ if (isset($_POST['chgadmin']) && $access->checkCsrf()) {
             die;
         }
         $userlib->change_user_password($userwatch, $_POST["pass1"]);
+        $userlib->update_lastlogin($userwatch);
         if ($prefs['feature_user_encryption'] === 'y') {
             // Notify CryptLib about the login
             $cryptlib = TikiLib::lib('crypt');



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/742abd9bbbe9befbf00334e8d22e89fb313dcf30

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/742abd9bbbe9befbf00334e8d22e89fb313dcf30
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs