[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [BP][FIX] Invalidate active sessions after password change

Elifeleti Mukisa Dan pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
cfed7e2e by Elifeleti Mukisa Dan at 2026-02-04T17:32:46+00:00
[BP][FIX] Invalidate active sessions after password change
---
* [BP][FIX] Invalidate active sessions after password change
---
* [BP][FIX] Invalidate active sessions after password change
---
* [FIX] Invalidate active sessions after password change
---
* [FIX] Invalidate active sessions after password change
---
* [FIX] Invalidate active sessions after password change

(cherry picked from commit 62e036368b65d3c1e71f913576e5ead2e19966d4)

b5d525fd [FIX] Invalidate active sessions after password change
52c8049d Redirect to login page after session invalidation
db0ea077 Avoid HTTP redirect when invalidating session in CLI mode

Co-authored-by: Yves Ngalamulume <[email protected]>

See merge request tikiwiki/tiki!9486

(cherry picked from commit 7ca463d750ca8f19a27b112209ec7881dc6988f9)

fd258658 [FIX] Invalidate active sessions after password change

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9488

(cherry picked from commit c9fc494fc78eee669d1240bb03b4c3f8e1a1f3cc)

f41f1dcd [FIX] Invalidate active sessions after password change

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!9492

See merge request tikiwiki/tiki!9503

See merge request tikiwiki/tiki!9505

- - - - -


3 changed files:

- tiki-login.php
- tiki-setup.php
- tiki-user_preferences.php


Changes:

=====================================
tiki-login.php
=====================================
@@ -349,6 +349,7 @@ if ($isvalid && ($isOpenIdValid || $access->checkCsrf(null, null, null, null, nu
             $userlib->assign_openid($user, $_SESSION['openid_url']);
         }
         $url = $_SESSION['loginfrom'];
+        $_SESSION['login_time'] = time();
 
         // When logging into a multi-lingual Tiki, $_SESSION['loginfrom'] contains the main-language page, and not the translated one
         //  This only applies if feature_best_language and only seems to affect SEFURL


=====================================
tiki-setup.php
=====================================
@@ -66,7 +66,28 @@ require_once('lib/setup/tikisetup.class.php');
 require_once('lib/setup/timer.class.php');
 $tiki_timer = new timer();
 $tiki_timer->start();
-require_once('tiki-setup_base.php');
+require_once('tiki-setup_base.php'); //Starting here composer autoloading is available
+
+if (! empty($user) && isset($_SESSION['login_time'])) {
+    $userInfo = $userlib->get_user_info($user);
+
+    if (! empty($userInfo['lastLogin']) && $_SESSION['login_time'] < $userInfo['lastLogin']) {
+        TikiLib::lib('login')->logout();
+        if (! defined('TIKI_CONSOLE') && PHP_SAPI !== 'cli') {
+            header('Location:tiki-login_scr.php');
+        }
+        exit;
+    }
+}
+
+if (version_compare(PHP_VERSION, TIKI_MIN_PHP_VERSION, '<')) {
+    if (PHP_SAPI !== 'cli') {                   // if not running a command line version of php, show requirements
+        header('location: tiki-install.php');
+        exit;
+    }
+    // This is command-line. No 'location' command make sense here. Let admins access what works and deal with the rest.
+    echo 'Warning: Tiki expects PHP ' . TIKI_MIN_PHP_VERSION . ' and above. You are running ' . PHP_VERSION . ". Use at your own risk\n";
+}
 
 // Attempt setting locales. This code is just a start, locales should be set per-user.
 // Also, different operating systems use different locale strings. en_US.utf8 is valid on POSIX systems, maybe not on Windows, feel free to add alternative locale strings.


=====================================
tiki-user_preferences.php
=====================================
@@ -379,6 +379,7 @@ if (isset($_POST['chgadmin']) && $access->checkCsrf()) {
             die;
         }
         $userlib->change_user_password($userwatch, $_POST["pass1"]);
+        $userlib->update_lastlogin($userwatch);
         if ($prefs['feature_user_encryption'] === 'y') {
             // Notify CryptLib about the login
             $cryptlib = TikiLib::lib('crypt');



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/cfed7e2e7ac0d9eb59bf1074a1d8692b96d0a0c8

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/cfed7e2e7ac0d9eb59bf1074a1d8692b96d0a0c8
You're receiving this email because of your account on gitlab.com.

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs