diff --git a/database_updates.php b/database_updates.php index a822b609..29988cef 100644 --- a/database_updates.php +++ b/database_updates.php @@ -1504,6 +1504,12 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { // Then, update the database to the next sequential version mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.9.5'"); } + + if (CURRENT_DATABASE_VERSION == '0.9.5') { + mysqli_query($mysqli, "ALTER TABLE `user_settings` ADD `user_config_remember_me_token` VARCHAR(255) NULL DEFAULT NULL AFTER `user_role`"); + // Then, update the database to the next sequential version + mysqli_query($mysqli, "UPDATE `settings` SET `config_current_database_version` = '0.9.6'"); + } } else { // Up-to-date } diff --git a/database_version.php b/database_version.php index e8349860..87bac458 100644 --- a/database_version.php +++ b/database_version.php @@ -5,5 +5,5 @@ * It is used in conjunction with database_updates.php */ -DEFINE("LATEST_DATABASE_VERSION", "0.9.5"); +DEFINE("LATEST_DATABASE_VERSION", "0.9.6"); diff --git a/login.php b/login.php index 08618380..eb08bd7b 100644 --- a/login.php +++ b/login.php @@ -111,12 +111,25 @@ if (isset($_POST['login'])) { $user_email = sanitizeInput($row['user_email']); $token = sanitizeInput($row['user_token']); $force_mfa = intval($row['user_config_force_mfa']); + $remember_token = $row['user_config_remember_me_token']; if($force_mfa == 1 && $token == NULL) { $config_start_page = "user_profile.php"; } - // Checking for user 2FA - if (empty($token) || TokenAuth6238::verify($token, $current_code)) { + $bypass_2fa = false; + if (isset($_COOKIE['rememberme']) && $_COOKIE['rememberme'] == $remember_token) { + $bypass_2fa = true; + } elseif (empty($token) || TokenAuth6238::verify($token, $current_code)) { + $bypass_2fa = true; + } + + if ($bypass_2fa) { + if (isset($_POST['remember_me'])) { + $newRememberToken = bin2hex(random_bytes(64)); + setcookie('rememberme', $newRememberToken, time() + 86400*14, "/", null, true, true); + $updateTokenQuery = "UPDATE user_settings SET user_config_remember_me_token = '$newRememberToken' WHERE user_id = $user_id"; + mysqli_query($mysqli, $updateTokenQuery); + } // FULL LOGIN SUCCESS - 2FA not configured or was successful @@ -310,14 +323,14 @@ if (isset($_POST['login'])) { - +