Reauthenticate when a user password is changed

forkcms · Mar 23, 2022 · 7003a3b · 7003a3b
1 parent 1b38e33
commit 7003a3b
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/src/Backend/Core/Engine/Authentication.php b/src/Backend/Core/Engine/Authentication.php
@@ -436,4 +436,9 @@ public static function tearDown(): void
         self::$allowedModules = [];
         self::$user = null;
     }
+
+    public static function clearUserSessionsForId(int $userId): void
+    {
+        BackendModel::get('database')->delete('users_sessions', 'user_id = ?', $userId);
+    }
 }
diff --git a/src/Backend/Modules/Users/Actions/Edit.php b/src/Backend/Modules/Users/Actions/Edit.php
@@ -288,6 +288,7 @@ private function validateForm(): void
 
             // no errors?
             if ($this->form->isCorrect()) {
+                $reAuthenticate = false;
                 // build user-array
                 $user = ['id' => $this->id];
                 if (!$this->user->isGod()) {
@@ -330,6 +331,7 @@ private function validateForm(): void
 
                     // the password has changed
                     if ($this->record['password'] != $user['password']) {
+                        $reAuthenticate = true;
                         // save the login timestamp in the user's settings
                         $lastPasswordChange = BackendUsersModel::getSetting($user['id'], 'current_password_change');
                         $settings['current_password_change'] = time();
@@ -389,6 +391,14 @@ private function validateForm(): void
                     BackendGroupsModel::insertMultipleGroups($this->id, $fields['groups']->getChecked());
                 }
 
+                if ($reAuthenticate) {
+                    BackendAuthentication::clearUserSessionsForId($this->id);
+                    if ($this->authenticatedUser->getUserId() == $this->id) {
+                        BackendAuthentication::logout();
+                        BackendAuthentication::loginUser($this->user->getEmail(), $fields['new_password']->getValue());
+                    }
+                }
+
                 // can only edit own profile
                 if (!BackendAuthentication::isAllowedAction('Index')) {
                     // everything is saved, so redirect to the edit page