nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening: invited user onboarding flow (C1–N7)

Browse Source
This commit is contained in:
Thanakorn S
2026-05-26 10:18:40 +07:00
parent 0815ae3292
commit 9e200d31fe
9 changed files with 562 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/login/invited_onboarding.php
+34 -6
View File
@@ -10,6 +10,34 @@
exit;
}
// Reject if a user is already logged in — opening an invite link in an active
// session would bind a different account's identity into the current session.
if (!empty($_SESSION['login_company_id'])) {
require '../include_header.php';
?>
<body>
<div class="container py-5" style="max-width:480px;">
<div class="text-center mb-5">
<a href="<?php echo $server_url?>login/index.php" class="d-inline-block mb-4">
<img src="<?php echo $server_url?>assets/images/favicon.png" alt="" width="40"/>
<span class="ms-2"><img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
</a>
</div>
<div class="card text-center">
<div class="card-body p-5">
<i class="ti ti-user-check text-warning mb-3" style="font-size:3rem;"></i>
<h2 class="fs-4 mb-2">Already Signed In</h2>
<p class="text-muted mb-4">You are already signed in. Please sign out first before accepting an invitation.</p>
<a href="<?php echo $server_url?>login/index.php" class="btn btn-primary">Go to Dashboard</a>
</div>
</div>
</div>
</body>
</html>
<?php
exit;
}
// Validate token — must match a pending invited user (license='user') that has not expired
$sth = $pdo1->prepare(
"SELECT u.user_id, u.email, u.verify_expires_at, c.company_name
@@ -65,12 +93,12 @@
exit;
}
// Regenerate session ID before binding invite identity to prevent session fixation
session_regenerate_id(true);
$_SESSION['invited_user_id'] = (int)$row['user_id'];
$_SESSION['invited_token'] = $token;
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
$company_name = htmlspecialchars($row['company_name']);
$invite_email = htmlspecialchars($row['email']);
@@ -107,8 +135,8 @@
</div>
<div class="col-12">
<label class="form-label">Username <span class="text-danger">*</span></label>
<input type="text" class="form-control" id="username" placeholder="Lowercase letters, numbers, underscores">
<div class="form-text">Used to log in. Cannot be changed later.</div>
<input type="text" class="form-control" id="username" placeholder="Lowercase letters, numbers, underscores" minlength="3" maxlength="32">
<div class="form-text">3–32 characters. Used to log in. Cannot be changed later.</div>
</div>
<div class="col-12">
<label class="form-label">Password <span class="text-danger">*</span></label>