diff --git a/app/middleware/AdminMiddleware.php b/app/middleware/AdminMiddleware.php index e12deae..277670d 100644 --- a/app/middleware/AdminMiddleware.php +++ b/app/middleware/AdminMiddleware.php @@ -8,7 +8,7 @@ class AdminMiddleware extends LoginRequiredMiddleware public function canAccess(): bool { if (parent::canAccess()) { - return $_SESSION['UserLevel'] > 100; + return $_SESSION['LEVEL'] > 100; } return false; diff --git a/app/middleware/LoginRequiredMiddleware.php b/app/middleware/LoginRequiredMiddleware.php index 37bed41..0bb6596 100644 --- a/app/middleware/LoginRequiredMiddleware.php +++ b/app/middleware/LoginRequiredMiddleware.php @@ -25,7 +25,6 @@ class LoginRequiredMiddleware extends SessionMiddleware $getLevel->execute([$_SESSION['UUID']]); if ($row = $getLevel->fetch()) { $_SESSION['LEVEL'] = $row['UserLevel']; - session_set_cookie_params(86400); return true; } else { diff --git a/app/middleware/SessionMiddleware.php b/app/middleware/SessionMiddleware.php index 2d0b4c7..79de43e 100644 --- a/app/middleware/SessionMiddleware.php +++ b/app/middleware/SessionMiddleware.php @@ -38,7 +38,7 @@ abstract class SessionMiddleware implements Middleware break; } - if(!isset($_SESSION['csrf']) || strlen($_SESSION['csrf']) != 64) { + if(!isset($_SESSION['csrf']) || !preg_match('/^[0-9a-f]{64}$/', $_SESSION['csrf'])) { $_SESSION['csrf'] = bin2hex(random_bytes(32)); } }