← All changes | src/model/setting/class-session-protection.php +33 -2 5.4.1 → 6.3.0 View file →

		@@ -17,8 +17,13 @@
17	17	class Session_Protection extends Setting {
18	18	use User;
19	19
20	20	/**
	21	+ * Maximum allowed idle timeout in hours (~24.8 days, aligned with JS setTimeout 32-bit limit).
	22	+ */
	23	+ public const MAX_IDLE_TIMEOUT_HOURS = 596;
	24	+
	25	+ /**
21	26	* Feature status
22	27	*
23	28	* @defender_property
24	29	* @var bool
		@@ -81,14 +86,40 @@
81	86	$this->user_roles = array( 'administrator' );
82	87	}
83	88
84	89	/**
	90	+ * Clamps idle_timeout to MAX_IDLE_TIMEOUT_HOURS to guard against legacy values saved without a limit.
	91	+ *
	92	+ * @return void
	93	+ */
	94	+ protected function after_load(): void {
	95	+ if ( $this->idle_timeout > self::MAX_IDLE_TIMEOUT_HOURS ) {
	96	+ $this->idle_timeout = self::MAX_IDLE_TIMEOUT_HOURS;
	97	+ }
	98	+ }
	99	+
	100	+ /**
	101	+ * Validates that idle_timeout does not exceed the allowed maximum.
	102	+ *
	103	+ * @return void
	104	+ */
	105	+ protected function after_validate(): void {
	106	+ if ( $this->idle_timeout > self::MAX_IDLE_TIMEOUT_HOURS ) {
	107	+ $this->errors['idle_timeout'] = sprintf(
	108	+ /* translators: %d: maximum allowed hours */
	109	+ esc_html__( 'Idle timeout cannot exceed %d hours (30 days).', 'defender-security' ),
	110	+ self::MAX_IDLE_TIMEOUT_HOURS
	111	+ );
	112	+ }
	113	+ }
	114	+
	115	+ /**
85	116	* Has lock properties?
86	117	*
87	118	* @return bool
88	119	*/
89	120	public function has_properties(): bool {
90		- return ! empty( $this->lock_properties );
	121	+ return array() !== $this->lock_properties;
91	122	}
92	123
93	124	/**
94	125	* Is property locked?
		@@ -126,9 +157,9 @@
126	157	*/
127	158	public function get_default_duration(): int {
128	159	$tweak_duration = wd_di()->get( Login_Duration::class )->get_tweak_duration();
129	160
130		- return ! empty( $tweak_duration )
	161	+ return $tweak_duration > 0
131	162	? $tweak_duration
132	163	: $this->login_duration;
133	164	}
134	165	}