← All changes | src/model/setting/class-session-protection.php +31 -0 5.7.0 → 6.3.0 View file →

		@@ -17,8 +17,13 @@
17	17	class Session_Protection extends Setting {
18	18	use User;
19	19
20	20	/**
	21	+ * Maximum allowed idle timeout in hours (~24.8 days, aligned with JS setTimeout 32-bit limit).
	22	+ */
	23	+ public const MAX_IDLE_TIMEOUT_HOURS = 596;
	24	+
	25	+ /**
21	26	* Feature status
22	27	*
23	28	* @defender_property
24	29	* @var bool
		@@ -78,8 +83,34 @@
78	83	*/
79	84	protected function before_load(): void {
80	85	$this->login_duration = $this->get_default_duration();
81	86	$this->user_roles = array( 'administrator' );
	87	+ }
	88	+
	89	+ /**
	90	+ * Clamps idle_timeout to MAX_IDLE_TIMEOUT_HOURS to guard against legacy values saved without a limit.
	91	+ *
	92	+ * @return void
	93	+ */
	94	+ protected function after_load(): void {
	95	+ if ( $this->idle_timeout > self::MAX_IDLE_TIMEOUT_HOURS ) {
	96	+ $this->idle_timeout = self::MAX_IDLE_TIMEOUT_HOURS;
	97	+ }
	98	+ }
	99	+
	100	+ /**
	101	+ * Validates that idle_timeout does not exceed the allowed maximum.
	102	+ *
	103	+ * @return void
	104	+ */
	105	+ protected function after_validate(): void {
	106	+ if ( $this->idle_timeout > self::MAX_IDLE_TIMEOUT_HOURS ) {
	107	+ $this->errors['idle_timeout'] = sprintf(
	108	+ /* translators: %d: maximum allowed hours */
	109	+ esc_html__( 'Idle timeout cannot exceed %d hours (30 days).', 'defender-security' ),
	110	+ self::MAX_IDLE_TIMEOUT_HOURS
	111	+ );
	112	+ }
82	113	}
83	114
84	115	/**
85	116	* Has lock properties?