session timeout

public/userarea/include/headscript.php

@@ -62,10 +62,27 @@ require_once(__DIR__ . '/../../languages/en/general.php');
 require_once __DIR__ . '/permissions_helper.php';
 require_once(__DIR__ . '/popup-moved.php');
 
-// Timbra la sessione dell'utente a ogni pagina (rolling manuale)
+// Timbra la sessione: tiene vive le sessioni ancora valide dell'utente e rinnova il cookie di Laravel
 try {
+	$now      = time();
+	$lifetime = (int)(function_exists('config') ? config('session.lifetime', 120) : 120);   // minuti
+	$table    = function_exists('config') ? config('session.table', 'auth_sessions') : 'auth_sessions';
+
 	$pdoSess = DBHandlerSelect::getInstance()->getConnection();
-	$pdoSess->prepare("UPDATE auth_sessions SET last_activity = ? WHERE user_id = ? ORDER BY last_activity DESC LIMIT 1")
-		->execute([time(), $iduserlogin]);
+	$pdoSess->prepare("UPDATE `$table` SET last_activity = ? WHERE user_id = ? AND last_activity > ?")
+		->execute([$now, $iduserlogin, $now - $lifetime * 60]);
+
+	// le pagine userarea non passano da Laravel: rinnovo io la scadenza del cookie di sessione
+	$cookie = function_exists('config') ? config('session.cookie') : null;
+	if ($cookie && !empty($_COOKIE[$cookie]) && !headers_sent() && !(function_exists('config') && config('session.expire_on_close'))) {
+		setcookie($cookie, $_COOKIE[$cookie], [
+			'expires'  => $now + $lifetime * 60,
+			'path'     => function_exists('config') ? (config('session.path') ?: '/') : '/',
+			'domain'   => function_exists('config') ? (config('session.domain') ?: '') : '',
+			'secure'   => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
+			'httponly' => true,
+			'samesite' => function_exists('config') ? (config('session.same_site') ?: 'Lax') : 'Lax',
+		]);
+	}
 } catch (\Throwable $e) { /* non bloccare la pagina */
 }