From c51b520b8dec840c059f2bc20f1b682fc0f0a12a Mon Sep 17 00:00:00 2001
From: billz <billzimmerman@gmail.com>
Date: Mon, 20 Jan 2025 00:55:21 -0800
Subject: [PATCH] Decouple session from csrf handler, set initial lastActivity

---
 includes/csrf.php    | 1 -
 includes/session.php | 5 +++++
 index.php            | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/includes/csrf.php b/includes/csrf.php
index bca935df..4e098e5b 100755
--- a/includes/csrf.php
+++ b/includes/csrf.php
@@ -1,7 +1,6 @@
 <?php
 
 require_once 'functions.php';
-require_once 'session.php';
 
 if (csrfValidateRequest() && !CSRFValidate()) {
     handleInvalidCSRFToken();
diff --git a/includes/session.php b/includes/session.php
index fe447f3d..12e45fec 100755
--- a/includes/session.php
+++ b/includes/session.php
@@ -3,3 +3,8 @@
 if (session_status() == PHP_SESSION_NONE) {
     session_start();
 }
+
+if (!isset($_SESSION['lastActivity'])) {
+    $_SESSION['lastActivity'] = time();
+}
+
diff --git a/index.php b/index.php
index c1d39e94..badd2762 100755
--- a/index.php
+++ b/index.php
@@ -23,6 +23,7 @@
  * as you leave these references intact in the header comments of your source files.
  */
 
+require 'includes/session.php';
 require 'includes/csrf.php';
 ensureCSRFSessionToken();