From 8ce423c60d4e57f09f1d88f9906e2c5be04b4542 Mon Sep 17 00:00:00 2001
From: rmeijer_huizehetoost <rmeijer_huizehetoost@HHO-1481.local>
Date: Wed, 1 Oct 2025 12:25:38 +0200
Subject: [PATCH] "Remember Me" functionality

---
 include/language.php |  5 +++++
 lang/en.php          |  1 +
 lang/nl.php          |  1 +
 login.php            | 47 +++++++++++++++++++++++++++++++++++++++++++-
 4 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/include/language.php b/include/language.php
index 90289dd..9e9569a 100644
--- a/include/language.php
+++ b/include/language.php
@@ -1,6 +1,11 @@
 <?php
 // include/language.php
 
+// Configure session settings before starting session
+ini_set('session.cookie_httponly', 1);
+ini_set('session.use_strict_mode', 1);
+ini_set('session.cookie_secure', isset($_SERVER['HTTPS']) ? 1 : 0);
+
 session_start();
 
 // The $pdo object is available from init.php which included this file.
diff --git a/lang/en.php b/lang/en.php
index 74ced2f..ea42409 100644
--- a/lang/en.php
+++ b/lang/en.php
@@ -17,6 +17,7 @@ return [
     'username' => 'Username',
     'password' => 'Password',
     'login_button' => 'Login',
+    'remember_me' => 'Remember me',
     'error_invalid_credentials' => 'Invalid username or password.',
     'error_fill_fields' => 'Please fill in both fields.',
     
diff --git a/lang/nl.php b/lang/nl.php
index ce2d3b5..00a99da 100644
--- a/lang/nl.php
+++ b/lang/nl.php
@@ -17,6 +17,7 @@ return [
     'username' => 'Gebruikersnaam',
     'password' => 'Wachtwoord',
     'login_button' => 'Inloggen',
+    'remember_me' => 'Onthoud mij',
     'error_invalid_credentials' => 'Ongeldige gebruikersnaam of wachtwoord.',
     'error_fill_fields' => 'Vul alstublieft beide velden in.',
 
diff --git a/login.php b/login.php
index 52cfb2b..2e75ea4 100644
--- a/login.php
+++ b/login.php
@@ -12,6 +12,7 @@ if (isset($_SESSION['user_id'])) {
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $username = $_POST['username'] ?? '';
     $password = $_POST['password'] ?? '';
+    $remember_me = isset($_POST['remember_me']);
     $honeypot = $_POST['website'] ?? '';
 
     // Honeypot check: if the hidden field is filled, it's a bot.
@@ -35,7 +36,45 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             $_SESSION['user_id'] = $user['id'];
             $_SESSION['username'] = $user['username'];
             $_SESSION['role'] = $user['role'];
-            // TODO: Handle "Remember Me"
+            
+            // Handle "Remember Me" functionality
+            if ($remember_me) {
+                // Get remember me duration from settings
+                $stmt = $pdo->prepare("SELECT value FROM settings WHERE key = 'remember_me_duration'");
+                $stmt->execute();
+                $duration = $stmt->fetchColumn() ?: '2 weeks';
+                
+                // Convert duration to seconds
+                $seconds = 0;
+                switch ($duration) {
+                    case '1 day':
+                        $seconds = 24 * 60 * 60;
+                        break;
+                    case '2 weeks':
+                        $seconds = 14 * 24 * 60 * 60;
+                        break;
+                    case '1 month':
+                        $seconds = 30 * 24 * 60 * 60;
+                        break;
+                    case '3 months':
+                        $seconds = 90 * 24 * 60 * 60;
+                        break;
+                    case '1 year':
+                        $seconds = 365 * 24 * 60 * 60;
+                        break;
+                    default:
+                        $seconds = 14 * 24 * 60 * 60; // Default to 2 weeks
+                }
+                
+                // Set session cookie lifetime
+                ini_set('session.cookie_lifetime', $seconds);
+                ini_set('session.gc_maxlifetime', $seconds);
+                
+                // Update session cookie with new lifetime
+                $params = session_get_cookie_params();
+                setcookie(session_name(), session_id(), time() + $seconds, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
+            }
+            
             header('Location: index.php');
             exit;
         } else {
@@ -80,6 +119,12 @@ require_once 'include/header.php';
                         <label for="password" class="form-label"><?php echo translate('password'); ?></label>
                         <input type="password" class="form-control" id="password" name="password" required>
                     </div>
+                    <div class="mb-3 form-check">
+                        <input class="form-check-input" type="checkbox" id="remember_me" name="remember_me" value="1">
+                        <label class="form-check-label" for="remember_me">
+                            <?php echo translate('remember_me'); ?>
+                        </label>
+                    </div>
                     <div class="mb-3 website-field" style="display: none !important;">
                         <label for="website" class="form-label">Website</label>
                         <input type="text" class="form-control" id="website" name="website" autocomplete="off">