Recent Posts

51

Modules / Re: accordion 2.7.6 Template in Einstellungen nicht wählbar

« Last post by ruebenwurzel on December 03, 2025, 09:29:42 AM »

Perfekt, Danke 

52

Modules / Re: accordion 2.7.6 Template in Einstellungen nicht wählbar

« Last post by sternchen8875 on December 03, 2025, 02:08:00 AM »

japp, geht auf meine Kappe

Datei /modules/accordion/cmd/Modifysettings.inc.php

da fehlt eine Zeile   

hinter diese Zeilen 80ff

Code: [Select]

$oBEFunctions                                   = new Accordion();
$aTwigdata['setting']                           = $oBEFunctions->getAccordionSettings($section_id);
$aTwigdata['lang']                              = $oTrans->getLangArray();
füge diese Zeile ein

Code: [Select]

$aTwigdata['TemplateList']                      = $oBEFunctions->getAllTemplatesArray($section_id);
neue Version lade ich später hoch

53

Modules / accordion 2.7.6 Template in Einstellungen nicht wählbar

« Last post by ruebenwurzel on December 02, 2025, 12:59:11 PM »

Hallo,

habe eben versucht eine neu Accordion Section in eine Seite einzubauen. Nach Aktivierung des Template Editors habe ich mein Template erstellt. Unter "Wähle ein Frontend-Template" ist es nicht zu sehen, kann deshalb auch nicht aktiviert werden. Musste die Template ID dann in der Datenbank manuell eintragen.

Kann das jemand nachvollziehen oder ist das ein lokales Problem meiner Installation?

Gruß
Matthias

WB 2.23.9 R25; PHP 8.4

54

General Help & Support / Re: Wish list: "Remember me" at login...

« Last post by sternchen8875 on November 28, 2025, 09:53:23 AM »

 

55

General Help & Support / Re: Wish list: "Remember me" at login...

« Last post by crnogorac081 on November 27, 2025, 04:34:34 PM »

I agree, if there Is need at some point to put this featured back on , there should be info box at checkbox to Point to vulnerabilitirs (example: this will save your login to this computers, dont check if you Are using publici computers etc..)

56

General Help & Support / Re: Wish list: "Remember me" at login...

« Last post by sternchen8875 on November 27, 2025, 12:17:58 PM »

I understand Uwe's concern, but how I see it, it is up to user weather he will check Remember me or no, of course noone will check remember me in internet cafe computer, and will check on home or office computer.

german
ein kleiner, aber feiner Unterschied...
wenn ich (als Privatperson) für mich, Freunde, Familie oder Kunden am WB etwas ändere, kann ich tun, was immer ich will, solang ich GPL beachte
Bin ich aber verantwortlich für das CMS, muß ich mit einkalkulieren, das User nicht über die Kenntnisse verfügen, die du und ich haben. Ich muß damit rechnen, das ein(e) User(in) nicht weiß, was Remember-me bedeutet und vielleicht auch nicht versteht, was es bewirkt.

Was ich oben schrieb, war meine persönliche, private Meinung. Ich brauche diese Funktion nicht und auch niemand in meinem Bekannten- oder Kundenkreis. Wenn aber das Fehlen solch einer Funktion dazu führt, das Menschen, egal welchen Alters, sich von einem für sie bestimmten Produkt abwenden, weil es ihnen zu kompliziert ist, dann kann ich das natürlich nachvollziehen und möchte da auch gerne helfen.

Als Developer frage ich, ist das eine Sache, die man direkt wieder in das CMS integrieren sollte. Wenn JA,
wird es ähnlich werden wie bei dir. Ich kann es halt direkt in den Core integrieren, das macht es einfacher.

Ist aber nichts, was in drei Tagen fertig ist, denn das hieße: eine neue WB-Version mit allem drum und dran.
Ich habe mich mit CodeALot unterhalten, kenn diese spezielle Problematik in seinem Projekt und hab nun ein Snippet erstellt mit gleichen Anforderungen in Verbindung mit einem Droplet, der Kopie der LoginBox mit geänderten Links usw. Das macht, so finde ich, die Integration leichter

Google translate
A small but important difference...

If I (as a private individual) make changes to the workbook for myself, friends, family, or clients, I can do whatever I want as long as I comply with the GPL.

However, if I'm responsible for the CMS, I have to factor in that users don't have the same level of knowledge as you and me. I have to expect that a user might not know what "Remember-me" means and perhaps not understand its function.

What I wrote above was my personal opinion. I don't need this feature, and neither does anyone in my circle of acquaintances or clients. But if the absence of such a feature leads people of all ages to turn away from a product intended for them because it's too complicated, then I can certainly understand that and would like to help.

As a developer, I'm asking if this is something that should be directly integrated back into the CMS. If so,

it will be similar to your situation. I can integrate it directly into the core, which makes things easier.

But it's not something that can be finished in three days, because that would mean a new WB version with all the bells and whistles.

I talked to CodeALot, I'm familiar with this specific issue in his project, and I've now created a snippet with the same requirements, combined with a droplet, a copy of the login box with modified links, etc. I think that makes the integration easier.

57

General Help & Support / Re: Wish list: "Remember me" at login...

« Last post by crnogorac081 on November 27, 2025, 10:04:57 AM »

This is just a plain example how to make it, im not saying we should or no, or there is or no any better way. This is just a quick suggestion from chatgtp.

I understand Uwe's concern, but how I see it, it is up to user weather he will check Remember me or no, of course noone will check remember me in internet cafe computer, and will check on home or office computer.

58

General Help & Support / Re: Wish list: "Remember me" at login...

« Last post by crnogorac081 on November 26, 2025, 08:09:27 PM »

Managing and Viewing All Remember-Me Tokens (Admin Tools)

This post explains how to extend the RememberMe system so an administrator or user can:

✔ View all login tokens 
✔ See IP address of each session 
✔ See device/browser (user agent) 
✔ See location (optional) 
✔ Delete individual tokens
1. Add Methods to RememberMe.php

A) List all tokens for a user:

Code: [Select]

public function getTokensByUser($user_id)
{
    $stmt = $this->db->prepare("
        SELECT id, selector, hashed_validator, expires, ip, user_agent
        FROM wb_user_tokens
        WHERE user_id = ?
        ORDER BY expires DESC
    ");
    $stmt->execute([$user_id]);
    return $stmt->fetchAll(PDO::FETCH_ASSOC);
}

B) Delete a single token:

Code: [Select]

public function deleteToken($token_id)
{
    $stmt = $this->db->prepare("DELETE FROM wb_user_tokens WHERE id = ?");
    $stmt->execute([$token_id]);
}

C) Optional: Convert IP to Location (Country Lookup):

Code: [Select]

public function getLocationFromIP($ip)
{
    $json = @file_get_contents("https://ipapi.co/{$ip}/json/");
    if ($json === false) {
        return "Unknown";
    }
    $data = json_decode($json, true);
    return $data['country_name'] ?? 'Unknown';
}


2. Example Admin Panel: List All Tokens

Code: [Select]

$tokens = $remember->getTokensByUser($user_id);

foreach ($tokens as $token) {
    echo "Token ID: " . $token['id'] . "<br>";
    echo "Selector: " . $token['selector'] . "<br>";
    echo "IP: " . $token['ip'] . "<br>";
    echo "Location: " . $remember->getLocationFromIP($token['ip']) . "<br>";
    echo "User Agent: " . $token['user_agent'] . "<br>";
    echo "Expires: " . date('Y-m-d H:i:s', $token['expires']) . "<br>";
    echo "<a href='delete_token.php?id={$token['id']}'>Delete Token</a>";
    echo "<hr>";
}


3. Delete Token Script (delete_token.php)

Code: [Select]

require 'RememberMe.php';
$remember = new RememberMe($db);

if (!empty($_GET['id'])) {
    $remember->deleteToken($_GET['id']);
}

header("Location: tokens_list.php");
exit;


Done!

59

General Help & Support / Re: Wish list: "Remember me" at login...

« Last post by crnogorac081 on November 26, 2025, 08:02:07 PM »

Hello,

Here Is how to Building a Secure Multi-Browser “Remember Me” System for WebsiteBaker using Help logic From Chatgtp

To create a **“remember me”** feature that works across **multiple browsers** and **multiple devices**, you should avoid browser fingerprinting (it’s unreliable and violates privacy standards).
The correct modern solution is to use a **persistent login token system** with a secure selector/validator mechanism.

Below is the complete implementation.

---

# **1. Create a Token Table**

Do not use the `remember_key` field in the `users` table.
Each device/browser needs its own token, so create a separate table:

```sql
CREATE TABLE IF NOT EXISTS `{TABLE_PREFIX}user_tokens` (
    `id` int(11) NOT NULL AUTO_INCREMENT,
    `user_id` int(11) NOT NULL,
    `selector` char(16) NOT NULL,
    `hashed_validator` char(64) NOT NULL,
    `expires` int(11) NOT NULL,
    `ip` varchar(45) NOT NULL DEFAULT '',
    `user_agent` varchar(255) NOT NULL DEFAULT '',
    PRIMARY KEY (`id`),
    UNIQUE KEY (`selector`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
```

### Why two token parts?

A secure persistent login uses:

* **selector** → public part
* **validator** → private part (hashed in DB)

Cookie value looks like:

```
selector:validator
```

This prevents token theft/hijacking.

---

# **2. When User Logs In With “Remember Me”**

### (A) Generate token parts:

```php
$selector = bin2hex(random_bytes();
$validator = bin2hex(random_bytes(32));
$hashed_validator = hash('sha256', $validator);
$expires = time() + (86400 * 30); // 30 days
```

### (B) Insert token into database:

```php
$stmt = $db->prepare("INSERT INTO wb_user_tokens
    (user_id, selector, hashed_validator, expires, ip, user_agent)
    VALUES (?, ?, ?, ?, ?, ?)");

$stmt->execute([
    $user_id,
    $selector,
    $hashed_validator,
    $expires,
    $_SERVER['REMOTE_ADDR'],
    $_SERVER['HTTP_USER_AGENT']
]);
```

### (C) Set the cookie:

```php
setcookie(
    "remember_me",
    $selector . ':' . $validator,
    $expires,
    "/",
    "",
    true,  // secure flag
    true   // httpOnly
);
```

This will work on **any browser and any device**.

---

# **3. Auto-Login When User Returns**

### (A) Check if the cookie exists:

```php
if (!empty($_COOKIE['remember_me'])) {
    list($selector, $validator) = explode(':', $_COOKIE['remember_me']);
}
```

### (B) Find the token in database:

```php
$stmt = $db->prepare("SELECT user_id, hashed_validator, expires
    FROM wb_user_tokens
    WHERE selector = ? LIMIT 1");
$stmt->execute([$selector]);
$token = $stmt->fetch();
```

### (C) Validate expiration:

```php
if ($token['expires'] < time()) {
    // Token expired — delete it from DB
}
```

### (D) Validate the validator:

```php
if (hash('sha256', $validator) === $token['hashed_validator']) {
    // SUCCESS — log the user in
}
```

---

# **4. Token Rotation (Highly Recommended)**

After a successful auto-login:

1. Delete the old token
2. Generate and store a new one

This prevents replay attacks and increases security.

---

# **5. Optional: Limit Number of Active Devices**

To allow only the latest 5 devices, delete old ones:

```sql
DELETE FROM wb_user_tokens
WHERE user_id = ?
ORDER BY expires ASC
LIMIT 1;
```

---

# **6. Why Fingerprinting Is Not Recommended**

Browser fingerprinting is:

❌ inconsistent across browsers
❌ unstable (changes frequently)
❌ easily spoofed
❌ a privacy violation (GDPR)

Token-based authentication is the secure industry standard.

---

# **Final Result**

With this implementation you get:

✔ works on **all browsers**
✔ works on **multiple devices**
✔ secure tokens (hashed validators)
✔ based on OWASP security guidelines
✔ flexible — you can limit number of tokens per user

---




Secure Multi-Browser "Remember Me" System for WebsiteBaker

This post contains:
✔ Database table 
✔ Complete explanation 
✔ Full RememberMe.php class 
✔ Login usage example 
✔ Auto-login example 
✔ Logout example 

Everything below is ready for copy/paste.


1. Create the Token Table

Code: [Select]

CREATE TABLE IF NOT EXISTS `wb_user_tokens` (
    `id` int(11) NOT NULL AUTO_INCREMENT,
    `user_id` int(11) NOT NULL,
    `selector` char(16) NOT NULL,
    `hashed_validator` char(64) NOT NULL,
    `expires` int(11) NOT NULL,
    `ip` varchar(45) NOT NULL DEFAULT '',
    `user_agent` varchar(255) NOT NULL DEFAULT '',
    PRIMARY KEY (`id`),
    UNIQUE KEY (`selector`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;


Why selector + validator?

selector = public token 
validator = private token (hashed in DB) 

Stored cookie format:

Code: [Select]

selector:validator


2. RememberMe.php (FULL CLASS)

Code: [Select]

<?php

class RememberMe
{
    private $db;
    private $cookieName = "remember_me";
    private $cookieLifetime = 86400 * 30; // 30 days

    public function __construct($db)
    {
        $this->db = $db;
    }

    public function createToken($user_id)
    {
        $selector = bin2hex(random_bytes(8));
        $validator = bin2hex(random_bytes(32));
        $hashed_validator = hash(&#39;sha256&#39;, $validator);
        $expires = time() + $this->cookieLifetime;

        $stmt = $this->db->prepare("
            INSERT INTO wb_user_tokens (user_id, selector, hashed_validator, expires, ip, user_agent)
            VALUES (?, ?, ?, ?, ?, ?)
        ");

        $stmt->execute([
            $user_id,
            $selector,
            $hashed_validator,
            $expires,
            $_SERVER[&#39;REMOTE_ADDR&#39;] ?? &#39;&#39;,
            $_SERVER[&#39;HTTP_USER_AGENT&#39;] ?? &#39;&#39;
        ]);

        setcookie(
            $this->cookieName,
            $selector . ":" . $validator,
            $expires,
            "/",
            "",
            true,
            true
        );
    }

    public function validateToken()
    {
        if (empty($_COOKIE[$this->cookieName])) {
            return false;
        }

        list($selector, $validator) = explode(":", $_COOKIE[$this->cookieName]);

        $stmt = $this->db->prepare("
            SELECT id, user_id, hashed_validator, expires
            FROM wb_user_tokens
            WHERE selector = ?
            LIMIT 1
        ");
        $stmt->execute([$selector]);
        $token = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$token) {
            return false;
        }

        if ($token[&#39;expires&#39;] < time()) {
            $this->deleteTokenById($token[&#39;id&#39;]);
            return false;
        }

        if (hash(&#39;sha256&#39;, $validator) !== $token[&#39;hashed_validator&#39;]) {
            $this->deleteTokenById($token[&#39;id&#39;]);
            return false;
        }

        $this->deleteTokenById($token[&#39;id&#39;]);
        $this->createToken($token[&#39;user_id&#39;]);

        return $token[&#39;user_id&#39;];
    }

    private function deleteTokenById($id)
    {
        $stmt = $this->db->prepare("DELETE FROM wb_user_tokens WHERE id = ?");
        $stmt->execute([$id]);
    }

    public function deleteTokensByUser($user_id)
    {
        $stmt = $this->db->prepare("DELETE FROM wb_user_tokens WHERE user_id = ?");
        $stmt->execute([$user_id]);

        setcookie($this->cookieName, "", time() - 3600, "/", "", true, true);
    }
}
?>


3. Login Script Example (with remember me)

Code: [Select]

require 'RememberMe.php';
$remember = new RememberMe($db);

if ($login_successful) {

    if (!empty($_POST['remember_me'])) {
        $remember->createToken($user_id);
    }

    $_SESSION['user_id'] = $user_id;
    // redirect to dashboard...
}


4. Auto-Login on Every Page (init.php)

Code: [Select]

require 'RememberMe.php';
$remember = new RememberMe($db);

if (empty($_SESSION['user_id'])) {
    $user_id = $remember->validateToken();
    if ($user_id !== false) {
        $_SESSION['user_id'] = $user_id;
    }
}


5. Logout (remove all tokens)

Code: [Select]

$remember = new RememberMe($db);
$remember->deleteTokensByUser($_SESSION['user_id']);
session_destroy();


Done!

This system supports:
✔ Multiple browsers 
✔ Multiple devices 
✔ Secure hashed tokens 
✔ Automatic token rotation 
✔ OWASP-compliant persistent login 
[/code]

60

General Help & Support / Re: Wish list: "Remember me" at login...

« Last post by CodeALot on November 25, 2025, 02:09:50 PM »

(German translation by AI
Ich weiß Ihre Antwort sehr zu schätzen und stimme Ihnen in vielen Punkten zu... ABER

Ich habe einen Grund, warum ich mir die Funktion „Angemeldet bleiben” in WB wünsche.
Ich habe eine Website für eine sehr spezifische geschlossene Community erstellt, in der jede Person ihren eigenen Login hat. Die Website ist für Personen außerhalb der Community in keiner Weise zugänglich. Alle Nutzer sind ältere Menschen, die nicht mit verschiedenen Browsern arbeiten, und die meisten von ihnen haben keine Ahnung von der automatischen Passwortspeicherung in Chrome, zum Beispiel.
Alle Nutzer arbeiten mit einem Smartphone oder PC, und das war's. Keine anderen Personen dürfen ihre Geräte benutzen, und selbst wenn dies der Fall wäre, würden diese Personen ohnehin derselben Community angehören und die gleichen Zugriffsrechte haben. Es finden keine finanziellen Transaktionen statt, es gibt keinen Nachrichtenaustausc h zwischen den Nutzern.

Das einzige Problem ist: Damit diese Website erfolgreich ist, muss ich sicherstellen, dass die Nutzer so einfach wie möglich darauf zugreifen können. Die gesamte Website MUSS zwar hinter einem Login liegen, aber das macht es gleichzeitig für einen 93-Jährigen (zum Beispiel) „schwieriger”, die Website zu nutzen. (Sie haben ihr Passwort nicht gespeichert, sie haben ihr Passwort vergessen usw.)

Daher wäre „Angemeldet bleiben” eine tolle Funktion. Einmal anmelden und fertig.

Mir ist klar, dass diese Funktion nur einer ganz bestimmten Gruppe von Website-Betreibern/-Erstellern zugute kommen würde. Aber fragen kostet nichts, oder?

---------------------------------------------------------------
I absolutely appreciate your reply and agree on many things you said... BUT

I do have a reason to want the 'remember me' functionality in WB.
I built a website for a very specific closed community, where every person has his/her own login. The website is in no way accessible for people outside the community. All users are elderly people who do not work with different browsers and most of them have no idea about automatic password storage in Chrome, for instance.
All users work with a smartphone or PC and that's it. No other people get to use their devices and even if that would happen, these people will belong to the same community and have the same access priviliges anyway. No financial transactions are made, no messages between users.

The only thing is: To have this website succeed, I have to make sure the users can access it as easy as possible. So while the whole website HAS to be behind a login, this at the same time makes it "more difficult" for a 93-year old (for example) to use the website. (They haven't stored their password, they forgot their password, etc.)

So: "Remember me" would be great. Log in once, and that's it.

I do realize that this feature would only benefit a very specific group of site-owners/builders. Then again: can't hurt to ask, right?