xBeaTz/anjuma-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
xBeaTz
2026-07-22 01:12:45 +02:00
commit 124f2746ac
357 changed files with 159669 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
index.php
+344
View File
@@ -0,0 +1,344 @@
<?php
// -------------------- Secure session cookie params (before session_start) --------------------
$secure = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
session_set_cookie_params([
'lifetime' => 0, // Session-Cookie (endet mit Browser), Remember-me macht "lang"
'path' => '/',
'domain' => '',
'secure' => $secure,
'httponly' => true,
'samesite' => 'Lax',
]);
session_start();
require_once "config/config.php";
// -------------------- Auto-Login via remember cookie (if no session) + ROTATION --------------------
if ((!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true) && !empty($_COOKIE['remember'])) {
try {
// optional housekeeping
$pdo->exec("DELETE FROM remember_tokens WHERE expires_at < NOW()");
$oldToken = (string)$_COOKIE['remember'];
$oldHash = hash('sha256', $oldToken);
$stmt = $pdo->prepare("
SELECT rt.id AS token_id,
rt.user_id,
UNIX_TIMESTAMP(rt.expires_at) AS exp,
u.username, u.name, u.role
FROM remember_tokens rt
JOIN users u ON u.id = rt.user_id
WHERE rt.token_hash = :th
LIMIT 1
");
$stmt->execute([':th' => $oldHash]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);
if ($row && (int)$row['exp'] > time()) {
// ✅ valid token -> log in
session_regenerate_id(true);
$_SESSION["loggedin"] = true;
$_SESSION["id"] = (int)$row["user_id"];
$_SESSION["username"] = $row["username"];
$_SESSION["name"] = $row["name"];
$_SESSION["role"] = $row["role"];
// last_login auch bei Auto-Login aktualisieren
$upd = $pdo->prepare("UPDATE users SET last_login = :ts WHERE id = :id");
$upd->execute([
':ts' => time(),
':id' => (int)$row['user_id']
]);
// ✅ TOKEN ROTATION: replace old token with a fresh one & extend expiry to 7 days
$newToken = bin2hex(random_bytes(32));
$newHash = hash('sha256', $newToken);
$newExp = time() + 7 * 24 * 60 * 60; // 7 days
$pdo->beginTransaction();
try {
// Update the existing token row (keeps 1 token per "cookie session")
$upd = $pdo->prepare("
UPDATE remember_tokens
SET token_hash = :new_hash,
expires_at = FROM_UNIXTIME(:exp)
WHERE id = :tid
LIMIT 1
");
$upd->execute([
':new_hash' => $newHash,
':exp' => $newExp,
':tid' => (int)$row['token_id'],
]);
$pdo->commit();
} catch (Throwable $e) {
$pdo->rollBack();
// If rotation fails, fail closed-ish:
// We'll still keep the session (user is in), but we remove cookie to avoid loops.
setcookie('remember', '', [
'expires' => time() - 3600,
'path' => '/',
'secure' => $secure,
'httponly' => true,
'samesite' => 'Lax',
]);
header("location: dashboard.php");
exit;
}
// Set new cookie
setcookie('remember', $newToken, [
'expires' => $newExp,
'path' => '/',
'secure' => $secure,
'httponly' => true,
'samesite' => 'Lax',
]);
header("location: dashboard.php");
exit;
} else {
// invalid/expired token -> delete cookie
setcookie('remember', '', [
'expires' => time() - 3600,
'path' => '/',
'secure' => $secure,
'httponly' => true,
'samesite' => 'Lax',
]);
}
} catch (Throwable $e) {
// fail closed (do nothing, user stays logged out)
}
}
// If already logged in -> go dashboard
if (isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true) {
header("location: dashboard.php");
exit;
}
$username = $password = "";
$username_err = $password_err = "";
if ($_SERVER["REQUEST_METHOD"] === "POST") {
// Username prüfen
if (empty(trim($_POST["username"] ?? ""))) {
$username_err = "Bitte Username eingeben.";
} else {
$username = trim((string)$_POST["username"]);
}
$password = (string)($_POST["password"] ?? "");
if (empty($username_err) && empty($password_err)) {
$sql = "
SELECT *
FROM users
WHERE username = :username
LIMIT 1
";
$stmt = $pdo->prepare($sql);
$stmt->bindParam(":username", $username, PDO::PARAM_STR);
if ($stmt->execute()) {
if ($stmt->rowCount() === 1) {
$user = $stmt->fetch(PDO::FETCH_ASSOC);
$hash = $user['password_hash'] ?? '';
$first = (int)($user['first_login'] ?? 0);
// 1️⃣ Nur wenn wirklich First Login ODER kein Hash vorhanden
if ($first === 1 || empty($hash)) {
$_SESSION['set_pw_user'] = (int)$user['id'];
header("location: set_password.php");
exit;
}
// 2️⃣ Passwort prüfen
if (!password_verify($password, $hash)) {
$password_err = "Falsches Passwort.";
} else {
session_regenerate_id(true);
$_SESSION["loggedin"] = true;
$_SESSION["id"] = (int)$user["id"];
$_SESSION["username"] = $user["username"];
$_SESSION["name"] = $user["name"];
$_SESSION["role"] = $user["role"];
// Remember-me (7 Tage), nur wenn Checkbox gesetzt
if (!empty($_POST['remember'])) {
$token = bin2hex(random_bytes(32));
$tokenHash = hash('sha256', $token);
$expires = time() + 7 * 24 * 60 * 60; // 7 days
// optional housekeeping
$pdo->exec("DELETE FROM remember_tokens WHERE expires_at < NOW()");
$ins = $pdo->prepare("
INSERT INTO remember_tokens (user_id, token_hash, expires_at)
VALUES (:uid, :th, FROM_UNIXTIME(:exp))
");
$ins->execute([
':uid' => (int)$user['id'],
':th' => $tokenHash,
':exp' => $expires
]);
setcookie('remember', $token, [
'expires' => $expires,
'path' => '/',
'secure' => $secure,
'httponly' => true,
'samesite' => 'Lax',
]);
}
// last_login setzen
$upd = $pdo->prepare("UPDATE users SET last_login = :ts WHERE id = :id");
$upd->execute([
':ts' => time(),
':id' => (int)$user['id']
]);
header("location: dashboard.php");
exit;
}
} else {
$username_err = "Dieser Benutzer existiert nicht.";
}
} else {
echo "Fehler. Bitte später erneut versuchen.";
}
}
}
?>
<!DOCTYPE html>
<html lang="de">
<head>
<meta charset="UTF-8">
<title>ANJUMA Login</title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
<style>
body {
background: #ffffff;
height: 100vh;
display: flex;
justify-content: center;
align-items: center;
font-family: 'Segoe UI', sans-serif;
margin: 0;
overflow-x: hidden;
}
.login-card {
width: 90%;
max-width: 380px;
background: #fff;
border-radius: 16px;
padding: 30px;
box-shadow: 0 6px 25px rgba(0,0,0,0.08);
text-align: center;
animation: fadeIn 0.4s ease-out;
border: 1px solid #f1f1f1;
}
.login-logo {
width: 200px;
max-width: 100%;
margin-bottom: 12px;
}
@media (max-width: 480px) {
.login-card { padding: 22px; }
h4 { font-size: 1.2rem; }
.btn-login { padding: 10px; font-size: 15px; }
}
.form-control {
border-radius: 10px;
padding: 12px;
border: 1px solid #dcdcdc;
font-size: 15px;
}
.form-control:focus {
border-color: #0d6efd;
box-shadow: 0 0 0 2px rgba(13,110,253,0.15);
}
.btn-login {
width: 100%;
padding: 12px;
border-radius: 10px;
font-size: 16px;
background: #0d6efd;
color: white;
font-weight: 600;
transition: 0.2s;
}
.btn-login:hover {
background: #0b5ed7;
transform: translateY(-2px);
}
.error {
color: #d9534f;
font-size: 0.85rem;
margin-top: 4px;
text-align: left;
}
</style>
</head>
<body>
<div class="login-card">
<img src="ANJUMA_LOGO.png" class="login-logo" alt="ANJUMA Logo">
<h4 class="mb-3">Willkommen zurück</h4>
<form action="" method="post">
<div class="text-start mb-3">
<label class="mb-1">Username</label>
<input type="text" name="username" class="form-control"
value="<?php echo htmlspecialchars($username, ENT_QUOTES, 'UTF-8'); ?>">
<?php if (!empty($username_err)) echo "<div class='error'>".htmlspecialchars($username_err, ENT_QUOTES, 'UTF-8')."</div>"; ?>
</div>
<div class="text-start mb-2">
<label class="mb-1">Passwort</label>
<input type="password" name="password" class="form-control">
<?php if (!empty($password_err)) echo "<div class='error'>".htmlspecialchars($password_err, ENT_QUOTES, 'UTF-8')."</div>"; ?>
</div>
<div class="form-check text-start mb-4">
<input class="form-check-input" type="checkbox" name="remember" id="remember" value="1" checked>
<label class="form-check-label" for="remember">Angemeldet bleiben</label>
</div>
<button type="submit" class="btn btn-login">Einloggen</button>
</form>
</div>
</body>
</html>