345 lines
10 KiB
PHP
345 lines
10 KiB
PHP
<?php
|
|
// -------------------- Secure session cookie params (before session_start) --------------------
|
|
$secure = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
|
|
|
|
session_set_cookie_params([
|
|
'lifetime' => 0, // Session-Cookie (endet mit Browser), Remember-me macht "lang"
|
|
'path' => '/',
|
|
'domain' => '',
|
|
'secure' => $secure,
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
|
|
session_start();
|
|
|
|
require_once "config/config.php";
|
|
|
|
// -------------------- Auto-Login via remember cookie (if no session) + ROTATION --------------------
|
|
if ((!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true) && !empty($_COOKIE['remember'])) {
|
|
try {
|
|
// optional housekeeping
|
|
$pdo->exec("DELETE FROM remember_tokens WHERE expires_at < NOW()");
|
|
|
|
$oldToken = (string)$_COOKIE['remember'];
|
|
$oldHash = hash('sha256', $oldToken);
|
|
|
|
$stmt = $pdo->prepare("
|
|
SELECT rt.id AS token_id,
|
|
rt.user_id,
|
|
UNIX_TIMESTAMP(rt.expires_at) AS exp,
|
|
u.username, u.name, u.role
|
|
FROM remember_tokens rt
|
|
JOIN users u ON u.id = rt.user_id
|
|
WHERE rt.token_hash = :th
|
|
LIMIT 1
|
|
");
|
|
$stmt->execute([':th' => $oldHash]);
|
|
$row = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if ($row && (int)$row['exp'] > time()) {
|
|
// ✅ valid token -> log in
|
|
session_regenerate_id(true);
|
|
|
|
$_SESSION["loggedin"] = true;
|
|
$_SESSION["id"] = (int)$row["user_id"];
|
|
$_SESSION["username"] = $row["username"];
|
|
$_SESSION["name"] = $row["name"];
|
|
$_SESSION["role"] = $row["role"];
|
|
|
|
// last_login auch bei Auto-Login aktualisieren
|
|
$upd = $pdo->prepare("UPDATE users SET last_login = :ts WHERE id = :id");
|
|
$upd->execute([
|
|
':ts' => time(),
|
|
':id' => (int)$row['user_id']
|
|
]);
|
|
|
|
|
|
// ✅ TOKEN ROTATION: replace old token with a fresh one & extend expiry to 7 days
|
|
$newToken = bin2hex(random_bytes(32));
|
|
$newHash = hash('sha256', $newToken);
|
|
$newExp = time() + 7 * 24 * 60 * 60; // 7 days
|
|
|
|
$pdo->beginTransaction();
|
|
try {
|
|
// Update the existing token row (keeps 1 token per "cookie session")
|
|
$upd = $pdo->prepare("
|
|
UPDATE remember_tokens
|
|
SET token_hash = :new_hash,
|
|
expires_at = FROM_UNIXTIME(:exp)
|
|
WHERE id = :tid
|
|
LIMIT 1
|
|
");
|
|
$upd->execute([
|
|
':new_hash' => $newHash,
|
|
':exp' => $newExp,
|
|
':tid' => (int)$row['token_id'],
|
|
]);
|
|
|
|
$pdo->commit();
|
|
} catch (Throwable $e) {
|
|
$pdo->rollBack();
|
|
// If rotation fails, fail closed-ish:
|
|
// We'll still keep the session (user is in), but we remove cookie to avoid loops.
|
|
setcookie('remember', '', [
|
|
'expires' => time() - 3600,
|
|
'path' => '/',
|
|
'secure' => $secure,
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
header("location: dashboard.php");
|
|
exit;
|
|
}
|
|
|
|
// Set new cookie
|
|
setcookie('remember', $newToken, [
|
|
'expires' => $newExp,
|
|
'path' => '/',
|
|
'secure' => $secure,
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
|
|
header("location: dashboard.php");
|
|
exit;
|
|
} else {
|
|
// invalid/expired token -> delete cookie
|
|
setcookie('remember', '', [
|
|
'expires' => time() - 3600,
|
|
'path' => '/',
|
|
'secure' => $secure,
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
}
|
|
} catch (Throwable $e) {
|
|
// fail closed (do nothing, user stays logged out)
|
|
}
|
|
}
|
|
|
|
// If already logged in -> go dashboard
|
|
if (isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true) {
|
|
header("location: dashboard.php");
|
|
exit;
|
|
}
|
|
|
|
$username = $password = "";
|
|
$username_err = $password_err = "";
|
|
|
|
if ($_SERVER["REQUEST_METHOD"] === "POST") {
|
|
|
|
// Username prüfen
|
|
if (empty(trim($_POST["username"] ?? ""))) {
|
|
$username_err = "Bitte Username eingeben.";
|
|
} else {
|
|
$username = trim((string)$_POST["username"]);
|
|
}
|
|
|
|
$password = (string)($_POST["password"] ?? "");
|
|
|
|
if (empty($username_err) && empty($password_err)) {
|
|
|
|
$sql = "
|
|
SELECT *
|
|
FROM users
|
|
WHERE username = :username
|
|
LIMIT 1
|
|
";
|
|
|
|
$stmt = $pdo->prepare($sql);
|
|
$stmt->bindParam(":username", $username, PDO::PARAM_STR);
|
|
|
|
if ($stmt->execute()) {
|
|
|
|
if ($stmt->rowCount() === 1) {
|
|
|
|
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
$hash = $user['password_hash'] ?? '';
|
|
$first = (int)($user['first_login'] ?? 0);
|
|
|
|
// 1️⃣ Nur wenn wirklich First Login ODER kein Hash vorhanden
|
|
if ($first === 1 || empty($hash)) {
|
|
$_SESSION['set_pw_user'] = (int)$user['id'];
|
|
header("location: set_password.php");
|
|
exit;
|
|
}
|
|
|
|
// 2️⃣ Passwort prüfen
|
|
if (!password_verify($password, $hash)) {
|
|
$password_err = "Falsches Passwort.";
|
|
} else {
|
|
|
|
session_regenerate_id(true);
|
|
|
|
$_SESSION["loggedin"] = true;
|
|
$_SESSION["id"] = (int)$user["id"];
|
|
$_SESSION["username"] = $user["username"];
|
|
$_SESSION["name"] = $user["name"];
|
|
$_SESSION["role"] = $user["role"];
|
|
|
|
// Remember-me (7 Tage), nur wenn Checkbox gesetzt
|
|
if (!empty($_POST['remember'])) {
|
|
$token = bin2hex(random_bytes(32));
|
|
$tokenHash = hash('sha256', $token);
|
|
$expires = time() + 7 * 24 * 60 * 60; // 7 days
|
|
|
|
// optional housekeeping
|
|
$pdo->exec("DELETE FROM remember_tokens WHERE expires_at < NOW()");
|
|
|
|
$ins = $pdo->prepare("
|
|
INSERT INTO remember_tokens (user_id, token_hash, expires_at)
|
|
VALUES (:uid, :th, FROM_UNIXTIME(:exp))
|
|
");
|
|
$ins->execute([
|
|
':uid' => (int)$user['id'],
|
|
':th' => $tokenHash,
|
|
':exp' => $expires
|
|
]);
|
|
|
|
setcookie('remember', $token, [
|
|
'expires' => $expires,
|
|
'path' => '/',
|
|
'secure' => $secure,
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
]);
|
|
}
|
|
|
|
// last_login setzen
|
|
$upd = $pdo->prepare("UPDATE users SET last_login = :ts WHERE id = :id");
|
|
$upd->execute([
|
|
':ts' => time(),
|
|
':id' => (int)$user['id']
|
|
]);
|
|
|
|
header("location: dashboard.php");
|
|
exit;
|
|
}
|
|
|
|
} else {
|
|
$username_err = "Dieser Benutzer existiert nicht.";
|
|
}
|
|
|
|
} else {
|
|
echo "Fehler. Bitte später erneut versuchen.";
|
|
}
|
|
}
|
|
}
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<title>ANJUMA Login</title>
|
|
|
|
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
|
|
|
|
<style>
|
|
body {
|
|
background: #ffffff;
|
|
height: 100vh;
|
|
display: flex;
|
|
justify-content: center;
|
|
align-items: center;
|
|
font-family: 'Segoe UI', sans-serif;
|
|
margin: 0;
|
|
overflow-x: hidden;
|
|
}
|
|
|
|
.login-card {
|
|
width: 90%;
|
|
max-width: 380px;
|
|
background: #fff;
|
|
border-radius: 16px;
|
|
padding: 30px;
|
|
box-shadow: 0 6px 25px rgba(0,0,0,0.08);
|
|
text-align: center;
|
|
animation: fadeIn 0.4s ease-out;
|
|
border: 1px solid #f1f1f1;
|
|
}
|
|
|
|
.login-logo {
|
|
width: 200px;
|
|
max-width: 100%;
|
|
margin-bottom: 12px;
|
|
}
|
|
|
|
@media (max-width: 480px) {
|
|
.login-card { padding: 22px; }
|
|
h4 { font-size: 1.2rem; }
|
|
.btn-login { padding: 10px; font-size: 15px; }
|
|
}
|
|
|
|
.form-control {
|
|
border-radius: 10px;
|
|
padding: 12px;
|
|
border: 1px solid #dcdcdc;
|
|
font-size: 15px;
|
|
}
|
|
|
|
.form-control:focus {
|
|
border-color: #0d6efd;
|
|
box-shadow: 0 0 0 2px rgba(13,110,253,0.15);
|
|
}
|
|
|
|
.btn-login {
|
|
width: 100%;
|
|
padding: 12px;
|
|
border-radius: 10px;
|
|
font-size: 16px;
|
|
background: #0d6efd;
|
|
color: white;
|
|
font-weight: 600;
|
|
transition: 0.2s;
|
|
}
|
|
|
|
.btn-login:hover {
|
|
background: #0b5ed7;
|
|
transform: translateY(-2px);
|
|
}
|
|
|
|
.error {
|
|
color: #d9534f;
|
|
font-size: 0.85rem;
|
|
margin-top: 4px;
|
|
text-align: left;
|
|
}
|
|
</style>
|
|
</head>
|
|
|
|
<body>
|
|
<div class="login-card">
|
|
|
|
<img src="ANJUMA_LOGO.png" class="login-logo" alt="ANJUMA Logo">
|
|
|
|
<h4 class="mb-3">Willkommen zurück</h4>
|
|
|
|
<form action="" method="post">
|
|
|
|
<div class="text-start mb-3">
|
|
<label class="mb-1">Username</label>
|
|
<input type="text" name="username" class="form-control"
|
|
value="<?php echo htmlspecialchars($username, ENT_QUOTES, 'UTF-8'); ?>">
|
|
<?php if (!empty($username_err)) echo "<div class='error'>".htmlspecialchars($username_err, ENT_QUOTES, 'UTF-8')."</div>"; ?>
|
|
</div>
|
|
|
|
<div class="text-start mb-2">
|
|
<label class="mb-1">Passwort</label>
|
|
<input type="password" name="password" class="form-control">
|
|
<?php if (!empty($password_err)) echo "<div class='error'>".htmlspecialchars($password_err, ENT_QUOTES, 'UTF-8')."</div>"; ?>
|
|
</div>
|
|
|
|
<div class="form-check text-start mb-4">
|
|
<input class="form-check-input" type="checkbox" name="remember" id="remember" value="1" checked>
|
|
<label class="form-check-label" for="remember">Angemeldet bleiben</label>
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-login">Einloggen</button>
|
|
|
|
</form>
|
|
</div>
|
|
</body>
|
|
</html>
|