pguzman
9622f9aeca
Six fixes from a codebase review: - Consolidate the ad hoc install.php + migrate_v2..v6.php chain into one canonical schema.sql (structure reference) plus a simplified install.php that creates all tables and seeds site_settings, the superadmin account, and the standard prayer library. The six migrate_v*.php scripts are deleted — their cumulative effect is now fully captured in schema.sql. - Delete the two root-level setup.php/novena_group.php files that existed only to redirect to their admin/ equivalents of the same name; confirmed unreferenced by any link or .htaccess rule. - Decouple includes/build_slides.php from data/prayers.php's implicit `global $opening, $mysteries, ...` contract. data/prayers.php now explicitly returns its arrays; build_slides.php loads them through a small memoized get_prayer_data() and destructures them by key. - Add CSRF protection (includes/csrf.php: csrf_token/csrf_field/csrf_verify) across every POST-handling endpoint — 10 form pages and 7 API endpoints — plus token wiring in the JS/inline scripts that call the FormData- and JSON-body API endpoints (builder.js, setup.js, and the inline scripts in admin/audio.php, admin/novena_group.php, and index.php). - Stop round-tripping the SMTP password in plaintext through the settings form: the field now renders blank with a "currently set" hint, and a blank submission leaves the stored password unchanged instead of clearing it. - Add login rate-limiting: users.failed_login_attempts / locked_until columns, is_locked_out()/record_login_failure()/record_login_success() helpers in includes/auth.php, and lockout handling in login.php (5 failed attempts locks the account for 15 minutes). README documents the one manual ALTER TABLE needed to add these columns to an existing production database. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
105 lines
4.2 KiB
PHP
105 lines
4.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/config/db.php';
|
|
require_once __DIR__ . '/includes/auth.php';
|
|
require_once __DIR__ . '/includes/csrf.php';
|
|
|
|
_auth_start();
|
|
|
|
// Already logged in
|
|
if (!empty($_SESSION['user_id'])) {
|
|
header('Location: ' . BASE_URL . '/admin/');
|
|
exit;
|
|
}
|
|
|
|
$error = '';
|
|
$username = '';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
csrf_verify();
|
|
$username = trim($_POST['username'] ?? '');
|
|
$password = $_POST['password'] ?? '';
|
|
|
|
if ($username === '' || $password === '') {
|
|
$error = 'Please enter your username/email and password.';
|
|
} else {
|
|
$pdo = get_pdo();
|
|
// Allow login by username OR email
|
|
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = ? OR email = ? LIMIT 1');
|
|
$stmt->execute([$username, $username]);
|
|
$user = $stmt->fetch();
|
|
|
|
if ($user && is_locked_out($user)) {
|
|
$mins = login_lockout_minutes_remaining($user);
|
|
$error = "Too many failed login attempts. Please try again in {$mins} minute" . ($mins === 1 ? '' : 's') . '.';
|
|
} elseif (!$user || !password_verify($password, $user['password_hash'])) {
|
|
if ($user) record_login_failure((int)$user['id']);
|
|
$error = 'Invalid username or password.';
|
|
} elseif (!$user['email_confirmed']) {
|
|
$error = 'Please confirm your email address before logging in. Check your inbox for the confirmation link.';
|
|
} else {
|
|
record_login_success((int)$user['id']);
|
|
session_regenerate_id(true);
|
|
$_SESSION['user_id'] = $user['id'];
|
|
$_SESSION['username'] = $user['username'];
|
|
$_SESSION['email'] = $user['email'];
|
|
$_SESSION['role'] = $user['role'];
|
|
$_SESSION['display_name'] = $user['display_name'] ?? $user['username'];
|
|
$_SESSION['rosary_limit'] = (int)$user['rosary_limit'];
|
|
header('Location: ' . BASE_URL . '/admin/');
|
|
exit;
|
|
}
|
|
}
|
|
}
|
|
|
|
$confirmed_msg = isset($_GET['confirmed']) ? 'Email confirmed! You can now log in.' : '';
|
|
$reset_msg = isset($_GET['reset']) ? 'Password reset successfully. Please log in.' : '';
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<link rel="icon" type="image/svg+xml" href="<?= BASE_URL ?>/favicon.svg">
|
|
<title>Login — <?= htmlspecialchars(get_setting('site_name', APP_NAME)) ?></title>
|
|
<link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/setup.css">
|
|
</head>
|
|
<body class="login-page">
|
|
<div class="login-box">
|
|
<h1>✝ <?= htmlspecialchars(get_setting('site_name', APP_NAME)) ?></h1>
|
|
<h2>Sign In</h2>
|
|
|
|
<?php if ($confirmed_msg): ?>
|
|
<div class="alert alert-success"><?= htmlspecialchars($confirmed_msg) ?></div>
|
|
<?php endif; ?>
|
|
<?php if ($reset_msg): ?>
|
|
<div class="alert alert-success"><?= htmlspecialchars($reset_msg) ?></div>
|
|
<?php endif; ?>
|
|
<?php if ($error): ?>
|
|
<div class="alert alert-error"><?= htmlspecialchars($error) ?></div>
|
|
<?php endif; ?>
|
|
|
|
<form method="post" action="<?= BASE_URL ?>/login">
|
|
<?= csrf_field() ?>
|
|
<div class="form-group">
|
|
<label for="username">Username or Email</label>
|
|
<input type="text" id="username" name="username"
|
|
value="<?= htmlspecialchars($username) ?>"
|
|
autocomplete="username" autofocus required>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="password">Password</label>
|
|
<input type="password" id="password" name="password"
|
|
autocomplete="current-password" required>
|
|
</div>
|
|
<button type="submit" class="btn btn-primary btn-full">Sign In</button>
|
|
</form>
|
|
|
|
<div style="margin-top:20px;text-align:center;font-size:14px;color:#6b7280">
|
|
<a href="<?= BASE_URL ?>/forgot-password" style="color:#1e3a5f">Forgot password?</a>
|
|
•
|
|
<a href="<?= BASE_URL ?>/register" style="color:#1e3a5f">Create an account</a>
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html>
|