WKVS_gitea/WKVS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WKVS v 1.0.0

Browse Source
This commit is contained in:
Fabio Herzig
2026-07-24 21:49:40 +02:00
commit 6cb5386205
469 changed files with 76191 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/login/login.php
+173
View File
@@ -0,0 +1,173 @@
<?php
require_once __DIR__ . '/../rate-limiter/rate-limiter.php';
$limiter = new TokenBucket(
redis: $redis,
capacity: 30,
refillRate: 2,
refillInterval: 5.0
);
$result = $limiter->allow('RATE_LIMITER:TYPE:login:IP:'. $_SERVER['REMOTE_ADDR']);
if (!$result['allowed']) {
http_response_code(429);
include __DIR__ . "/../../www/error-pages/429.html";
exit;
}
require_once __DIR__ . '/../session_functions.php';
ini_wkvs_session();
if (!isset($error)) {
$error = '';
}
// Initialize session variables if not set
if (!isset($_SESSION['login_attempts_'. $logintype])) {
$_SESSION['login_attempts_'. $logintype] = 0;
$_SESSION['lockout_time_'. $logintype] = 0;
}
$max_attempts = 5;
$lockout_period = 5 * 60;
// Check if user is locked out
if ($_SESSION['lockout_time_'. $logintype] > time()) {
$remaining = $_SESSION['lockout_time_'. $logintype] - time();
$minutes = ceil($remaining / 60);
$error = "Zu viele fehlgeschlagene Anmeldeversuche. Bitte warte $minutes Minute(n).";
} elseif (isset($_POST[$logintype.'_login_submit'])) {
require __DIR__ .'/../db/db-verbindung-script-guest.php';
require __DIR__ . "/../db/db-tables.php";
$username = htmlspecialchars(trim($_POST['access_username']), ENT_QUOTES);
$password = trim($_POST['access_passcode']);
// Prepare statement
$stmt = $guest->prepare("SELECT * FROM $db_tabelle_intern_benutzende WHERE username = ? AND login_active = ? LIMIT 1");
$loginActive = 1;
$stmt->bind_param("ss", $username, $loginActive);
$stmt->execute();
$result = $stmt->get_result();
$user = $result->fetch_assoc();
if (!$user) {
$_SESSION['login_attempts_'. $logintype]++;
if ($_SESSION['login_attempts_'. $logintype] >= $max_attempts) {
$_SESSION['lockout_time_'. $logintype] = time() + $lockout_period;
$error = "Zu viele fehlgeschlagene Anmeldeversuche. Bitte versuche es in ".ceil($lockout_period / 60)." Minuten erneut.";
} else {
$remaining_attempts = $max_attempts - $_SESSION['login_attempts_'. $logintype];
$error = "Benutzer / Passwort unbekannt. Noch $remaining_attempts Versuch(e) möglich.";
}
} else {
$freigaben = json_decode($user['freigabe'], true) ?: [];
$freigabe_values = $freigaben['types'] ?? [];
// Verify password using PHP native function
if (password_verify($password, $user['password_hash']) && in_array($logintype, $freigabe_values)) {
foreach ($freigabe_values as $freigabe) {
$_SESSION['access_granted_'. $freigabe] = true;
$_SESSION['user_id_'. $freigabe] = $user['id'];
$_SESSION['lockout_time_'. $freigabe] = 0;
$_SESSION['login_attempts_'. $freigabe] = 0;
}
// Redirect using plain PHP
header("Location:" . $_SERVER['REQUEST_URI']);
exit;
} elseif ($password === ' ') {
$error = "Kein Passwort eingegeben.";
} else {
$_SESSION['login_attempts_'. $logintype]++;
if ($_SESSION['login_attempts_'. $logintype] >= $max_attempts) {
$_SESSION['lockout_time_'. $logintype] = time() + $lockout_period;
$error = "Zu viele fehlgeschlagene Anmeldeversuche. Bitte versuche es in ".ceil($lockout_period / 60)." Minuten erneut.";
} else {
$remaining_attempts = $max_attempts - $_SESSION['login_attempts_'. $logintype];
$error = "Benutzer / Passwort unbekannt. Noch $remaining_attempts Versuch(e) möglich.";
}
}
}
}
$array_logintitles = [
'wk_leitung' => 'Wettkampfleitung',
'trainer' => 'Trainer',
'kampfrichter' => 'Kampfrichter'
]
?>
<!DOCTYPE html>
<html lang="de">
<head>
<meta charset="utf-8">
<title>Login <?= $array_logintitles[$logintype] ?></title>
<link rel="icon" type="png" href="/intern/img/icon.png">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" href="/intern/css/login.css">
<link href="/files/fonts/fonts.css" rel="stylesheet">
<link rel="stylesheet" href="/intern/css/user.css">
</head>
<body class="login">
<section class="page-secure-login">
<div class="bg-picture-secure-login">
<img src="/intern/img/login/bg<?= ucfirst($logintype) ?>.webp">
</div>
<div class="bg-secure-login">
<div class="bg-secure-login-form">
<h1>Anmeldung<br><?= $array_logintitles[$logintype] ?? "" ?></h1>
<form method="post">
<label for="access_username">Benutzername eingeben</label><br>
<input type="text" id="access_username" name="access_username" required placeholder="Benutzername"><br>
<label for="password">Passwort eingeben</label><br>
<div id="div_showpw">
<input type="password" name="access_passcode" id="access_passcode" placeholder="Passwort" required>
<button type="button" id="togglePassword">
<svg id="eyeIcon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/>
<circle cx="12" cy="12" r="3"/>
</svg>
</button>
</div>
<input type="submit" name="<?= $logintype ?>_login_submit" value="Einloggen">
</form>
<?php if ($error !== ''): ?>
<p style="color:red;"><?php echo $error; ?></p>
<?php endif; ?>
</div>
</div>
</section>
<a class="seclog_home_link" href="/"><img src="/intern/img/logo-normal.png"></a>
<script>
const passwordInput = document.getElementById('access_passcode');
const toggleButton = document.getElementById('togglePassword');
const eyeIcon = document.getElementById('eyeIcon');
toggleButton.addEventListener('click', () => {
const type = passwordInput.getAttribute('type') === 'password' ? 'text' : 'password';
passwordInput.setAttribute('type', type);
if (type === 'password') {
eyeIcon.innerHTML = '<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
} else {
eyeIcon.innerHTML = '<path d="M17.94 17.94L6.06 6.06"/><path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
}
});
</script>
</body>