First version, for githup; UNSTABLE, DO NOT USE!
This commit is contained in:
Fabio Herzig
433
www/intern/otlogin.php
Normal file
433
www/intern/otlogin.php
Normal file
@@ -0,0 +1,433 @@
|
||||
<?php
|
||||
|
||||
ini_set('display_errors', 1);
|
||||
ini_set('display_startup_errors', 1);
|
||||
error_reporting(E_ALL);
|
||||
|
||||
use Dotenv\Dotenv;
|
||||
|
||||
if (session_status() !== PHP_SESSION_ACTIVE) session_start();
|
||||
|
||||
|
||||
$oturl = $_GET['otl'] ?? '';
|
||||
|
||||
if (!$oturl) {
|
||||
http_response_code(403);
|
||||
exit;
|
||||
}
|
||||
|
||||
if (!isset($baseDir)) {
|
||||
$baseDir = $_SERVER['DOCUMENT_ROOT'];
|
||||
}
|
||||
|
||||
require $baseDir . '/../scripts/db/db-functions.php';
|
||||
require $baseDir . '/../scripts/db/db-tables.php';
|
||||
|
||||
$error = '';
|
||||
|
||||
function logIn() {
|
||||
|
||||
global $baseDir;
|
||||
|
||||
$iduser = intval($_POST['user_id']);
|
||||
|
||||
|
||||
// security: user must have passed one-time-login first
|
||||
if (empty($_SESSION['set_new_password_id_user']) || empty($_SESSION['set_new_password_granted']) || $_SESSION['set_new_password_id_user'] !== $iduser || $_SESSION['set_new_password_granted'] !== true) {
|
||||
http_response_code(403);
|
||||
exit;
|
||||
}
|
||||
|
||||
$type = 'otl';
|
||||
|
||||
// DB
|
||||
$dbconnection = require $baseDir .'/../scripts/db/db-verbindung-script.php';
|
||||
if ($dbconnection['success'] !== true){
|
||||
return "DB Error";
|
||||
}
|
||||
|
||||
require $baseDir . '/../scripts/db/db-tables.php';
|
||||
|
||||
require $baseDir . '/../composer/vendor/autoload.php';
|
||||
|
||||
$envFile = realpath($baseDir . '/../config/.env.pw-encryption-key');
|
||||
|
||||
if ($envFile === false) {
|
||||
http_response_code(500);
|
||||
echo json_encode([
|
||||
'success' => false,
|
||||
'message' => "Environment file not found"
|
||||
]);
|
||||
exit;
|
||||
}
|
||||
|
||||
try {
|
||||
$envDir = dirname($envFile);
|
||||
|
||||
$dotenv = Dotenv::createImmutable($envDir, '.env.pw-encryption-key');
|
||||
|
||||
$dotenv->load();
|
||||
} catch (Throwable $e) {
|
||||
http_response_code(500);
|
||||
echo json_encode([
|
||||
'success' => false,
|
||||
'message' => "Dotenv error"
|
||||
]);
|
||||
}
|
||||
|
||||
|
||||
$password = trim($_POST['password1']);
|
||||
$password2 = trim($_POST['password2']);
|
||||
if ($password === '' || $password2 === '') {
|
||||
return 'Beide Felder müssen ausgefüllt sein';
|
||||
}
|
||||
|
||||
if ($password !== $password2) {
|
||||
return 'Beide Passwörter müssen identisch sein';
|
||||
}
|
||||
|
||||
$hash = password_hash($password, PASSWORD_ARGON2ID);
|
||||
|
||||
$iv_length = openssl_cipher_iv_length('aes-256-cbc');
|
||||
$iv = random_bytes($iv_length);
|
||||
|
||||
$encrypted = openssl_encrypt(
|
||||
'SET_BY_OTL',
|
||||
'aes-256-cbc',
|
||||
$_ENV['PW_ENCRYPTION_KEY'],
|
||||
0,
|
||||
$iv
|
||||
);
|
||||
|
||||
$cipher_store = base64_encode($iv . $encrypted);
|
||||
|
||||
// update password
|
||||
$updateResult = db_update($mysqli, $tableInternUsers, ['password_hash' => $hash, 'password_cipher' => $cipher_store, 'edited_by' => 'otlogin'], ['id' => $iduser]);
|
||||
if ($updateResult === false) {
|
||||
return 'Passwork konnte nicht neu gesetzt werden';
|
||||
}
|
||||
|
||||
// delete the one-time token
|
||||
if (!isset($_SESSION['otl_dbid'])) {
|
||||
return 'Interner Fehler';
|
||||
}
|
||||
|
||||
$dbid = intval($_SESSION['otl_dbid']);
|
||||
|
||||
$stmt = $mysqli->prepare("DELETE FROM $tableOTL WHERE id = ?");
|
||||
$stmt->bind_param("i", $dbid);
|
||||
|
||||
if (!$stmt->execute()) {
|
||||
return "DB Error";
|
||||
}
|
||||
|
||||
$stmt->close();
|
||||
|
||||
$sql = "SELECT freigabe FROM $tableInternUsers WHERE id = ?";
|
||||
|
||||
$stmt = $mysqli->prepare($sql);
|
||||
$stmt->bind_param("i", $iduser);
|
||||
$stmt->execute();
|
||||
|
||||
$result = $stmt->get_result();
|
||||
$row = $result->fetch_assoc();
|
||||
|
||||
$freigabe = $row['freigabe'];
|
||||
$stmt->close();
|
||||
|
||||
$mysqli->close();
|
||||
|
||||
unset($_SESSION['set_new_password_id_user'], $_SESSION['set_new_password_granted'], $_SESSION['otl_dbid']);
|
||||
|
||||
$freigabenArray = json_decode($freigabe, true) ?? [];
|
||||
$freigabenTypeArray = $freigabenArray['types'] ?? [];
|
||||
|
||||
if (count($freigabenTypeArray) > 0) {
|
||||
$_SESSION = array();
|
||||
session_destroy();
|
||||
session_start();
|
||||
}
|
||||
|
||||
foreach ($freigabenTypeArray as $freigabeType){
|
||||
$_SESSION['access_granted_'.$freigabeType] = true;
|
||||
$_SESSION['passcode'.$freigabeType.'_id'] = $iduser;
|
||||
}
|
||||
|
||||
if (in_array('wk_leitung', $freigabenTypeArray)) {
|
||||
header("Location: /intern/wk-leitung/logindata");
|
||||
exit;
|
||||
} elseif (in_array('trainer', $freigabenTypeArray)) {
|
||||
header("Location: /intern/trainer");
|
||||
exit;
|
||||
} elseif (in_array('kampfrichter', $freigabenTypeArray)) {
|
||||
header("Location: /intern/kampfrichter");
|
||||
exit;
|
||||
} else {
|
||||
return 'Dieser Benutzer hat keine Berechtigungen.';
|
||||
}
|
||||
}
|
||||
|
||||
/* ============================================================
|
||||
PASSWORD SET ON POST
|
||||
============================================================ */
|
||||
if (isset($_POST['password1'], $_POST['password2'], $_POST['setpasswordbtn'], $_POST['user_id'])) { $error = logIn() ?? ''; }
|
||||
|
||||
/* ============================================================
|
||||
ONE-TIME-LOGIN VALIDATION (GET)
|
||||
============================================================ */
|
||||
|
||||
$token = "QQa2UMbEYW8oOL7wz9DjtqECVCikSZsDuSdmzxiadEXFsKyujEUyQOW1AYMD2OqU8VXxClIRweRuWLzvBrZpPYL41e89Rs96tM7Lq1KpjA5E2mg2UfgvztheGRV";
|
||||
|
||||
require $baseDir .'/../scripts/db/db-verbindung-script-guest.php';
|
||||
|
||||
// fetch one-time login record
|
||||
$result = db_select(
|
||||
$guest,
|
||||
$tableOTL,
|
||||
'id, user_id',
|
||||
'url = ? AND timestamp >= NOW() - INTERVAL 24 HOUR',
|
||||
[$oturl]
|
||||
);
|
||||
|
||||
if (!$result || count($result) !== 1) {
|
||||
http_response_code(403);
|
||||
exit;
|
||||
}
|
||||
|
||||
$dbid = intval($result[0]['id']);
|
||||
$iduser = intval($result[0]['user_id']);
|
||||
|
||||
// store dbid for later deletion
|
||||
$_SESSION['otl_dbid'] = $dbid;
|
||||
|
||||
$tableusers = 'wp_secure_lock';
|
||||
|
||||
// fetch user
|
||||
$userinfo = db_select($guest, $tableInternUsers, 'username', 'id = ?', [$iduser]);
|
||||
$guest->close();
|
||||
|
||||
if (!$userinfo || count($userinfo) !== 1) {
|
||||
echo 'Ungültige Benutzerinformationen';
|
||||
exit;
|
||||
}
|
||||
|
||||
$username = $userinfo[0]['username'];
|
||||
|
||||
|
||||
// set session token that grants password reset
|
||||
$_SESSION['set_new_password_id_user'] = $iduser;
|
||||
$_SESSION['set_new_password_granted'] = true;
|
||||
|
||||
?>
|
||||
|
||||
<!DOCTYPE html>
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<link rel="icon" type="png" href="/intern/img/icon.png">
|
||||
<title>Einmal Login</title>
|
||||
|
||||
<script src="/intern/js/jquery/jquery-3.7.1.min.js"></script>
|
||||
<link href="/files/fonts/fonts.css" rel="stylesheet">
|
||||
<script src="/intern/js/custom-msg-display.js"></script>
|
||||
|
||||
</head>
|
||||
<body>
|
||||
<section class="page-secure-login">
|
||||
<div class="bg-picture-secure-login">
|
||||
<img src="/intern/img/login/bgOtl.webp">
|
||||
</div>
|
||||
<div class="bg-secure-login">
|
||||
<div class="bg-secure-login-form">
|
||||
<h1>Einmal-Login</h1>
|
||||
<p style="font-weight:400; line-height: 1.5; margin-bottom: 50px;">
|
||||
</p>
|
||||
<form method="post">
|
||||
<label for="password1">Neues Passwort eingeben</label><br>
|
||||
<div class="divShowPw">
|
||||
<input type="password" name="password1" id="password1" placeholder="Passwort" required>
|
||||
<button type="button" class="togglePassword">
|
||||
<svg class="eyeIcon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
|
||||
<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/>
|
||||
<circle cx="12" cy="12" r="3"/>
|
||||
</svg>
|
||||
</button>
|
||||
</div><br>
|
||||
<label for="password2">Neues Passwort wiederholen</label><br>
|
||||
<div class="divShowPw" id="lastDivShowPw">
|
||||
<input type="password" name="password2" id="password2" placeholder="Passwort" required>
|
||||
<button type="button" class="togglePassword">
|
||||
<svg class="eyeIcon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
|
||||
<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/>
|
||||
<circle cx="12" cy="12" r="3"/>
|
||||
</svg>
|
||||
</button>
|
||||
</div>
|
||||
<input type="hidden" name="user_id" value="<?= $iduser ?>">
|
||||
<input type="submit" name="setpasswordbtn" value="Einloggen">
|
||||
</form>
|
||||
|
||||
<?php if ($error !== ''): ?>
|
||||
<p style="color:red;"><?php echo $error; ?></p>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<a class="seclog_home_link" href="/"><img src="/intern/img/logo-normal.png" width="64" height="64"></a>
|
||||
|
||||
<style>
|
||||
body{
|
||||
overflow: hidden;
|
||||
}
|
||||
.page-secure-login{
|
||||
display: flex;
|
||||
}
|
||||
.bg-picture-secure-login{
|
||||
width: calc(100vw - 450px);
|
||||
height: 100vh;
|
||||
position: absolute;
|
||||
left: 0px;
|
||||
top: 0px;
|
||||
}
|
||||
.bg-picture-secure-login img{
|
||||
width: 100%;
|
||||
height: 100vh;
|
||||
object-fit: cover;
|
||||
}
|
||||
.bg-secure-login{
|
||||
display: flex;
|
||||
width: 100vw;
|
||||
max-width: 450px;
|
||||
height: 100vh;
|
||||
background-color: #fff;
|
||||
position: absolute;
|
||||
right: 0px;
|
||||
top: 0px;
|
||||
align-items: center;
|
||||
padding: 30px;
|
||||
}
|
||||
.bg-secure-login-form > h1{
|
||||
color: #000 !important;
|
||||
font-size: 32px;
|
||||
}
|
||||
.bg-secure-login-form input[type=password], .bg-secure-login-form input[type=text]{
|
||||
padding: 5px;
|
||||
width: 100%;
|
||||
max-width: 300px;
|
||||
border-top: none !important;
|
||||
border-left: none !important;
|
||||
border-right: none !important;
|
||||
font-size: 16px;
|
||||
border-bottom: 1px solid #000 !important;
|
||||
border-radius: 0px !important;
|
||||
}
|
||||
.divShowPw:not(#lastDivShowPw) {
|
||||
margin-bottom: 20px;
|
||||
}
|
||||
|
||||
.bg-secure-login-form input[type=password]:focus, .bg-secure-login-form input[type=text]:focus{
|
||||
outline: none;
|
||||
border-bottom: 1px solid #000 !important;
|
||||
}
|
||||
|
||||
.bg-secure-login-form input[type=password]::placeholder, .bg-secure-login-form input[type=text]::placeholder {
|
||||
color: #ccc !important;
|
||||
}
|
||||
|
||||
.bg-secure-login-form input[type=submit]{
|
||||
background-color: #fff !important;
|
||||
padding: 10px 20px !important;
|
||||
margin-top: 25px !important;
|
||||
border: 1px solid #000 !important;
|
||||
color: #000 !important;
|
||||
transition: all 0.3s ease-out !important;
|
||||
border-radius: 0px !important;
|
||||
}
|
||||
|
||||
body {
|
||||
color: #000 !important;
|
||||
}
|
||||
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
}
|
||||
|
||||
.bg-secure-login-form input[type=submit]:hover{
|
||||
background-color: #000 !important;
|
||||
color: #fff !important;
|
||||
}
|
||||
.bg-secure-login-form > p{
|
||||
margin-bottom: 30px;
|
||||
}
|
||||
.seclog_home_link{
|
||||
position: fixed;
|
||||
z-index: 1000;
|
||||
top: 30px;
|
||||
right: 30px;
|
||||
}
|
||||
.divShowPw {
|
||||
margin-top: 10px;
|
||||
position: relative;
|
||||
display: inline-block;
|
||||
width: 100%;
|
||||
max-width: 300px;
|
||||
}
|
||||
.togglePassword {
|
||||
position: absolute;
|
||||
right: 10px;
|
||||
top: 50%;
|
||||
transform: translateY(-50%);
|
||||
background: none;
|
||||
border: none;
|
||||
cursor: pointer;
|
||||
transition: all 0.5s ease;
|
||||
}
|
||||
|
||||
.togglePassword:hover {
|
||||
transform: translateY(-50%) scale(1.15);
|
||||
}
|
||||
|
||||
input:-webkit-autofill,
|
||||
input:-webkit-autofill:hover,
|
||||
input:-webkit-autofill:focus,
|
||||
input:-webkit-autofill:active {
|
||||
-webkit-box-shadow: 0 0 0 1000px #ffffff inset !important;
|
||||
box-shadow: 0 0 0 1000px #ffffff inset !important;
|
||||
-webkit-text-fill-color: #000000 !important;
|
||||
transition: background-color 5000s ease-in-out 0s;
|
||||
}
|
||||
</style>
|
||||
|
||||
<script>
|
||||
const toggleButtons = document.querySelectorAll('.togglePassword');
|
||||
|
||||
toggleButtons.forEach((el) => {
|
||||
el.addEventListener('click', () => {
|
||||
const passwordInput = el.parentElement.querySelector("input");
|
||||
const eyeIcon = el.querySelector(".eyeIcon");
|
||||
const type = passwordInput.getAttribute('type') === 'password' ? 'text' : 'password';
|
||||
passwordInput.setAttribute('type', type);
|
||||
|
||||
// Swap between eye and eye-with-line
|
||||
if (type === 'password') {
|
||||
// Eye (show)
|
||||
eyeIcon.innerHTML = '<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
|
||||
} else {
|
||||
// Eye with slash (hide)
|
||||
eyeIcon.innerHTML = '<path d="M17.94 17.94L6.06 6.06"/><path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
|
||||
}
|
||||
});
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
<?php /*<form id="setpasswordform" method="post">
|
||||
<label for="password">Neues Passwort setzen:</label>
|
||||
<input type="text" name="password" id="password" placeholder="Neues Passwort hier eingeben">
|
||||
<input name="setpasswordbtn" type="submit" value="Passwort setzen">
|
||||
</form>*/
|
||||
|
||||
?>
|
||||
Reference in New Issue
Block a user