Semi-stable version with old variable names

2026-07-16 18:43:30 +02:00
parent 3731183654
commit c8e7ce9174
165 changed files with 25654 additions and 9728 deletions
@@ -1,8 +1,21 @@
 <?php

-ini_set('display_errors', 1);
-ini_set('display_startup_errors', 1);
-error_reporting(E_ALL);
+require_once __DIR__ . '/../../scripts/rate-limiter/rate-limiter.php';
+
+$limiter = new TokenBucket(
+    redis: $redis,
+    capacity: 3,
+    refillRate: 1,
+    refillInterval: 5.0
+);
+
+$result = $limiter->allow('RATE_LIMITER:TYPE:otlogin:IP:'. $_SERVER['REMOTE_ADDR']);
+
+if (!$result['allowed']) {
+    http_response_code(429);
+    include __DIR__ . "/../error-pages/429.html";
+    exit;
+} 

 use Dotenv\Dotenv;

@@ -10,6 +23,8 @@ if (!isset($baseDir)) {
    $baseDir = $_SERVER['DOCUMENT_ROOT'];
 }

+date_default_timezone_set('Europe/Zurich');
+
 require_once $baseDir . '/../scripts/session_functions.php';

 ini_wkvs_session(true);
@@ -295,29 +310,23 @@ class otl {

 $pwClass = New otl();

-/* ============================================================
-   PASSWORD SET ON POST
-   ============================================================ */
-
-
-/* ============================================================
-   ONE-TIME-LOGIN VALIDATION (GET)
-   ============================================================ */
-
 require $baseDir .'/../scripts/db/db-verbindung-script-guest.php';

 // fetch one-time login record
+
+$now = date("Y-m-d H:i:s");
+
 $result = db_select(
    $guest,
    $tableOTL,
    'id, user_id, `type`',
-    'url = ? AND timestamp >= NOW() - INTERVAL 24 HOUR',
-    [$oturl]
+    'url = ? AND expires_at >= ?',
+    [$oturl, $now]
 );

 if (!$result || count($result) !== 1) {
-    echo 'forbidden';
-    http_response_code(403);
+    http_response_code(400);
+    include $baseDir . "/error-pages/400.html";
    exit;
 }

@@ -389,9 +398,10 @@ $guest->close();
    <link href="/files/fonts/fonts.css" rel="stylesheet">
    <link href="/intern/css/otl.css" rel="stylesheet">
    <script src="/intern/js/custom-msg-display.js"></script>
+    <link rel="stylesheet" href="/intern/css/user.css">
    
 </head>
-<body>
+<body class="otlogin">
 <section class="page-secure-login">
    <div class="bg-picture-secure-login">
        <img src="/intern/img/login/bgOtl.webp">