173 lines
6.5 KiB
PHP
173 lines
6.5 KiB
PHP
<?php
|
|
|
|
require_once __DIR__ . '/../rate-limiter/rate-limiter.php';
|
|
|
|
$limiter = new TokenBucket(
|
|
redis: $redis,
|
|
capacity: 30,
|
|
refillRate: 2,
|
|
refillInterval: 5.0
|
|
);
|
|
|
|
$result = $limiter->allow('RATE_LIMITER:TYPE:login:IP:'. $_SERVER['REMOTE_ADDR']);
|
|
|
|
if (!$result['allowed']) {
|
|
http_response_code(429);
|
|
include __DIR__ . "/../../www/error-pages/429.html";
|
|
exit;
|
|
}
|
|
|
|
require_once __DIR__ . '/../session_functions.php';
|
|
|
|
ini_wkvs_session();
|
|
|
|
if (!isset($error)) {
|
|
$error = '';
|
|
}
|
|
|
|
// Initialize session variables if not set
|
|
if (!isset($_SESSION['login_attempts_'. $logintype])) {
|
|
$_SESSION['login_attempts_'. $logintype] = 0;
|
|
$_SESSION['lockout_time_'. $logintype] = 0;
|
|
}
|
|
|
|
$max_attempts = 5;
|
|
$lockout_period = 5 * 60;
|
|
|
|
// Check if user is locked out
|
|
if ($_SESSION['lockout_time_'. $logintype] > time()) {
|
|
$remaining = $_SESSION['lockout_time_'. $logintype] - time();
|
|
$minutes = ceil($remaining / 60);
|
|
$error = "Zu viele fehlgeschlagene Anmeldeversuche. Bitte warte $minutes Minute(n).";
|
|
} elseif (isset($_POST[$logintype.'_login_submit'])) {
|
|
|
|
require __DIR__ .'/../db/db-verbindung-script-guest.php';
|
|
|
|
require __DIR__ . "/../db/db-tables.php";
|
|
|
|
|
|
$username = htmlspecialchars(trim($_POST['access_username']), ENT_QUOTES);
|
|
$password = trim($_POST['access_passcode']);
|
|
|
|
// Prepare statement
|
|
$stmt = $guest->prepare("SELECT * FROM $tableInternUsers WHERE username = ? AND login_active = ? LIMIT 1");
|
|
$loginActive = 1;
|
|
$stmt->bind_param("ss", $username, $loginActive);
|
|
$stmt->execute();
|
|
$result = $stmt->get_result();
|
|
$user = $result->fetch_assoc();
|
|
|
|
if (!$user) {
|
|
$_SESSION['login_attempts_'. $logintype]++;
|
|
|
|
if ($_SESSION['login_attempts_'. $logintype] >= $max_attempts) {
|
|
$_SESSION['lockout_time_'. $logintype] = time() + $lockout_period;
|
|
$error = "Zu viele fehlgeschlagene Anmeldeversuche. Bitte versuche es in ".ceil($lockout_period / 60)." Minuten erneut.";
|
|
} else {
|
|
$remaining_attempts = $max_attempts - $_SESSION['login_attempts_'. $logintype];
|
|
$error = "Benutzer / Passwort unbekannt. Noch $remaining_attempts Versuch(e) möglich.";
|
|
}
|
|
} else {
|
|
$freigaben = json_decode($user['freigabe'], true) ?: [];
|
|
|
|
$freigabe_values = $freigaben['types'] ?? [];
|
|
|
|
// Verify password using PHP native function
|
|
if (password_verify($password, $user['password_hash']) && in_array($logintype, $freigabe_values)) {
|
|
foreach ($freigabe_values as $freigabe) {
|
|
$_SESSION['access_granted_'. $freigabe] = true;
|
|
$_SESSION['user_id_'. $freigabe] = $user['id'];
|
|
$_SESSION['lockout_time_'. $freigabe] = 0;
|
|
$_SESSION['login_attempts_'. $freigabe] = 0;
|
|
}
|
|
|
|
// Redirect using plain PHP
|
|
header("Location:" . $_SERVER['REQUEST_URI']);
|
|
exit;
|
|
} elseif ($password === ' ') {
|
|
$error = "Kein Passwort eingegeben.";
|
|
} else {
|
|
$_SESSION['login_attempts_'. $logintype]++;
|
|
|
|
if ($_SESSION['login_attempts_'. $logintype] >= $max_attempts) {
|
|
$_SESSION['lockout_time_'. $logintype] = time() + $lockout_period;
|
|
$error = "Zu viele fehlgeschlagene Anmeldeversuche. Bitte versuche es in ".ceil($lockout_period / 60)." Minuten erneut.";
|
|
} else {
|
|
$remaining_attempts = $max_attempts - $_SESSION['login_attempts_'. $logintype];
|
|
$error = "Benutzer / Passwort unbekannt. Noch $remaining_attempts Versuch(e) möglich.";
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
$array_logintitles = [
|
|
'wk_leitung' => 'Wettkampfleitung',
|
|
'trainer' => 'Trainer',
|
|
'kampfrichter' => 'Kampfrichter'
|
|
]
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="de">
|
|
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>Login <?= $array_logintitles[$logintype] ?></title>
|
|
<link rel="icon" type="png" href="/intern/img/icon.png">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<link rel="stylesheet" href="/intern/css/login.css">
|
|
<link href="/files/fonts/fonts.css" rel="stylesheet">
|
|
<link rel="stylesheet" href="/intern/css/user.css">
|
|
|
|
</head>
|
|
|
|
<body class="login">
|
|
<section class="page-secure-login">
|
|
<div class="bg-picture-secure-login">
|
|
<img src="/intern/img/login/bg<?= ucfirst($logintype) ?>.webp">
|
|
</div>
|
|
<div class="bg-secure-login">
|
|
<div class="bg-secure-login-form">
|
|
<h1>Anmeldung<br><?= $array_logintitles[$logintype] ?? "" ?></h1>
|
|
|
|
<form method="post">
|
|
<label for="access_username">Benutzername eingeben</label><br>
|
|
<input type="text" id="access_username" name="access_username" required placeholder="Benutzername"><br>
|
|
<label for="password">Passwort eingeben</label><br>
|
|
<div id="div_showpw">
|
|
<input type="password" name="access_passcode" id="access_passcode" placeholder="Passwort" required>
|
|
<button type="button" id="togglePassword">
|
|
<svg id="eyeIcon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
|
|
<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/>
|
|
<circle cx="12" cy="12" r="3"/>
|
|
</svg>
|
|
</button>
|
|
</div>
|
|
<input type="submit" name="<?= $logintype ?>_login_submit" value="Einloggen">
|
|
</form>
|
|
|
|
<?php if ($error !== ''): ?>
|
|
<p style="color:red;"><?php echo $error; ?></p>
|
|
<?php endif; ?>
|
|
</div>
|
|
</div>
|
|
</section>
|
|
|
|
<a class="seclog_home_link" href="/"><img src="/intern/img/logo-normal.png"></a>
|
|
|
|
<script>
|
|
const passwordInput = document.getElementById('access_passcode');
|
|
const toggleButton = document.getElementById('togglePassword');
|
|
const eyeIcon = document.getElementById('eyeIcon');
|
|
|
|
toggleButton.addEventListener('click', () => {
|
|
const type = passwordInput.getAttribute('type') === 'password' ? 'text' : 'password';
|
|
passwordInput.setAttribute('type', type);
|
|
|
|
if (type === 'password') {
|
|
eyeIcon.innerHTML = '<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
|
|
} else {
|
|
eyeIcon.innerHTML = '<path d="M17.94 17.94L6.06 6.06"/><path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
|
|
}
|
|
});
|
|
</script>
|
|
</body>
|