213 lines
9.9 KiB
PHP
213 lines
9.9 KiB
PHP
<?php
|
|
require __DIR__ . '/session.php';
|
|
require __DIR__ . '/db.php';
|
|
start_app_session();
|
|
|
|
if (isset($_SESSION['username'])) {
|
|
header('Location: /');
|
|
exit;
|
|
}
|
|
|
|
const LOGIN_ATTEMPT_WINDOW_SECONDS = 900;
|
|
const MAX_LOGIN_ATTEMPTS_PER_IP = 20;
|
|
const MAX_LOGIN_ATTEMPTS_PER_EMAIL = 8;
|
|
|
|
function loginAttemptCount(PDO $pdo, string $identifier, int $windowSeconds): int
|
|
{
|
|
$stmt = $pdo->prepare("SELECT COUNT(*) FROM login_attempts WHERE identifier = :identifier AND created_at > datetime('now', :window)");
|
|
$stmt->execute(['identifier' => $identifier, 'window' => '-' . $windowSeconds . ' seconds']);
|
|
return (int) $stmt->fetchColumn();
|
|
}
|
|
|
|
function recordLoginAttempt(PDO $pdo, string $identifier): void
|
|
{
|
|
$pdo->prepare('INSERT INTO login_attempts (identifier) VALUES (:identifier)')->execute(['identifier' => $identifier]);
|
|
}
|
|
|
|
$errors = [];
|
|
$email = '';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$email = trim($_POST['email'] ?? '');
|
|
$password = $_POST['password'] ?? '';
|
|
|
|
if (!csrf_verify($_POST['csrf_token'] ?? null)) {
|
|
$errors['csrf'] = 'Your session has expired. Please refresh the page and try again.';
|
|
}
|
|
|
|
if ($email === '') {
|
|
$errors['email'] = 'Email is required.';
|
|
}
|
|
|
|
if ($password === '') {
|
|
$errors['password'] = 'Password is required.';
|
|
}
|
|
|
|
if (empty($errors)) {
|
|
$pdo = getDbConnection();
|
|
$pdo->exec('CREATE TABLE IF NOT EXISTS login_attempts (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
identifier TEXT NOT NULL,
|
|
created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
|
|
)');
|
|
$pdo->exec('CREATE INDEX IF NOT EXISTS idx_login_attempts_identifier ON login_attempts (identifier)');
|
|
|
|
$ipIdentifier = 'ip:' . ($_SERVER['REMOTE_ADDR'] ?? 'unknown');
|
|
$emailIdentifier = 'email:' . strtolower($email);
|
|
$attemptIds = [];
|
|
|
|
// Check both limits and reserve attempt rows for both identifiers atomically, so
|
|
// concurrent requests can't all read the same stale counts before any of them
|
|
// commits. Reserving happens before password_verify() runs (rather than only on a
|
|
// confirmed failure) so the check-then-record pair is a single fast transaction;
|
|
// the reservation is released below if the login actually succeeds, so only failed
|
|
// attempts count against the limit — matching the previous behavior.
|
|
$pdo->exec('BEGIN IMMEDIATE');
|
|
try {
|
|
if (
|
|
loginAttemptCount($pdo, $ipIdentifier, LOGIN_ATTEMPT_WINDOW_SECONDS) >= MAX_LOGIN_ATTEMPTS_PER_IP
|
|
|| loginAttemptCount($pdo, $emailIdentifier, LOGIN_ATTEMPT_WINDOW_SECONDS) >= MAX_LOGIN_ATTEMPTS_PER_EMAIL
|
|
) {
|
|
$errors['login'] = 'Too many login attempts. Please wait a while before trying again.';
|
|
} else {
|
|
recordLoginAttempt($pdo, $ipIdentifier);
|
|
$attemptIds[] = (int) $pdo->lastInsertId();
|
|
recordLoginAttempt($pdo, $emailIdentifier);
|
|
$attemptIds[] = (int) $pdo->lastInsertId();
|
|
}
|
|
$pdo->exec('COMMIT');
|
|
} catch (Throwable $e) {
|
|
$pdo->exec('ROLLBACK');
|
|
throw $e;
|
|
}
|
|
|
|
if (empty($errors)) {
|
|
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
|
|
$stmt->execute(['email' => $email]);
|
|
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$user || !password_verify($password, $user['password'])) {
|
|
$errors['login'] = 'Invalid email or password.';
|
|
} else {
|
|
foreach ($attemptIds as $attemptId) {
|
|
$pdo->prepare('DELETE FROM login_attempts WHERE id = :id')->execute(['id' => $attemptId]);
|
|
}
|
|
|
|
start_app_session();
|
|
session_regenerate_id(true);
|
|
$_SESSION['user_id'] = $user['id'];
|
|
$_SESSION['username'] = $user['username'];
|
|
$_SESSION['session_version'] = (int) $user['session_version'];
|
|
|
|
header('Location: /');
|
|
exit;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
$pageTitle = 'Log In';
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<?php require __DIR__ . '/lib/head.php'; ?>
|
|
<body class="bg-amber-50 min-h-screen flex flex-col">
|
|
<?php require __DIR__ . '/lib/header.php'; ?>
|
|
<div class="flex-1 flex items-center justify-center bg-gradient-to-b from-amber-50 via-pink-50 to-white p-4 py-12">
|
|
<div class="w-full max-w-4xl bg-white rounded-3xl shadow-xl ring-1 ring-gray-100 overflow-hidden grid md:grid-cols-2">
|
|
<div class="relative hidden md:block">
|
|
<img src="assets/recently2.webp" alt="" aria-hidden="true" class="absolute inset-0 h-full w-full object-cover">
|
|
<div class="absolute inset-0 bg-gradient-to-b from-black/10 via-transparent to-black/40"></div>
|
|
<div class="relative h-full flex flex-col justify-between p-8 text-white">
|
|
<p class="italic font-semibold text-xl leading-snug drop-shadow">
|
|
Good creatures.<br>Brighter days.
|
|
</p>
|
|
<div class="rounded-2xl bg-white/90 backdrop-blur text-gray-800 px-4 py-3 flex items-center gap-3 shadow-md">
|
|
<i data-lucide="paw-print" class="h-4 w-4"></i>
|
|
<span class="text-sm font-medium">Log in to continue your collection.</span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="p-8 sm:p-10">
|
|
<h1 class="text-2xl font-extrabold text-gray-900">Welcome back, explorer.</h1>
|
|
<p class="mt-1 text-gray-500 text-sm">Your critters have been waiting.</p>
|
|
|
|
<?php if (isset($errors['login']) || isset($errors['csrf'])): ?>
|
|
<div class="mt-4 rounded-lg bg-red-50 text-red-700 text-sm px-4 py-3">
|
|
<?php echo htmlspecialchars($errors['login'] ?? $errors['csrf'], ENT_QUOTES, 'UTF-8'); ?>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<?php if (isset($_GET['reset']) && $_GET['reset'] === 'success'): ?>
|
|
<div class="mt-4 rounded-lg bg-green-50 text-green-700 text-sm px-4 py-3">
|
|
Your password has been reset. You can now log in.
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<form action="login.php" method="post" novalidate class="mt-6 space-y-4">
|
|
<?php echo csrf_field(); ?>
|
|
<div>
|
|
<label for="email" class="block text-sm font-medium text-gray-700 mb-1">Email</label>
|
|
<div class="relative">
|
|
<i data-lucide="mail" class="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-gray-400"></i>
|
|
<input
|
|
type="email" id="email" name="email"
|
|
value="<?php echo htmlspecialchars($email, ENT_QUOTES, 'UTF-8'); ?>"
|
|
placeholder="you@example.com"
|
|
class="w-full rounded-xl border border-gray-300 pl-10 pr-3 py-2.5 focus:outline-none focus:ring-2 focus:ring-purple-400"
|
|
>
|
|
</div>
|
|
<?php if (isset($errors['email'])): ?>
|
|
<p class="mt-1 text-sm text-red-600"><?php echo htmlspecialchars($errors['email'], ENT_QUOTES, 'UTF-8'); ?></p>
|
|
<?php endif; ?>
|
|
</div>
|
|
<div>
|
|
<div class="flex items-center justify-between mb-1">
|
|
<label for="password" class="block text-sm font-medium text-gray-700">Password</label>
|
|
<a href="forgot-password.php" class="text-sm text-purple-600 font-medium hover:underline">Forgot password?</a>
|
|
</div>
|
|
<div class="relative">
|
|
<i data-lucide="lock" class="absolute left-3 top-1/2 -translate-y-1/2 h-4 w-4 text-gray-400"></i>
|
|
<input
|
|
type="password" id="password" name="password"
|
|
placeholder="Enter your password"
|
|
class="w-full rounded-xl border border-gray-300 pl-10 pr-10 py-2.5 focus:outline-none focus:ring-2 focus:ring-purple-400"
|
|
>
|
|
<button
|
|
type="button"
|
|
onclick="togglePasswordVisibility('password', this)"
|
|
class="absolute right-3 top-1/2 -translate-y-1/2 text-gray-400 hover:text-gray-600"
|
|
aria-label="Show password"
|
|
>
|
|
<i data-lucide="eye" class="h-4 w-4"></i>
|
|
<i data-lucide="eye-off" class="h-4 w-4 hidden"></i>
|
|
</button>
|
|
</div>
|
|
<?php if (isset($errors['password'])): ?>
|
|
<p class="mt-1 text-sm text-red-600"><?php echo htmlspecialchars($errors['password'], ENT_QUOTES, 'UTF-8'); ?></p>
|
|
<?php endif; ?>
|
|
</div>
|
|
<button type="submit" class="w-full inline-flex items-center justify-center gap-2 rounded-xl bg-gray-900 text-white font-semibold py-3 hover:bg-gray-800">
|
|
Log In <i data-lucide="arrow-right" class="h-4 w-4"></i>
|
|
</button>
|
|
</form>
|
|
|
|
<p class="mt-6 text-center text-sm text-gray-600">
|
|
New to OurApp? <a href="register.php" class="text-purple-600 font-semibold hover:underline">Create an account</a>
|
|
</p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
function togglePasswordVisibility(inputId, button) {
|
|
const input = document.getElementById(inputId);
|
|
const isPassword = input.type === 'password';
|
|
input.type = isPassword ? 'text' : 'password';
|
|
button.querySelectorAll('[data-lucide]').forEach((icon) => icon.classList.toggle('hidden'));
|
|
}
|
|
</script>
|
|
<?php require __DIR__ . '/lib/footer.php'; ?>
|
|
</body>
|
|
</html>
|