File manager

File manager - Edit - /home/webapp69.cm.in.th/u69319090039/Shop39/app/Controllers/AuthController.php

Back
<?php class AuthController extends Controller { public function showLogin(): void { if (Auth::check()) { $this->redirect(''); } // Check lockout status $lockoutUntil = (int)Session::get('login_lockout_until', 0); $remainingLockout = max(0, $lockoutUntil - time()); if ($remainingLockout <= 0 && $lockoutUntil > 0) { Session::remove('login_lockout_until'); Session::remove('login_captcha_fails'); } // Ensure captcha question exists $question = Session::get('login_captcha_q'); if (empty($question) \|\| Session::get('login_captcha_answer') === null) { $captcha = $this->generateCaptcha(); $question = $captcha['question']; } $fails = (int)Session::get('login_captcha_fails', 0); $attemptsLeft = max(0, 5 - $fails); $this->render('auth/login', [ 'title' => 'เข้าสู่ระบบ', 'captcha_question' => $question, 'lockout_seconds' => $remainingLockout, 'attempts_left' => $attemptsLeft ]); } /** * AJAX endpoint to refresh Math CAPTCHA question * GET /captcha/refresh / public function refreshCaptcha(): void { header('Content-Type: application/json; charset=utf-8'); $lockoutUntil = (int)Session::get('login_lockout_until', 0); if ($lockoutUntil > time()) { echo json_encode([ 'success' => false, 'locked' => true, 'remaining' => $lockoutUntil - time(), 'message' => 'ระบบถูกระงับชั่วคราว' ]); return; } $captcha = $this->generateCaptcha(); echo json_encode([ 'success' => true, 'question' => $captcha['question'] ]); } public function login(): void { $this->validateCsrf(); // 1. Check if user is currently locked out $lockoutUntil = (int)Session::get('login_lockout_until', 0); if ($lockoutUntil > time()) { $secs = $lockoutUntil - time(); $mins = ceil($secs / 60); Session::setFlash('danger', "⏳ คุณตอบคำถามตรวจบอทผิดครบ 5 ครั้งแล้ว ระบบถูกระงับชั่วคราว กรุณารออีก {$mins} นาที ({$secs} วินาที)"); $this->redirect('login'); } // 2. Validate Anti-Bot Math CAPTCHA $userAnswer = trim($_POST['captcha_answer'] ?? ''); $expectedAnswer = Session::get('login_captcha_answer'); if ($expectedAnswer === null \|\| $userAnswer === '' \|\| !is_numeric($userAnswer) \|\| (int)$userAnswer !== (int)$expectedAnswer) { $fails = (int)Session::get('login_captcha_fails', 0) + 1; Session::set('login_captcha_fails', $fails); $this->generateCaptcha(); // Generate new question for security if ($fails >= 5) { // Lockout for 3 minutes (180 seconds) Session::set('login_lockout_until', time() + 180); Session::setFlash('danger', '❌ คุณตอบคำถามตรวจบอทผิดครบ 5 ครั้งแล้ว! ระบบถูกระงับการเข้าสู่ระบบชั่วคราวเป็นเวลา 3 นาที'); } else { $left = 5 - $fails; Session::setFlash('danger', "❌ คำตอบตรวจบอทไม่ถูกต้อง! (ตอบผิดครั้งที่ {$fails}/5, เหลือโอกาสอีก {$left} ครั้งก่อนถูกระงับชั่วคราว)"); } $redirect = $_POST['redirect'] ?? $_GET['redirect'] ?? ''; $this->redirect('login' . (!empty($redirect) ? '?redirect=' . urlencode($redirect) : '')); } // 3. CAPTCHA passed — validate username & password $username = Security::sanitizeString($_POST['username'] ?? ''); $password = $_POST['password'] ?? ''; if (empty($username) \|\| empty($password)) { $this->generateCaptcha(); Session::setFlash('danger', 'กรุณากรอกชื่อผู้ใช้และรหัสผ่านให้ครบถ้วน'); $this->redirect('login'); } $userModel = new User(); // Allow login via username or email $user = $userModel->findByUsername($username) ?? $userModel->findByEmail($username); if ($user && Security::verifyPassword($password, $user['password'])) { if ($user['status'] !== 'active') { $this->generateCaptcha(); Session::setFlash('danger', 'บัญชีผู้ใช้ของคุณถูกระงับหรือยังไม่อนุมัติ'); $this->redirect('login'); } // Reset failed captcha counters upon successful login Session::remove('login_captcha_fails'); Session::remove('login_lockout_until'); Session::remove('login_captcha_answer'); Session::remove('login_captcha_q'); Session::set('user_id', $user['id']); Session::setFlash('success', 'เข้าสู่ระบบสำเร็จ! ยินดีต้อนรับคุณ ' . $user['full_name']); if ($user['role'] === 'admin') { $this->redirect('admin/dashboard'); } else { $redirect = $_POST['redirect'] ?? $_GET['redirect'] ?? ''; if (!empty($redirect) && str_starts_with($redirect, '/')) { header("Location: " . APP_URL . $redirect); exit; } $this->redirect(''); } } else { // Password or Username invalid — generate new captcha question $this->generateCaptcha(); Session::setFlash('danger', 'ชื่อผู้ใช้หรือรหัสผ่านไม่ถูกต้อง'); $redirect = $_POST['redirect'] ?? $_GET['redirect'] ?? ''; $this->redirect('login' . (!empty($redirect) ? '?redirect=' . urlencode($redirect) : '')); } } /* * Helper to generate a random 1-digit addition Math question */ private function generateCaptcha(): array { $num1 = random_int(1, 9); $num2 = random_int(1, 9); $question = "{$num1} + {$num2}"; $answer = $num1 + $num2; Session::set('login_captcha_q', $question); Session::set('login_captcha_answer', $answer); return [ 'question' => $question, 'answer' => $answer ]; } public function showRegister(): void { if (Auth::check()) { $this->redirect(''); } $this->render('auth/register', ['title' => 'สมัครสมาชิก']); } public function register(): void { $this->validateCsrf(); $username = Security::sanitizeString($_POST['username'] ?? ''); $email = Security::sanitizeEmail($_POST['email'] ?? ''); $password = $_POST['password'] ?? ''; $fullName = Security::sanitizeString($_POST['full_name'] ?? ''); $phone = Security::sanitizeString($_POST['phone'] ?? ''); if (empty($username) \|\| empty($email) \|\| empty($password) \|\| empty($fullName)) { Session::setFlash('danger', 'กรุณากรอกข้อมูลที่จำเป็นให้ครบถ้วน'); $this->redirect('register'); } $userModel = new User(); if ($userModel->findByUsername($username)) { Session::setFlash('danger', 'ชื่อผู้ใช้นี้ถูกใช้งานแล้ว'); $this->redirect('register'); } if ($userModel->findByEmail($email)) { Session::setFlash('danger', 'อีเมลนี้ถูกใช้งานแล้ว'); $this->redirect('register'); } $userId = $userModel->create([ 'username' => $username, 'email' => $email, 'password' => Security::hashPassword($password), 'full_name' => $fullName, 'phone' => $phone, 'role' => 'customer', 'status' => 'active' ]); Session::set('user_id', $userId); Session::setFlash('success', 'สมัครสมาชิกสำเร็จ! เข้าสู่ระบบเรียบร้อยแล้ว'); $this->redirect(''); } public function logout(): void { Session::destroy(); Session::init(); Session::setFlash('success', 'ออกจากระบบเรียบร้อยแล้ว'); $this->redirect('login'); } }

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.24 | proxy | phpinfo | Settings