File manager - Edit - /home/webapp69.cm.in.th/u69319090038/Shop/api/auth/login.php
Back
<?php // POST /api/auth/login.php require_once __DIR__ . '/../init.php'; if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::error('Method not allowed.', 405); $ip = clientIp(); $body = getBody(); $identifier = trim($body['identifier'] ?? ''); // email | phone | username $password = $body['password'] ?? ''; $rememberMe = (bool)($body['rememberMe'] ?? false); if (!$identifier || !$password) { Response::error('Identifier and password are required.'); } // ─── Rate limit (brute-force protection) ───────────────── if (!RateLimit::check($ip, RL_LOGIN_MAX, RL_LOGIN_WINDOW)) { Response::error('Too many failed login attempts. Please wait 15 minutes.', 429); } $db = DB::conn(); // ─── Fetch user (email OR username OR phone) ────────────── $stmt = $db->prepare( 'SELECT id, username, email, phone, password_hash, role, avatar_url, is_active FROM users WHERE email = ? OR username = ? OR phone = ? LIMIT 1' ); $stmt->execute([$identifier, $identifier, $identifier]); $user = $stmt->fetch(); if (!$user || !password_verify($password, $user['password_hash'])) { RateLimit::record($identifier, $ip, false); Response::error('Invalid credentials.', 401); } if (!$user['is_active']) { Response::error('Your account has been disabled. Contact support.', 403); } // ─── Issue tokens ───────────────────────────────────────── RateLimit::record($identifier, $ip, true); $accessToken = buildAccessToken($user); $refreshToken = buildRefreshToken($user); saveSession((int)$user['id'], $refreshToken, $rememberMe); setRefreshCookie($refreshToken, $rememberMe); Response::success('Login successful.', [ 'accessToken' => $accessToken, 'user' => [ 'id' => (int)$user['id'], 'username' => $user['username'], 'email' => $user['email'], 'phone' => $user['phone'], 'role' => $user['role'], 'avatar_url' => $user['avatar_url'], ], ]);
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.29 |
proxy
|
phpinfo
|
Settings