login change
This commit is contained in:
136
src/auth/login.php
Normal file
136
src/auth/login.php
Normal file
@@ -0,0 +1,136 @@
|
||||
<?php
|
||||
// public/auth/login.php
|
||||
|
||||
// Gemeinsame Bootstrap-/Config-Datei laden
|
||||
require __DIR__ . '/../../config/fileload.php'; // Pfad ggf. anpassen
|
||||
|
||||
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
||||
// Direktzugriff per GET → einfach zurück zur Login-Seite
|
||||
$lang = $_GET['lang'] ?? 'de';
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=login#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Daten einsammeln
|
||||
$lang = $_POST['lang'] ?? 'de';
|
||||
$email = trim((string)($_POST['email'] ?? ''));
|
||||
$password = (string)($_POST['password'] ?? '');
|
||||
$redirect = $_POST['redirect'] ?? '/';
|
||||
|
||||
// Minimale Validierung
|
||||
if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL) || $password === '') {
|
||||
flash_set('error', 'Bitte E-Mail-Adresse und Passwort eingeben.', 'login');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=login#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Annahme: $pdo ist in fileload.php / db.php gesetzt (PDO-Instanz)
|
||||
try {
|
||||
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email LIMIT 1');
|
||||
$stmt->execute([':email' => $email]);
|
||||
$user = $stmt->fetch(PDO::FETCH_ASSOC);
|
||||
} catch (Throwable $e) {
|
||||
// DB-Fehler → generische Meldung
|
||||
flash_set('error', 'Es ist ein Fehler beim Login aufgetreten. Bitte versuche es später erneut.', 'login');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=login#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
if (!$user) {
|
||||
flash_set('error', 'E-Mail oder Passwort ist falsch.', 'login');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=login#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Account gesperrt?
|
||||
if (!empty($user['is_locked'])) {
|
||||
flash_set('error', 'Dein Konto ist gesperrt. Bitte kontaktiere den Support.', 'login');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=login#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Passwort prüfen
|
||||
if (!password_verify($password, $user['password_hash'])) {
|
||||
// Fehlversuche hochzählen (optional)
|
||||
try {
|
||||
$failed = (int)($user['failed_logins'] ?? 0) + 1;
|
||||
|
||||
$lock = 0;
|
||||
if ($failed >= 5) {
|
||||
$lock = 1;
|
||||
}
|
||||
|
||||
$upd = $pdo->prepare('UPDATE users SET failed_logins = :failed, is_locked = :locked WHERE id = :id');
|
||||
$upd->execute([
|
||||
':failed' => $failed,
|
||||
':locked' => $lock,
|
||||
':id' => $user['id'],
|
||||
]);
|
||||
} catch (Throwable $e) {
|
||||
// Ignorieren, Login-Fehler reicht
|
||||
}
|
||||
|
||||
$msg = 'E-Mail oder Passwort ist falsch.';
|
||||
if (($user['failed_logins'] ?? 0) + 1 >= 5) {
|
||||
$msg = 'Zu viele Fehlversuche. Dein Konto wurde vorübergehend gesperrt.';
|
||||
}
|
||||
|
||||
flash_set('error', $msg, 'login');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=login#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Passwort korrekt → Fehlversuche zurücksetzen & letztes Login speichern
|
||||
try {
|
||||
$upd = $pdo->prepare('UPDATE users SET failed_logins = 0, last_login_at = NOW() WHERE id = :id');
|
||||
$upd->execute([':id' => $user['id']]);
|
||||
} catch (Throwable $e) {
|
||||
// Nicht kritisch für den Nutzer
|
||||
}
|
||||
|
||||
// Session füllen
|
||||
if (session_status() !== PHP_SESSION_ACTIVE) {
|
||||
@session_start();
|
||||
}
|
||||
|
||||
// Initialen bauen
|
||||
$firstName = $user['first_name'] ?? '';
|
||||
$lastName = $user['last_name'] ?? '';
|
||||
$initials = '';
|
||||
|
||||
if ($firstName !== '') {
|
||||
$initials .= mb_substr($firstName, 0, 1);
|
||||
}
|
||||
if ($lastName !== '') {
|
||||
$initials .= mb_substr($lastName, 0, 1);
|
||||
}
|
||||
if ($initials === '') {
|
||||
$initials = mb_substr($user['username'] ?? $user['email'], 0, 2);
|
||||
}
|
||||
$initials = mb_strtoupper($initials);
|
||||
|
||||
$_SESSION['user'] = [
|
||||
'id' => $user['id'],
|
||||
'email' => $user['email'],
|
||||
'username' => $user['username'],
|
||||
'first_name' => $user['first_name'],
|
||||
'last_name' => $user['last_name'],
|
||||
'plan' => $user['plan'] ?? 'free',
|
||||
'initials' => $initials,
|
||||
];
|
||||
|
||||
// Flash für „Willkommen“
|
||||
flash_set('success', 'Willkommen zurück, ' . ($user['first_name'] ?: 'User') . '!', 'login');
|
||||
|
||||
// Redirect-Ziel prüfen (nur interne Pfade erlauben)
|
||||
$target = is_string($redirect) ? trim($redirect) : '/';
|
||||
if ($target === '' || $target[0] !== '/') {
|
||||
$target = '/';
|
||||
}
|
||||
|
||||
// Sprache ggf. anfügen, wenn noch nicht als Parameter vorhanden
|
||||
$sep = (strpos($target, '?') === false) ? '?' : '&';
|
||||
$target = $target . $sep . 'lang=' . urlencode($lang);
|
||||
|
||||
header('Location: ' . $target);
|
||||
exit;
|
||||
22
src/auth/logout.php
Normal file
22
src/auth/logout.php
Normal file
@@ -0,0 +1,22 @@
|
||||
<?php
|
||||
// public/auth/logout.php
|
||||
|
||||
require __DIR__ . '/../../config/fileload.php'; // Pfad ggf. anpassen
|
||||
|
||||
if (session_status() !== PHP_SESSION_ACTIVE) {
|
||||
@session_start();
|
||||
}
|
||||
|
||||
// Session leeren, aber NICHT komplett zerstören,
|
||||
// damit flash_set noch funktionieren kann.
|
||||
$_SESSION = [];
|
||||
session_regenerate_id(true);
|
||||
|
||||
// Sprache aus GET, falls vorhanden
|
||||
$lang = $_GET['lang'] ?? 'de';
|
||||
|
||||
flash_set('success', 'Du wurdest erfolgreich ausgeloggt.', 'login');
|
||||
|
||||
// Zur Startseite zurück
|
||||
header('Location: /?lang=' . urlencode($lang));
|
||||
exit;
|
||||
124
src/auth/register.php
Normal file
124
src/auth/register.php
Normal file
@@ -0,0 +1,124 @@
|
||||
<?php
|
||||
// public/auth/register.php
|
||||
|
||||
require __DIR__ . '/../../config/fileload.php'; // Pfad ggf. anpassen
|
||||
|
||||
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
||||
$lang = $_GET['lang'] ?? 'de';
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=register#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
$lang = $_POST['lang'] ?? 'de';
|
||||
$name = trim((string)($_POST['name'] ?? ''));
|
||||
$email = trim((string)($_POST['email'] ?? ''));
|
||||
$password = (string)($_POST['password'] ?? '');
|
||||
$redirect = $_POST['redirect'] ?? '/';
|
||||
|
||||
if ($name === '' || $email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
||||
flash_set('error', 'Bitte einen gültigen Namen und eine gültige E-Mail-Adresse eingeben.', 'register');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=register#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
if (strlen($password) < 8) {
|
||||
flash_set('error', 'Das Passwort muss mindestens 8 Zeichen lang sein.', 'register');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=register#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Prüfen, ob E-Mail bereits existiert
|
||||
try {
|
||||
$stmt = $pdo->prepare('SELECT id FROM users WHERE email = :email LIMIT 1');
|
||||
$stmt->execute([':email' => $email]);
|
||||
$existing = $stmt->fetch(PDO::FETCH_ASSOC);
|
||||
} catch (Throwable $e) {
|
||||
flash_set('error', 'Es ist ein Fehler bei der Registrierung aufgetreten. Bitte versuche es später erneut.', 'register');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=register#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
if ($existing) {
|
||||
flash_set('error', 'Diese E-Mail-Adresse ist bereits registriert.', 'register');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=register#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Username aus E-Mail ableiten (oder einfach die komplette E-Mail nutzen)
|
||||
$username = $email;
|
||||
|
||||
// Vor- und Nachname grob aus dem „Name“-Feld splitten
|
||||
$firstName = $name;
|
||||
$lastName = null;
|
||||
|
||||
$parts = preg_split('/\s+/', $name);
|
||||
if (count($parts) >= 2) {
|
||||
$firstName = array_shift($parts);
|
||||
$lastName = implode(' ', $parts);
|
||||
}
|
||||
|
||||
$passwordHash = password_hash($password, PASSWORD_DEFAULT);
|
||||
|
||||
try {
|
||||
$stmt = $pdo->prepare('
|
||||
INSERT INTO users
|
||||
(username, email, password_hash, first_name, last_name, plan)
|
||||
VALUES
|
||||
(:username, :email, :password_hash, :first_name, :last_name, :plan)
|
||||
');
|
||||
$stmt->execute([
|
||||
':username' => $username,
|
||||
':email' => $email,
|
||||
':password_hash' => $passwordHash,
|
||||
':first_name' => $firstName,
|
||||
':last_name' => $lastName,
|
||||
':plan' => 'free',
|
||||
]);
|
||||
|
||||
$userId = (int)$pdo->lastInsertId();
|
||||
} catch (Throwable $e) {
|
||||
flash_set('error', 'Die Registrierung ist fehlgeschlagen. Bitte versuche es später erneut.', 'register');
|
||||
header('Location: /login/?lang=' . urlencode($lang) . '&view=register#auth');
|
||||
exit;
|
||||
}
|
||||
|
||||
// Direkt einloggen
|
||||
if (session_status() !== PHP_SESSION_ACTIVE) {
|
||||
@session_start();
|
||||
}
|
||||
|
||||
$initials = '';
|
||||
if ($firstName !== '') {
|
||||
$initials .= mb_substr($firstName, 0, 1);
|
||||
}
|
||||
if ($lastName !== null && $lastName !== '') {
|
||||
$initials .= mb_substr($lastName, 0, 1);
|
||||
}
|
||||
if ($initials === '') {
|
||||
$initials = mb_substr($username, 0, 2);
|
||||
}
|
||||
$initials = mb_strtoupper($initials);
|
||||
|
||||
$_SESSION['user'] = [
|
||||
'id' => $userId,
|
||||
'email' => $email,
|
||||
'username' => $username,
|
||||
'first_name' => $firstName,
|
||||
'last_name' => $lastName,
|
||||
'plan' => 'free',
|
||||
'initials' => $initials,
|
||||
];
|
||||
|
||||
flash_set('success', 'Konto erfolgreich erstellt. Willkommen bei USBCheck!', 'login');
|
||||
|
||||
// Redirect-Ziel prüfen (nur interne Pfade)
|
||||
$target = is_string($redirect) ? trim($redirect) : '/';
|
||||
if ($target === '' || $target[0] !== '/') {
|
||||
$target = '/';
|
||||
}
|
||||
|
||||
$sep = (strpos($target, '?') === false) ? '?' : '&';
|
||||
$target = $target . $sep . 'lang=' . urlencode($lang);
|
||||
|
||||
header('Location: ' . $target);
|
||||
exit;
|
||||
Reference in New Issue
Block a user