Initial commit

hosxp-webservice/_OLD/authen 2.php

@@ -0,0 +1,95 @@
+<?php
+session_start();
+require_once("config/db.php");
+require_once('inc/rfc6238.php');
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    header("Location: index.php");
+    exit();
+}
+
+$user = $_POST['username'] ?? '';
+$pass = $_POST['password'] ?? '';
+$currentcode = $_POST['2fa_auth'] ?? '';
+$ip = $_POST['show_ip'] ?? $_SERVER['REMOTE_ADDR'];
+$os = $_POST['user_os'] ?? 'Unknown';
+$browser = $_POST['user_browser'] ?? 'Unknown';
+
+$md5_pass = md5($pass);
+$timezone = "Asia/Bangkok";
+date_default_timezone_set($timezone);
+$thistime = date("Y-m-d H:i:s");
+
+// Helper function to log auth
+function log_auth($conn2, $user, $ip, $os, $browser, $thistime, $status) {
+    try {
+        // Use the exact insert structure from the original code
+        $sql = "INSERT INTO login_authen VALUES (null, ?, ?, ?, ?, ?, ?)";
+        $stmt = $conn2->prepare($sql);
+        if ($stmt) {
+            $stmt->bind_param("ssssss", $user, $ip, $os, $browser, $thistime, $status);
+            $stmt->execute();
+            $stmt->close();
+        }
+    } catch (Exception $e) {
+        // Ignore logging errors so they don't break the login flow
+        error_log("Login Auth Log Error: " . $e->getMessage());
+    }
+}
+
+try {
+    //------- Check Block IP ----------
+    $stmt_block = $conn2->prepare("SELECT block_ip_number FROM block_ip WHERE block_ip_number = ?");
+    $stmt_block->bind_param("s", $ip);
+    $stmt_block->execute();
+    $stmt_block->store_result();
+
+    if ($stmt_block->num_rows >= 1) {
+        $stmt_block->close();
+        echo '<div style="display:flex; justify-content:center; align-items:center; height:100vh; font-family:sans-serif; color:red; font-size:1.5rem;"><b>Your IP is Blocked !!!</b></div>';
+        exit();
+    }
+    $stmt_block->close();
+
+    //------- Check User Credentials ----------
+    $stmt_user = $conn1->prepare("SELECT loginname, name, entryposition, two_fa_secret_key_samui FROM opduser WHERE loginname = ? AND passweb = ? AND two_fa_secret_key_samui IS NOT NULL AND account_disable='N'");
+    $stmt_user->bind_param("ss", $user, $md5_pass);
+    $stmt_user->execute();
+    $result_user = $stmt_user->get_result();
+
+    if ($result_user->num_rows === 1) {
+        $row = $result_user->fetch_assoc();
+        $account = $row['loginname'];
+        $name = $row['name'];
+        $position = $row['entryposition'];
+        $fa_secretkey = $row['two_fa_secret_key_samui'];
+
+        if (TokenAuth6238::verify($fa_secretkey, $currentcode)) {
+            session_regenerate_id(true); // Prevent session fixation
+            $_SESSION['sess_userid'] = session_id();
+            $_SESSION['account'] = $account;
+            $_SESSION['name'] = $name;
+            $_SESSION['position'] = $position;
+            $_SESSION['ip'] = $ip;
+
+            log_auth($conn2, $user, $ip, $os, $browser, $thistime, "Login Success");
+            
+            header("Location: main.php");
+            exit();
+        } else {
+            log_auth($conn2, $user, $ip, $os, $browser, $thistime, "2FA Authen Fail");
+            header("Location: error.php?message=Pass+Code");
+            exit();
+        }
+    } else {
+        log_auth($conn2, $user, $ip, $os, $browser, $thistime, "User/Pass Fail");
+        header("Location: error.php?message=" . urlencode("บัญชีผู้ใช้ / รหัสผ่าน"));
+        exit();
+    }
+} catch (Exception $e) {
+    // If something crashes completely, show error
+    error_log("Authen Error: " . $e->getMessage());
+    header("Location: error.php?message=" . urlencode("ระบบฐานข้อมูลขัดข้อง"));
+    exit();
+}
+?>