96 lines
3.5 KiB
PHP
96 lines
3.5 KiB
PHP
<?php
|
|
session_start();
|
|
require_once("config/db.php");
|
|
require_once('inc/rfc6238.php');
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
header("Location: index.php");
|
|
exit();
|
|
}
|
|
|
|
$user = $_POST['username'] ?? '';
|
|
$pass = $_POST['password'] ?? '';
|
|
$currentcode = $_POST['2fa_auth'] ?? '';
|
|
$ip = $_POST['show_ip'] ?? $_SERVER['REMOTE_ADDR'];
|
|
$os = $_POST['user_os'] ?? 'Unknown';
|
|
$browser = $_POST['user_browser'] ?? 'Unknown';
|
|
|
|
$md5_pass = md5($pass);
|
|
$timezone = "Asia/Bangkok";
|
|
date_default_timezone_set($timezone);
|
|
$thistime = date("Y-m-d H:i:s");
|
|
|
|
// Helper function to log auth
|
|
function log_auth($conn2, $user, $ip, $os, $browser, $thistime, $status) {
|
|
try {
|
|
// Use the exact insert structure from the original code
|
|
$sql = "INSERT INTO login_authen VALUES (null, ?, ?, ?, ?, ?, ?)";
|
|
$stmt = $conn2->prepare($sql);
|
|
if ($stmt) {
|
|
$stmt->bind_param("ssssss", $user, $ip, $os, $browser, $thistime, $status);
|
|
$stmt->execute();
|
|
$stmt->close();
|
|
}
|
|
} catch (Exception $e) {
|
|
// Ignore logging errors so they don't break the login flow
|
|
error_log("Login Auth Log Error: " . $e->getMessage());
|
|
}
|
|
}
|
|
|
|
try {
|
|
//------- Check Block IP ----------
|
|
$stmt_block = $conn2->prepare("SELECT block_ip_number FROM block_ip WHERE block_ip_number = ?");
|
|
$stmt_block->bind_param("s", $ip);
|
|
$stmt_block->execute();
|
|
$stmt_block->store_result();
|
|
|
|
if ($stmt_block->num_rows >= 1) {
|
|
$stmt_block->close();
|
|
echo '<div style="display:flex; justify-content:center; align-items:center; height:100vh; font-family:sans-serif; color:red; font-size:1.5rem;"><b>Your IP is Blocked !!!</b></div>';
|
|
exit();
|
|
}
|
|
$stmt_block->close();
|
|
|
|
//------- Check User Credentials ----------
|
|
$stmt_user = $conn1->prepare("SELECT loginname, name, entryposition, two_fa_secret_key_samui FROM opduser WHERE loginname = ? AND passweb = ? AND two_fa_secret_key_samui IS NOT NULL AND account_disable='N'");
|
|
$stmt_user->bind_param("ss", $user, $md5_pass);
|
|
$stmt_user->execute();
|
|
$result_user = $stmt_user->get_result();
|
|
|
|
if ($result_user->num_rows === 1) {
|
|
$row = $result_user->fetch_assoc();
|
|
$account = $row['loginname'];
|
|
$name = $row['name'];
|
|
$position = $row['entryposition'];
|
|
$fa_secretkey = $row['two_fa_secret_key_samui'];
|
|
|
|
if (TokenAuth6238::verify($fa_secretkey, $currentcode)) {
|
|
session_regenerate_id(true); // Prevent session fixation
|
|
$_SESSION['sess_userid'] = session_id();
|
|
$_SESSION['account'] = $account;
|
|
$_SESSION['name'] = $name;
|
|
$_SESSION['position'] = $position;
|
|
$_SESSION['ip'] = $ip;
|
|
|
|
log_auth($conn2, $user, $ip, $os, $browser, $thistime, "Login Success");
|
|
|
|
header("Location: main.php");
|
|
exit();
|
|
} else {
|
|
log_auth($conn2, $user, $ip, $os, $browser, $thistime, "2FA Authen Fail");
|
|
header("Location: error.php?message=Pass+Code");
|
|
exit();
|
|
}
|
|
} else {
|
|
log_auth($conn2, $user, $ip, $os, $browser, $thistime, "User/Pass Fail");
|
|
header("Location: error.php?message=" . urlencode("บัญชีผู้ใช้ / รหัสผ่าน"));
|
|
exit();
|
|
}
|
|
} catch (Exception $e) {
|
|
// If something crashes completely, show error
|
|
error_log("Authen Error: " . $e->getMessage());
|
|
header("Location: error.php?message=" . urlencode("ระบบฐานข้อมูลขัดข้อง"));
|
|
exit();
|
|
}
|
|
?>
|