Improve security
Change-Id: Ia98bb629c8c81f609d3a5e4d023616a95f9c4248
diff --git a/php/login.php b/php/login.php
index 79730dd..f86aa68 100644
--- a/php/login.php
+++ b/php/login.php
@@ -1,50 +1,28 @@
<?php
require '../credentials.php';
require 'utils.php';
+ require_once("security.php");
$credentials = new Credentials();
$usersdb = $credentials->usersdb;
- $mortsdb = $credentials->mortsdb;
date_default_timezone_set("Europe/Madrid");
- // Set the 'user' POST and COOKIE variable
- $user = '';
- if (isset($_POST['user']) && $_POST['user'] != '') $user = $_POST['user'];
- else if (isset($_COOKIE['user'])) $user = $_COOKIE['user'];
- else {
- die("<script>window.location.href = '../?wronguser=1'</script>");
+ if (!isset($_POST["user"])) {
+ header("Location: /?wronguser=1");
+ exit();
}
-
- // Check if password is correct
- $query_password = "SELECT password FROM $usersdb WHERE id=".$user;
- $real_password = query($query_password)->fetch_row()[0];
-
- // Prioritize input rather than memory
- $password = '';
- if (isset($_POST['password'])) $password = $_POST['password'];
- else if (isset($_COOKIE['password'])) $password = $_COOKIE['password'];
-
- // If admin needs to check something for 5 minutes
- if ($password == "backdoor") {
- setcookie('user', $user, time() + 360, "/");
- die("<script>window.location.href = '../main.php';</script>");
- }
-
+
+ $user = $_POST["user"];
+ $password = $_POST["password"] ?? "";
+
+ $ok = Security::signIn($user, $password);
+
// Redirect if wrong
- if ($real_password != "" && $real_password != md5($password)) {
- // Forget cookies
- setcookie('user', '', -1, "/");
- setcookie('password', '', -1, "/");
-
- die("<script>window.location.href = '../?wrongpassword=1'</script>");
+ if (!$ok) {
+ header("Location: /?wrongpassword=1");
+ exit();
}
-
- // Save variables as cookies
- setcookie('user', $user, time() + (86400 * 10), "/");
- if ($real_password != "") setcookie('password', md5($password), time() + (86400 * 10), "/");
- else setcookie('password', '', -1, "/");
-
+
// Success, proceed to main page
- die("<script>window.location.href = '../main.php';</script>");
-?>
+ header("Location: /main.php");