dillard
6387d24846
Admin-scoped users (answers: who can create a 'user' account, only super or also an admin within their own scope?): - New owner_admin_id column on users (migration 004). NULL means created by super (company-wide, previous behavior); otherwise scoped to that admin's own codes. - Users::addUser/editUser/deleteUser now allow an 'admin' session, but force type='user' and owner_admin_id to their own id regardless of submitted input. user.php/users.php open up to admins with a restricted UI (no type picker, listing limited to their own created users). - New qr_compute_scope_owner_id()/qr_apply_owner_scope()/qr_has_full_visibility() helpers in includes/security.php, replacing the ad-hoc type==='admin' checks in index.php, dynamic_qrcodes.php, static_qrcodes.php and bulk_action.php. A 'user' account created by an admin is now scoped to that admin's codes instead of seeing everything company-wide. Qr code storage hardening: images were served as plain static files under the document root with no auth check at all. Storage now lives outside the web root; qrcode_image.php and qrcode_zip_download.php gate access with the same permission model as the list pages, and the bulk zip download is bound to the session that generated it. PHP 8.4 + chillerlan/php-qrcode 6.0.1: bumped since this is a dockerized app, so the PHP version shipped doesn't matter to end users. Note: the 6.0.1 tag itself only requires PHP 8.2 - the earlier "needs 8.4" read was from an unpinned clone of master, which has since moved past the tag. Fixed along the way, surfaced by testing on 8.4: - The hardcoded Imagick build (an old pinned master commit, workaround for 3.7.0 being broken on PHP 8.3+) no longer compiles on 8.4. Imagick 3.8.1 is now a normal stable release, so the workaround is gone. - config.php had display_errors=On + error_reporting(E_ALL), so PHP 8.4's new deprecation notices got dumped straight into the response before session_start() could run, breaking login outright. Also an info-disclosure risk on its own. Now logged instead of displayed. - MysqliDb::insertMulti() had an implicit nullable parameter, now explicit. - includes/auth_validate.php redirected unauthenticated requests but never called exit(), so the rest of the script kept running. - Dockerfile.fpm was missing both git (needed to clone chillerlan/php-qrcode) and the imagick extension entirely. Also removes the unused sample qr code images that shipped in the original repo; storage now lives outside the document root so they were never going to be served again.
99 lines
2.6 KiB
PHP
99 lines
2.6 KiB
PHP
<?php
|
|
|
|
require_once 'includes/bootstrap.php';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST')
|
|
{
|
|
csrf_verify_or_die();
|
|
|
|
$username = filter_input(INPUT_POST, 'username');
|
|
$password = filter_input(INPUT_POST, 'password');
|
|
$remember = filter_input(INPUT_POST, 'remember');
|
|
|
|
if (!$username || !$password) {
|
|
$_SESSION['login_failure'] = 'Invalid username or password';
|
|
header('Location: login.php');
|
|
exit;
|
|
}
|
|
|
|
if (qr_is_login_locked_out($username)) {
|
|
$_SESSION['login_failure'] = 'Too many failed login attempts. Try again in 15 minutes.';
|
|
header('Location: login.php');
|
|
exit;
|
|
}
|
|
|
|
// Get DB instance.
|
|
$db = getDbInstance();
|
|
|
|
$db->where('username', $username);
|
|
$row = $db->getOne('users');
|
|
|
|
if ($db->count >= 1 && password_verify($password, $row['password']))
|
|
{
|
|
qr_record_login_attempt($username, true);
|
|
|
|
// Voorkom session fixation: nieuwe sessie-id na een geslaagde login.
|
|
session_regenerate_id(true);
|
|
|
|
$_SESSION['user_logged_in'] = TRUE;
|
|
$_SESSION['type'] = $row['type'];
|
|
$_SESSION['user_id'] = $row['id'];
|
|
$_SESSION['username'] = $row['username'];
|
|
$_SESSION['must_change_password'] = !empty($row['must_change_password']);
|
|
$_SESSION['can_view_static'] = !empty($row['can_view_static']);
|
|
$_SESSION['can_view_dynamic'] = !empty($row['can_view_dynamic']);
|
|
$_SESSION['scope_owner_id'] = qr_compute_scope_owner_id($row);
|
|
$_SESSION['last_activity'] = time();
|
|
|
|
audit_log('login_success');
|
|
|
|
$user_id = $row['id'];
|
|
|
|
if ($remember)
|
|
{
|
|
$series_id = randomString(16);
|
|
$remember_token = getSecureRandomToken(20);
|
|
$encryted_remember_token = password_hash($remember_token,PASSWORD_DEFAULT);
|
|
|
|
$expiry_time = date('Y-m-d H:i:s', strtotime(' + 30 days'));
|
|
$expires = strtotime($expiry_time);
|
|
$is_https = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off';
|
|
|
|
$cookie_options = [
|
|
'expires' => $expires,
|
|
'path' => '/',
|
|
'secure' => $is_https,
|
|
'httponly' => true,
|
|
'samesite' => 'Lax',
|
|
];
|
|
|
|
setcookie('series_id', $series_id, $cookie_options);
|
|
setcookie('remember_token', $remember_token, $cookie_options);
|
|
|
|
$db = getDbInstance();
|
|
$db->where ('id',$user_id);
|
|
|
|
$update_remember = array(
|
|
'series_id'=> $series_id,
|
|
'remember_token' => $encryted_remember_token,
|
|
'expires' =>$expiry_time
|
|
);
|
|
$db->update('users', $update_remember);
|
|
}
|
|
// Authentication successfull redirect user
|
|
header('Location: index.php');
|
|
exit;
|
|
}
|
|
else
|
|
{
|
|
qr_record_login_attempt($username, false);
|
|
$_SESSION['login_failure'] = 'Invalid username or password';
|
|
header('Location: login.php');
|
|
exit;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
die('Method Not allowed');
|
|
}
|