-
Notifications
You must be signed in to change notification settings - Fork 0
/
login.php
131 lines (100 loc) · 4.55 KB
/
login.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
<?php
include 'incs/header.php';
if (isset($_SESSION['userId'])) {
header("location: 404.php");
exit();
}
include_once 'classes/dbh.php';
include_once 'classes/user.php';
// set a csrf token
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(64));
}
$sessionToken = $_SESSION['csrf_token'];
// check when the user was last active if it was more than 15 minutes ago, unset the csrf token
if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 900)) {
unset($_SESSION['csrf_token']);
unset($_SESSION['LAST_ACTIVITY']);
}
// update last activity time stamp
$_SESSION['LAST_ACTIVITY'] = time();
if (isset($_POST['submit'])) {
// if csrf token is not set, redirect to login page
if (!isset($_SESSION['csrf_token'])) {
header('location: login.php?error=csrfTokenInvalidSet');
die();
}
// check if csrf token is valid
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
header('location: login.php?error=csrfTokenInvalid');
unset($_SESSION['csrf_token']);
die();
}
$firstname = null;
$lastname = null;
$email = $_POST['email'];
$streetname = null;
$housenumber = null;
$postalcode = null;
$city = null;
$password = $_POST['password'];
$user = new User($firstname, $lastname, $email, $streetname, $housenumber, $postalcode, $city, $password);
$user->loginUser();
unset($_SESSION['csrf_token']);
header('location: index.php?error=none');
}
?>
<body>
<?php
include 'incs/navBar.php';
?>
<br>
<div class="login-wrapper">
<section class="side-login">
<img src="imgs/login.svg" alt="">
</section>
<section class="main-login">
<div class="login-container">
<p class="title">Welkom terug!</p>
<?php
if (isset($_GET["error"])) {
if ($_GET["error"] == "none") {
echo "<p class=\"error-message\" style='color:#7FB319;'>Account is sucsessvol ingelogd!</p>";
} else if ($_GET["error"] == "loginUserStmt1Failed") {
echo "<p class=\"error-message\" style='color:red'>oeps er is een onverwachte fout opgetreden, probeer het later opnieuw.</p>";
} else if ($_GET["error"] == "loginUserStmt2Failed") {
echo "<p class=\"error-message\" style='color:red'>oeps er is een onverwachte fout opgetreden, probeer het opnieuw.</p>";
} else if ($_GET["error"] == "loginUserStmt3Failed") {
echo "<p class=\"error-message\" style='color:red'>oeps er is een onverwachte fout opgetreden, probeer het opnieuw.</p>";
} else if ($_GET["error"] == "userNotFound") {
echo "<p class=\"error-message\" style='color:red'>Er is geen account gevonden met het ingevoerde e-mailadres. Probeer het alstublieft nog een keer.</p>";
} else if ($_GET["error"] == "wrongLoginCredentials") {
echo "<p class=\"error-message\" style='color:red'>Het ingevoerde e-mailadres of wachtwoord is onjuist. Probeer het alstublieft nog een keer.</p>";
}
elseif ($_GET["error"] == "csrfTokenInvalid") {
echo "<p class=\"error-message\" style='color:red'>Sessie is verlopen, probeer het opnieuw.</p>";
}
}
?>
<div class="separator"></div>
<p class="welcome-message">Geef uw inloggegevens op om door te gaan en toegang te krijgen tot al onze diensten</p>
<form class="login-form" method="post" action="">
<div class="form-control">
<input type="email" name="email" placeholder="E-mail">
<i class="fas fa-at"></i>
</div>
<div class="form-control">
<input type="password" name="password" placeholder="Wachtwoord">
<i class="fas fa-lock"></i>
</div>
<input type="hidden" name="csrf_token" value="<?php echo $sessionToken; ?>">
<button class="submit" type="submit" name="submit">Login</button>
</form>
<a href="register.php" class="register-login-text">Heeft u nog geen account? <span>Registreer hier!</span></a>
</div>
</section>
</div>
</body>
<?php
include 'incs/footer.php';
?>