76 lines
2.0 KiB
PHP
76 lines
2.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
require_once __DIR__ . '/session.php';
|
|
|
|
use App\Database\Database;
|
|
use App\Database\LoginManager;
|
|
|
|
if (!isset($_SESSION['login_attempts'])) {
|
|
$_SESSION['login_attempts'] = 0;
|
|
}
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
$login = trim((string) filter_input(INPUT_POST, 'login', FILTER_SANITIZE_FULL_SPECIAL_CHARS));
|
|
$password = trim((string) ($_POST['password'] ?? ''));
|
|
|
|
if ($login === '' || $password === '') {
|
|
$_SESSION['login_error'] = 'Veuillez renseigner votre login et votre mot de passe.';
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
$handleFailedAttempt = function (string $message): void {
|
|
$attempts = (int) ($_SESSION['login_attempts'] ?? 0) + 1;
|
|
$_SESSION['login_attempts'] = $attempts;
|
|
|
|
if ($attempts >= 5) {
|
|
$_SESSION['blocked'] = true;
|
|
header('Location: https://home.giraud-finance.com');
|
|
exit;
|
|
}
|
|
|
|
$_SESSION['login_error'] = $message;
|
|
header('Location: ../index.php');
|
|
exit;
|
|
};
|
|
|
|
try {
|
|
$database = new Database();
|
|
$loginManager = new LoginManager($database);
|
|
$user = $loginManager->getByLogin($login);
|
|
} catch (Throwable $exception) {
|
|
$_SESSION['login_error'] = 'Erreur interne : impossible de se connecter au service.';
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
if ($user === null) {
|
|
$handleFailedAttempt('Login ou mot de passe incorrect.');
|
|
}
|
|
|
|
if ((int) ($user['actif'] ?? 0) !== 1) {
|
|
$_SESSION['login_error'] = 'Votre compte n\'est pas encore activé. Veuillez contacter l\'administrateur.';
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
if (!password_verify($password, $user['pass'])) {
|
|
$handleFailedAttempt('Login ou mot de passe incorrect.');
|
|
}
|
|
|
|
session_regenerate_id(true);
|
|
$_SESSION['login_attempts'] = 0;
|
|
unset($_SESSION['blocked']);
|
|
$_SESSION['user_id'] = (int) $user['id'];
|
|
$_SESSION['user_login'] = $user['login'];
|
|
$_SESSION['user_name'] = trim($user['prenom'] . ' ' . $user['nom']);
|
|
|
|
header('Location: menu.php');
|
|
exit;
|