Changes between Version 5 and Version 6 of ImportantCase0

Timestamp:

01/10/25 14:47:58 (10 months ago)

Author:

222039

Comment:

--

ImportantCase0

@@ -117 +117 @@
 По успешна регистрација корисникот се најавува со своето корисничко име и лозинка за да да пристапи до платформата.
 [[Image(BT-2.png)]]
+{{{#!sql
+<?php
+session_start();
+session_regenerate_id(true);
+
+// Rate limiting check
+if (isset($_SESSION['login_attempts']) && $_SESSION['login_attempts'] > 5) {
+    $timeout = 300; // 5 minutes timeout
+    if (time() - $_SESSION['last_attempt'] < $timeout) {
+        header("Location: /Sign&Log.php?error=TOO_MANY_ATTEMPTS");
+        exit();
+    } else {
+        $_SESSION['login_attempts'] = 0;
+    }
+}
+
+// Input validation
+if (empty($_POST['username']) || empty($_POST['password'])) {
+    header("Location: /Sign&Log.php?error=INVALID_CREDENTIALS");
+    exit();
+}
+
+require 'connect.php';
+
+try {
+    $username = trim(htmlspecialchars($_POST['username']));
+    
+    $sql = "SELECT * FROM Users WHERE username = :username";
+    $stmt = $conn->prepare($sql);
+    $stmt->bindParam(':username', $username, PDO::PARAM_STR);
+    $stmt->execute();
+    
+    if ($stmt->rowCount() <= 0) {
+        $_SESSION['login_attempts'] = isset($_SESSION['login_attempts']) ? $_SESSION['login_attempts'] + 1 : 1;
+        $_SESSION['last_attempt'] = time();
+        header("Location: /Sign&Log.php?error=INVALID_CREDENTIALS");
+        exit();
+    }
+
+    $res = $stmt->fetch(PDO::FETCH_ASSOC);
+    
+    if (!password_verify($_POST['password'], $res['password'])) {
+        $_SESSION['login_attempts'] = isset($_SESSION['login_attempts']) ? $_SESSION['login_attempts'] + 1 : 1;
+        $_SESSION['last_attempt'] = time();
+        header("Location: /Sign&Log.php?error=INVALID_CREDENTIALS");
+        exit();
+    }
+
+    $_SESSION['username'] = $username;
+    $_SESSION['userid'] = $res['userid'];
+    $_SESSION['role'] = $res['role'];
+    $_SESSION['last_activity'] = time();
+    $_SESSION['ip_address'] = $_SERVER['REMOTE_ADDR'];
+    
+    $_SESSION['login_attempts'] = 0;
+    
+    // Redirect based on role
+    if ($res['role'] == 'Admin') {
+        header("Location: ./Admin.php");
+    } else {
+        header("Location: ./HomePage.php");
+    }
+    
+} catch (PDOException $e) {
+    error_log("Login error: " . $e->getMessage());
+    header("Location: /Sign&Log.php?error=SERVER_ERROR");
+    exit();
+}
+}}}
 
 === Чекор 3 ===