David Dyer
c7b836bcf2
- Created `admin-head.php` for consistent <head> markup across admin pages. - Created `admin-nav.php` for shared navigation bar, reducing duplication. - Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components. - Added security headers to `auth.php` and `index.php` for improved security. - Introduced `security-headers.php` to manage security headers across the application. - Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP). - Normalized file permissions during build process to prevent permission issues on deployment.
80 lines
3.2 KiB
PHP
80 lines
3.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../inc/auth.php';
|
|
require_once __DIR__ . '/../inc/login-throttle.php';
|
|
require_once __DIR__ . '/../inc/assets.php';
|
|
require_once __DIR__ . '/../inc/admin-head.php';
|
|
|
|
$error = '';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$username = is_string($_POST['username'] ?? null) ? $_POST['username'] : '';
|
|
$password = is_string($_POST['password'] ?? null) ? $_POST['password'] : '';
|
|
$ip = client_ip();
|
|
$throttleKey = strtolower(trim($username));
|
|
$lockSeconds = login_lock_seconds($ip, $throttleKey);
|
|
|
|
if ($lockSeconds > 0) {
|
|
http_response_code(429);
|
|
$error = 'Too many failed attempts. Try again in ' . (int) ceil($lockSeconds / 60) . ' minute(s).';
|
|
} elseif (authenticate_user($username, $password)) {
|
|
clear_login_failures($ip, $throttleKey);
|
|
header('Location: index.php');
|
|
exit;
|
|
} else {
|
|
record_login_failure($ip, $throttleKey);
|
|
$error = 'Invalid username or password.';
|
|
}
|
|
}
|
|
?>
|
|
<!doctype html>
|
|
<html lang="en">
|
|
<?php render_admin_head('Sign In'); ?>
|
|
<body class="admin-login-body">
|
|
<div class="login-card">
|
|
<div class="login-header">
|
|
<img src="../assets/knot.png" alt="" class="knot">
|
|
<h1>The Old Fitz</h1>
|
|
<p>Management Portal</p>
|
|
</div>
|
|
|
|
<?php if (!empty($error)): ?>
|
|
<div class="error-msg" role="alert"><?= htmlspecialchars($error) ?></div>
|
|
<?php endif; ?>
|
|
|
|
<form method="POST" action="login.php">
|
|
<div class="form-group">
|
|
<label for="username">Username</label>
|
|
<input type="text" id="username" name="username" class="form-input" required autofocus autocomplete="username">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="password">Password</label>
|
|
<div class="password-input-wrap">
|
|
<input type="password" id="password" name="password" class="form-input" required autocomplete="current-password">
|
|
<button type="button" class="password-toggle-btn" aria-label="Show password" id="btn-toggle-login-password">
|
|
<span class="js-eye-open">
|
|
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="icon-eye">
|
|
<path d="M2 12s3-7 10-7 10 7 10 7-3 7-10 7-10-7-10-7Z" />
|
|
<circle cx="12" cy="12" r="3" />
|
|
</svg>
|
|
</span>
|
|
<span class="js-eye-off" hidden>
|
|
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="icon-eye-off">
|
|
<path d="M9.88 9.88a3 3 0 1 0 4.24 4.24" />
|
|
<path d="M10.73 5.08A10.43 10.43 0 0 1 12 5c7 0 10 7 10 7a13.16 13.16 0 0 1-1.67 2.68" />
|
|
<path d="M6.61 6.61A13.526 13.526 0 0 0 2 12s3 7 10 7a9.74 9.74 0 0 0 5.39-1.61" />
|
|
<line x1="2" y1="2" x2="22" y2="22" />
|
|
</svg>
|
|
</span>
|
|
</button>
|
|
</div>
|
|
</div>
|
|
<button type="submit" class="btn btn-primary login-btn">Sign In</button>
|
|
</form>
|
|
|
|
<a href="../" class="back-link">← Return to Pub Website</a>
|
|
</div>
|
|
|
|
<script src="login.js" defer></script>
|
|
</body>
|
|
</html>
|