andre/fitme3070.pt
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace Andmore ID SSO with local login

Browse Source 
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.

Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.

Added, ported from the fotografia.andmore.pt sibling rather than invented:

  - auth_login() with transparent password_needs_rehash upgrades and the
    last_login trail; auth_register_client(); auth_set_password(); the
    single-use 2h reset tokens.
  - Real login / register / forgot_password / reset_password pages on a new
    anonymous shell (includes/auth_header.php). includes/header.php renders
    the backoffice sidebar and a logout button, which is wrong for a visitor
    who is not signed in yet.
  - safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
    authenticated user off-site.
  - Per-IP throttling on login, register and reset-request. Successes count
    too, so a guessed password cannot be parlayed into stuffing the rest of
    the user list from the same IP.
  - views/user/set_password.php: admin override for anyone whose email is
    undeliverable. Prefers mailing an invite link so the backoffice never
    handles the password. A plain admin cannot act on a sysadmin, and nobody
    can use it on themselves — self-service goes through profile.php, which
    demands the current password so a hijacked session cannot lock the owner
    out.

Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.

users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.

Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
andreandClaude Opus 5 committed 2026-09-13 21:00:57 +01:00
1 parent dc8a36e126
commit aec7b47820
23 files changed
+1195 -710
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

views/auth/forgot_password.php
+77 -5
View File
@@ -1,10 +1,82 @@
<?php
// Password recovery lives on id.andmore.pt — every local form/handler was
// removed when this install became SSO-only. This file is a bounce-only stub.
// "Forgot password" request. Mints a single-use token in `password_resets` and
// emails the reset link through the centralized notify façade.
//
// The response is identical whether or not the address exists — otherwise this
// page would be an account-enumeration oracle.
//
// This is also how anyone carried over from the Andmore ID era sets their
// first local password: those rows have password_hash NULL, and the flow keys
// on the address on file, so only its owner can act on the link.
require __DIR__ . '/../../config/db.php';
require_once __DIR__ . '/../../config/functions.php';
$return_to = base_url('views/auth/login.php');
header('Location: ' . ANDMORE_ID_URL . 'auth/forgot_password.php?return_to=' . urlencode($return_to));
exit;
if (!empty($_SESSION['user_id'])) {
header('Location: ' . base_url(post_login_destination($_SESSION['user']['role'] ?? '')));
exit;
}
$sent = false;
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
// Tighter than login: minting a reset token costs an email each time.
if (!throttle_check($pdo, 'pwreset', 3, 10)) {
throttle_block('forgot password');
}
throttle_record($pdo, 'pwreset');
$email = trim($_POST['email'] ?? '');
if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
$error = 'Endereço de email inválido.';
} else {
$user = user_find_by_email($pdo, $email);
if ($user) {
$token = auth_create_reset_token($pdo, (int) $user['id']);
send_password_reset_email(
(string) $user['name'],
(string) $user['email'],
base_url('views/auth/reset_password.php?token=' . $token),
(int) $user['id']
);
}
// Same message either way.
$sent = true;
}
}
$page_title = 'Recuperar palavra-passe';
include __DIR__ . '/../../includes/auth_header.php';
?>
<p class="auth-sub">Enviamos-lhe um link para definir uma nova palavra-passe.</p>
<?php if ($error): ?>
<div class="alert alert-danger py-2 small"><?= htmlspecialchars($error) ?></div>
<?php endif; ?>
<?php if ($sent): ?>
<div class="alert alert-success py-2 small">
Se existir uma conta com esse email, enviámos-lhe as instruções.
O link é válido durante 2 horas.
</div>
<a href="<?= htmlspecialchars(base_url('views/auth/login.php')) ?>" class="btn btn-outline-secondary w-100">Voltar ao login</a>
<?php else: ?>
<form method="POST" novalidate>
<?= csrf_field() ?>
<div class="mb-4">
<label class="form-label" for="fp-email">Email</label>
<input type="email" id="fp-email" name="email" class="form-control" required autofocus
autocomplete="email" inputmode="email"
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
</div>
<button type="submit" class="btn btn-primary w-100">Enviar link</button>
</form>
<hr class="my-3">
<p class="text-center small mb-0 auth-foot">
<a href="<?= htmlspecialchars(base_url('views/auth/login.php')) ?>">Voltar ao login</a>
</p>
<?php endif; ?>
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>
views/auth/login.php
+90 -60
View File
@@ -1,76 +1,106 @@
<?php
// SSO-only platform: there is no local login form. All credentials live on
// id.andmore.pt. This file exists solely so old links / bookmarks pointing
// at /views/auth/login.php still land the visitor on the central form.
// Local login form. This install owns its passwords (users.password_hash);
// there is no identity provider in front of it.
//
// Also acts as the post-login landing for the id.andmore.pt return_to: the
// am_sso cookie is now in the browser, sso_resolve_session() picks it up,
// and we forward to the dashboard. The `?from=sso` flag prevents an infinite
// loop if resolution fails here — we render a clean error instead of
// bouncing back to id.andmore.pt (which would just send us back here again).
//
// Carries through the optional claim intent (?next=session&session_id=X)
// from the homepage "vagas disponíveis" cards so that after authenticating
// the user lands on their dashboard scrolled to the open session.
// Carries through ?return_to=/path, set by require_login(), so the visitor
// lands back on the page they originally asked for.
require __DIR__ . '/../../config/db.php';
require_once __DIR__ . '/../../config/functions.php';
// Establish the session on return from the hub. fitme3070.pt is off the
// .andmore.pt cookie scope, so the real handoff is the one-time ?sso_ticket=…
// the hub appended to this return URL — redeem it. (sso_resolve_session() is
// kept as a fallback for the rare case a same-site am_sso cookie is present.)
if (empty($_SESSION['user_id']) && identity_is_federated()) {
if (!empty($_GET['sso_ticket'])) {
sso_redeem_ticket($pdo, (string) $_GET['sso_ticket']);
}
if (empty($_SESSION['user_id'])) {
sso_resolve_session($pdo);
}
}
$return_to = safe_return_path($_GET['return_to'] ?? '');
$next = $_GET['next'] ?? '';
$session_id = (int) ($_GET['session_id'] ?? 0);
$claim_intent = ($next === 'session' && $session_id > 0);
$from_sso = isset($_GET['from']) && $_GET['from'] === 'sso';
$dashboard_for = function (string $role) use ($claim_intent, $session_id): string {
if ($claim_intent && $role === 'client') {
return 'views/user/dashboard.php?focus_session=' . $session_id;
}
return post_login_destination($role);
$destination = function (string $role) use ($return_to): string {
return $return_to !== '' ? $return_to : post_login_destination($role);
};
if (!empty($_SESSION['user_id'])) {
header('Location: ' . base_url($dashboard_for($_SESSION['user']['role'] ?? '')));
header('Location: ' . base_url($destination($_SESSION['user']['role'] ?? '')));
exit;
}
// We came back from id.andmore.pt but sso_resolve_session() couldn't pick up
// a valid session. Bouncing to id.andmore.pt again would loop forever — show
// a clean error instead so the user can see what's wrong.
if ($from_sso) {
http_response_code(500);
$am_cookie_present = !empty($_COOKIE[SSO_COOKIE_NAME] ?? '');
?><!doctype html><html lang="pt"><head><meta charset="utf-8"><title>Erro de autenticação</title>
<style>body{font-family:system-ui,-apple-system,sans-serif;max-width:560px;margin:80px auto;padding:0 1.5rem;color:#1c1c1a;background:#f7f5f1;line-height:1.6}h1{font-weight:300;font-size:1.6rem;margin-bottom:.5rem}code{background:rgba(0,0,0,.05);padding:2px 6px;border-radius:3px;font-size:.9em}.muted{color:#6b6863;font-size:.9rem}a{color:#5a7a62}</style>
</head><body>
<h1>Não foi possível concluir o login</h1>
<p>O servidor Andmore ID autenticou-o, mas esta plataforma não conseguiu carregar a sua sessão.</p>
<p class="muted">
Cookie <code>am_sso</code>: <?= $am_cookie_present ? 'presente' : '<strong>em falta</strong>' ?>.<br>
Plataforma: <code><?= htmlspecialchars(PLATFORM_SLUG) ?></code> · Modo: <code><?= htmlspecialchars(IDENTITY_MODE) ?></code>.
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
// Counts successes too, so a guessed password can't be parlayed into
// stuffing the rest of the user list from the same IP.
if (!throttle_check($pdo, 'login')) {
throttle_block('login form');
}
throttle_record($pdo, 'login');
$user = auth_login($pdo, $_POST['email'] ?? '', $_POST['password'] ?? '');
if ($user) {
auth_set_session($user);
header('Location: ' . base_url($destination($user['role'])));
exit;
}
// Deliberately vague — doesn't reveal whether the address exists.
$error = 'Email ou palavra-passe incorretos.';
}
// Preserve the redirect intent across the POST.
$form_qs = $return_to !== '' ? ('?' . http_build_query(['return_to' => $_GET['return_to'] ?? ''])) : '';
$page_title = 'Entrar';
include __DIR__ . '/../../includes/auth_header.php';
?>
<p class="auth-sub">Entre na sua conta para continuar.</p>
<?php if ($error): ?>
<div class="alert alert-danger py-2 small mb-2"><?= htmlspecialchars($error) ?></div>
<?php // Shown on any failure — an account created by an admin (or carried
// over from the Andmore ID era) has no password yet and would
// otherwise be stuck here. Phrased so it never confirms the address
// exists. ?>
<p class="small auth-foot">
Se a sua conta foi criada por nós, ainda não tem palavra-passe definida —
use <a href="<?= htmlspecialchars(base_url('views/auth/forgot_password.php')) ?>">Esqueceu a palavra-passe?</a>
para definir uma.
</p>
<p><a href="<?= htmlspecialchars(base_url('index.php')) ?>">Voltar ao início</a> · <a href="<?= htmlspecialchars(base_url('views/auth/logout.php')) ?>">Tentar novamente</a></p>
</body></html><?php
exit;
}
<?php endif; ?>
<?php if (isset($_GET['registered'])): ?>
<div class="alert alert-success py-2 small">Conta criada. Já pode entrar.</div>
<?php endif; ?>
<?php if (isset($_GET['reset'])): ?>
<div class="alert alert-success py-2 small">Palavra-passe alterada. Entre com a nova palavra-passe.</div>
<?php endif; ?>
<?php if (isset($_GET['loggedout'])): ?>
<div class="alert alert-success py-2 small">Sessão terminada.</div>
<?php endif; ?>
// First arrival — bounce to id.andmore.pt for credentials, tagging the
// return URL with ?from=sso so the loop-guard above fires on the way back.
$return_to = base_url('views/auth/login.php?from=sso'
. ($claim_intent ? '&next=session&session_id=' . $session_id : ''));
<form method="POST" action="<?= htmlspecialchars('login.php' . $form_qs) ?>" novalidate>
<?= csrf_field() ?>
<div class="mb-3">
<label class="form-label" for="login-email">Email</label>
<input type="email" id="login-email" name="email" class="form-control" required autofocus
autocomplete="email" inputmode="email"
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
</div>
<div class="mb-4">
<!-- O link de recuperação vem DEPOIS do input: dentro do <label> ficava
antes dele no DOM, e o Tab a partir do email saltava para o link
em vez de ir para a palavra-passe. -->
<label class="form-label" for="login-password">Palavra-passe</label>
<div class="input-group">
<input type="password" id="login-password" name="password" class="form-control" required
autocomplete="current-password">
<button class="btn btn-outline-secondary" type="button" tabindex="-1"
data-toggle-password="login-password" aria-label="Mostrar palavra-passe">
<i class="bi bi-eye"></i>
</button>
</div>
<div class="text-end mt-1">
<a href="<?= htmlspecialchars(base_url('views/auth/forgot_password.php')) ?>" class="small">Esqueceu a <span class="text-nowrap">palavra-passe</span>?</a>
</div>
</div>
<button type="submit" class="btn btn-primary w-100">Entrar</button>
</form>
$_login_qs = '?return_to=' . urlencode($return_to) . '&platform=' . urlencode(PLATFORM_SLUG);
header('Location: ' . ANDMORE_ID_URL . 'auth/login.php' . $_login_qs);
exit;
<hr class="my-3">
<p class="text-center small mb-0 auth-foot">
Novo cliente?
<a href="<?= htmlspecialchars(base_url('views/auth/register.php')) ?>">Criar conta</a>
</p>
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>
views/auth/logout.php
+9 -18
View File
@@ -1,26 +1,17 @@
<?php
// Ends the local session. Nothing to coordinate with an identity provider —
// this install owns its own sessions.
require __DIR__ . '/../../config/db.php';
require __DIR__ . '/../../config/functions.php';
// Always clear the local session first.
$_SESSION = [];
// Drop the cookie too, so the browser doesn't keep presenting a dead id.
if (ini_get('session.use_cookies')) {
$p = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
}
session_destroy();
// Federated mode: always bounce through Andmore ID's logout endpoint so both
// the central sso_sessions row and the am_sso cookie are destroyed AND
// id.andmore.pt's own PHP session is cleared. The old check for the am_sso
// cookie was a bug: if the cookie happened to be absent from $_COOKIE (e.g.
// due to a Secure-flag or SameSite edge case), the central logout was skipped,
// leaving id.andmore.pt's session alive. That session then caused a redirect
// loop — id.andmore.pt auto-logged the user in and bounced them back to the
// login stub, which immediately bounced them back to id.andmore.pt, ad inf.
//
// Return to the public landing page (not the login stub) so the post-logout
// redirect from id.andmore.pt lands on a real page and the chain stops.
if (identity_is_federated()) {
header('Location: ' . ANDMORE_ID_URL . 'auth/logout.php?return_to=' . urlencode(APP_BASE_URL));
exit;
}
header('Location: ' . base_url('views/auth/login.php'));
header('Location: ' . base_url('views/auth/login.php?loggedout=1'));
exit;
views/auth/register.php
+116 -25
View File
@@ -1,35 +1,126 @@
<?php
// SSO-only platform: there is no local registration form. Accounts live on
// id.andmore.pt and are mirrored locally by sso_resolve_session() the first
// time the user lands on this platform. This file exists only so old
// /views/auth/register.php links bounce through to the central registration.
// Local self-registration for clients. Creates (or claims — see
// auth_register_client) a `client` row with a password and signs the person in.
require __DIR__ . '/../../config/db.php';
require_once __DIR__ . '/../../config/functions.php';
// Already authenticated? Skip the bounce and land on the right dashboard.
if (empty($_SESSION['user_id']) && identity_is_federated()) {
sso_resolve_session($pdo);
}
$next = $_GET['next'] ?? '';
$session_id = (int) ($_GET['session_id'] ?? 0);
$claim_intent = ($next === 'session' && $session_id > 0);
$dashboard_for = function (string $role) use ($claim_intent, $session_id): string {
if ($claim_intent && $role === 'client') {
return 'views/user/dashboard.php?focus_session=' . $session_id;
}
return post_login_destination($role);
};
if (!empty($_SESSION['user_id'])) {
header('Location: ' . base_url($dashboard_for($_SESSION['user']['role'] ?? '')));
header('Location: ' . base_url(post_login_destination($_SESSION['user']['role'] ?? '')));
exit;
}
$return_to = base_url('views/auth/login.php'
. ($claim_intent ? '?next=session&session_id=' . $session_id : ''));
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
header('Location: ' . ANDMORE_ID_URL . 'auth/register.php?return_to=' . urlencode($return_to));
exit;
// Tighter than login: each signup writes a row.
if (!throttle_check($pdo, 'register', 3, 10)) {
throttle_block('register form');
}
throttle_record($pdo, 'register');
$name = trim($_POST['name'] ?? '');
$email = trim($_POST['email'] ?? '');
$phone = trim($_POST['phone'] ?? '');
$password = $_POST['password'] ?? '';
$confirm = $_POST['confirm'] ?? '';
if ($name === '' || $email === '' || $password === '') {
$error = 'Nome, email e palavra-passe são obrigatórios.';
} elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$error = 'Endereço de email inválido.';
} elseif (strlen($password) < 8) {
$error = 'A palavra-passe deve ter pelo menos 8 caracteres.';
} elseif ($password !== $confirm) {
$error = 'As palavras-passe não coincidem.';
} elseif (empty($_POST['accept_terms'])) {
$error = 'É necessário aceitar a política de privacidade.';
} else {
$res = auth_register_client($pdo, [
'name' => $name,
'email' => $email,
'phone' => $phone,
'password' => $password,
'marketing_consent' => !empty($_POST['marketing_consent']),
]);
if (isset($res['error'])) {
$error = 'Já existe uma conta com esse email. Use "Esqueceu a palavra-passe?" para entrar.';
} else {
// Sign the new client straight in rather than bouncing them to the
// login form with credentials they just typed.
$user = db_get_user($pdo, (int) $res['id']);
if ($user) {
auth_set_session($user);
header('Location: ' . base_url(post_login_destination($user['role'])));
exit;
}
header('Location: ' . base_url('views/auth/login.php?registered=1'));
exit;
}
}
}
$page_title = 'Criar conta';
include __DIR__ . '/../../includes/auth_header.php';
?>
<p class="auth-sub">Crie a sua conta de cliente.</p>
<?php if ($error): ?>
<div class="alert alert-danger py-2 small"><?= htmlspecialchars($error) ?></div>
<?php endif; ?>
<form method="POST" novalidate>
<?= csrf_field() ?>
<div class="mb-3">
<label class="form-label" for="reg-name">Nome</label>
<input type="text" id="reg-name" name="name" class="form-control" required autofocus
autocomplete="name" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>">
</div>
<div class="mb-3">
<label class="form-label" for="reg-email">Email</label>
<input type="email" id="reg-email" name="email" class="form-control" required
autocomplete="email" inputmode="email"
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
</div>
<div class="mb-3">
<label class="form-label" for="reg-phone">Telefone <span class="text-muted small">(opcional)</span></label>
<input type="tel" id="reg-phone" name="phone" class="form-control"
autocomplete="tel" value="<?= htmlspecialchars($_POST['phone'] ?? '') ?>">
</div>
<div class="mb-3">
<label class="form-label" for="reg-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<div class="input-group">
<input type="password" id="reg-password" name="password" class="form-control" required minlength="8"
autocomplete="new-password">
<button class="btn btn-outline-secondary" type="button" tabindex="-1"
data-toggle-password="reg-password" aria-label="Mostrar palavra-passe">
<i class="bi bi-eye"></i>
</button>
</div>
</div>
<div class="mb-3">
<label class="form-label" for="reg-confirm">Confirmar palavra-passe</label>
<input type="password" id="reg-confirm" name="confirm" class="form-control" required
autocomplete="new-password">
</div>
<div class="form-check small mb-2">
<input class="form-check-input" type="checkbox" name="accept_terms" id="reg-terms" value="1"
<?= !empty($_POST['accept_terms']) ? 'checked' : '' ?>>
<label class="form-check-label" for="reg-terms">
Li e aceito a <a href="<?= htmlspecialchars(base_url('home/privacidade')) ?>" target="_blank" rel="noopener">política de privacidade</a>.
</label>
</div>
<div class="form-check small mb-4">
<input class="form-check-input" type="checkbox" name="marketing_consent" id="reg-marketing" value="1"
<?= !empty($_POST['marketing_consent']) ? 'checked' : '' ?>>
<label class="form-check-label" for="reg-marketing">Aceito receber comunicações de marketing.</label>
</div>
<button type="submit" class="btn btn-primary w-100">Criar conta</button>
</form>
<hr class="my-3">
<p class="text-center small mb-0 auth-foot">
Já tem conta? <a href="<?= htmlspecialchars(base_url('views/auth/login.php')) ?>">Entrar</a>
</p>
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>
views/auth/reset_password.php
+73 -5
View File
@@ -1,10 +1,78 @@
<?php
// Password reset happens on id.andmore.pt — bounce anyone landing here with
// an old reset link so they don't get a "page not working" experience.
// Consumes a `password_resets` token and sets a new password. Tokens are
// single-use and expire 2 hours after being minted (auth_create_reset_token).
// Also serves the "define a sua palavra-passe" invitation links.
require __DIR__ . '/../../config/db.php';
require_once __DIR__ . '/../../config/functions.php';
header('Location: ' . ANDMORE_ID_URL . 'auth/forgot_password.php?return_to='
. urlencode(base_url('views/auth/login.php')));
exit;
if (!empty($_SESSION['user_id'])) {
header('Location: ' . base_url(post_login_destination($_SESSION['user']['role'] ?? '')));
exit;
}
// The token travels in the query string on the GET and in a hidden field on
// the POST, so a mistyped/expired one is caught before rendering the form.
$token = (string) ($_POST['token'] ?? $_GET['token'] ?? '');
$reset = $token !== '' ? auth_get_valid_reset_token($pdo, $token) : false;
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $reset) {
csrf_check();
$password = $_POST['password'] ?? '';
$confirm = $_POST['confirm'] ?? '';
if (strlen($password) < 8) {
$error = 'A palavra-passe deve ter pelo menos 8 caracteres.';
} elseif ($password !== $confirm) {
$error = 'As palavras-passe não coincidem.';
} elseif (auth_consume_reset_token($pdo, $token, $password)) {
header('Location: ' . base_url('views/auth/login.php?reset=1'));
exit;
} else {
$error = 'Não foi possível repor a palavra-passe. Peça um novo link.';
}
}
$page_title = 'Nova palavra-passe';
include __DIR__ . '/../../includes/auth_header.php';
?>
<?php if (!$reset): ?>
<p class="auth-sub">Este link já não é válido.</p>
<div class="alert alert-warning py-2 small">
O link expirou ou já foi utilizado. Peça um novo para continuar.
</div>
<a href="<?= htmlspecialchars(base_url('views/auth/forgot_password.php')) ?>" class="btn btn-primary w-100">Pedir novo link</a>
<?php else: ?>
<p class="auth-sub">
A definir uma nova palavra-passe para <strong><?= htmlspecialchars($reset['email']) ?></strong>.
</p>
<?php if ($error): ?>
<div class="alert alert-danger py-2 small"><?= htmlspecialchars($error) ?></div>
<?php endif; ?>
<form method="POST" novalidate>
<?= csrf_field() ?>
<input type="hidden" name="token" value="<?= htmlspecialchars($token) ?>">
<div class="mb-3">
<label class="form-label" for="rp-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<div class="input-group">
<input type="password" id="rp-password" name="password" class="form-control" required minlength="8"
autocomplete="new-password" autofocus>
<button class="btn btn-outline-secondary" type="button" tabindex="-1"
data-toggle-password="rp-password" aria-label="Mostrar palavra-passe">
<i class="bi bi-eye"></i>
</button>
</div>
</div>
<div class="mb-4">
<label class="form-label" for="rp-confirm">Confirmar palavra-passe</label>
<input type="password" id="rp-confirm" name="confirm" class="form-control" required
autocomplete="new-password">
</div>
<button type="submit" class="btn btn-primary w-100">Guardar palavra-passe</button>
</form>
<?php endif; ?>
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>
views/auth/setup.php
+36 -42
View File
@@ -39,48 +39,42 @@ if ($alreadyDone) {
}
}
include __DIR__ . '/../../includes/header.php';
$page_title = 'Configuração inicial';
include __DIR__ . '/../../includes/auth_header.php';
?>
<div class="container" style="max-width:480px; margin-top:80px;">
<div class="card shadow-sm">
<div class="card-body p-4">
<h3 class="mb-1">Configuração inicial</h3>
<p class="text-muted small mb-4">Crie a conta de administrador. Elimine este ficheiro depois.</p>
<p class="auth-sub">Crie a conta de administrador. Elimine este ficheiro depois.</p>
<?php if ($error): ?>
<div class="alert alert-danger"><?= htmlspecialchars($error) ?></div>
<?php endif; ?>
<?php if ($success): ?>
<div class="alert alert-success"><?= $success ?></div>
<?php elseif (!$alreadyDone): ?>
<form method="POST">
<?= csrf_field() ?>
<div class="mb-3">
<label class="form-label" for="setup-name">Nome</label>
<input type="text" id="setup-name" name="name" class="form-control" required
autocomplete="name"
value="<?= htmlspecialchars($_POST['name'] ?? '') ?>">
</div>
<div class="mb-3">
<label class="form-label" for="setup-email">Email</label>
<input type="email" id="setup-email" name="email" class="form-control" required
autocomplete="email" inputmode="email"
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
</div>
<div class="mb-3">
<label class="form-label" for="setup-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<input type="password" id="setup-password" name="password" class="form-control" required minlength="8"
autocomplete="new-password">
</div>
<div class="mb-4">
<label class="form-label" for="setup-confirm">Confirmar palavra-passe</label>
<input type="password" id="setup-confirm" name="confirm" class="form-control" required
autocomplete="new-password">
</div>
<button type="submit" class="btn btn-primary w-100">Criar conta de administrador</button>
</form>
<?php endif; ?>
</div>
<?php if ($error): ?>
<div class="alert alert-danger"><?= htmlspecialchars($error) ?></div>
<?php endif; ?>
<?php if ($success): ?>
<div class="alert alert-success"><?= $success ?></div>
<?php elseif (!$alreadyDone): ?>
<form method="POST">
<?= csrf_field() ?>
<div class="mb-3">
<label class="form-label" for="setup-name">Nome</label>
<input type="text" id="setup-name" name="name" class="form-control" required
autocomplete="name"
value="<?= htmlspecialchars($_POST['name'] ?? '') ?>">
</div>
</div>
<?php include __DIR__ . '/../../includes/footer.php'; ?>
<div class="mb-3">
<label class="form-label" for="setup-email">Email</label>
<input type="email" id="setup-email" name="email" class="form-control" required
autocomplete="email" inputmode="email"
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
</div>
<div class="mb-3">
<label class="form-label" for="setup-password">Palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<input type="password" id="setup-password" name="password" class="form-control" required minlength="8"
autocomplete="new-password">
</div>
<div class="mb-4">
<label class="form-label" for="setup-confirm">Confirmar palavra-passe</label>
<input type="password" id="setup-confirm" name="confirm" class="form-control" required
autocomplete="new-password">
</div>
<button type="submit" class="btn btn-primary w-100">Criar conta de administrador</button>
</form>
<?php endif; ?>
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>
views/user/index.php
+14 -3
View File
@@ -4,7 +4,7 @@ require __DIR__ . '/../../config/functions.php';
$user = require_admin();
$users = $pdo->query(
"SELECT id, name, email, phone, role, is_active, andmore_id, last_login_at, last_login_ua
"SELECT id, name, email, phone, role, is_active, password_hash, last_login_at, last_login_ua
FROM users ORDER BY FIELD(role,'sysadmin','admin','staff','client'), name"
)->fetchAll(PDO::FETCH_ASSOC);
@@ -17,7 +17,7 @@ include __DIR__ . '/../../includes/header.php';
<table class="am-datatable table table-hover align-middle">
<thead><tr>
<th>Nome</th><th>Email</th><th>Perfil</th><th>Ativo</th>
<th>Andmore ID</th><th>Último acesso</th>
<th>Palavra-passe</th><th>Último acesso</th><th></th>
</tr></thead>
<tbody>
<?php foreach ($users as $u): ?>
@@ -26,13 +26,24 @@ include __DIR__ . '/../../includes/header.php';
<td><?= htmlspecialchars($u['email']) ?></td>
<td><span class="badge text-bg-secondary"><?= htmlspecialchars(role_label($u['role'])) ?></span></td>
<td><?= $u['is_active'] ? '<i class="bi bi-check-circle text-success"></i>' : '<i class="bi bi-x-circle text-muted"></i>' ?></td>
<td><?= $u['andmore_id'] ? (int) $u['andmore_id'] : '<span class="text-muted">—</span>' ?></td>
<td>
<?php if (!empty($u['password_hash'])): ?>
<i class="bi bi-key-fill text-success" title="Definida"></i>
<?php else: ?>
<span class="badge text-bg-warning-subtle text-warning-emphasis">Por definir</span>
<?php endif; ?>
</td>
<td class="small text-muted">
<?php if ($u['last_login_at']): ?>
<?= htmlspecialchars(format_date_pt($u['last_login_at'])) ?>
· <?= htmlspecialchars(parse_user_agent((string) $u['last_login_ua'])) ?>
<?php else: ?>—<?php endif; ?>
</td>
<td class="text-end">
<a class="btn btn-sm btn-outline-secondary"
href="<?= base_url('views/user/set_password.php?id=' . (int) $u['id']) ?>"
title="Gerir palavra-passe"><i class="bi bi-key"></i></a>
</td>
</tr>
<?php endforeach; ?>
</tbody>
views/user/profile.php
+69 -28
View File
@@ -3,24 +3,51 @@ require __DIR__ . '/../../config/db.php';
require __DIR__ . '/../../config/functions.php';
$user = require_login();
// Editable per-tenant fields only. Name/email are owned by Andmore ID and synced
// on login by sso_resolve_session(); the password is managed centrally.
$saved = false;
// Two forms on this page, told apart by the hidden `form` field: the contact
// details and the password change. Name and email are not self-editable — an
// admin changes those, so a client can't quietly take over another address.
$saved = false;
$pw_saved = false;
$pw_error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
$phone = trim($_POST['phone'] ?? '');
$address = trim($_POST['address'] ?? '');
$city = trim($_POST['city'] ?? '');
$postal_code = trim($_POST['postal_code'] ?? '');
$email_opt = isset($_POST['email_opt_out']) ? 1 : 0;
$sms_opt = isset($_POST['sms_opt_out']) ? 1 : 0;
$marketing = isset($_POST['marketing_consent']) ? 1 : 0;
$pdo->prepare(
"UPDATE users SET phone=?, address=?, city=?, postal_code=?,
email_opt_out=?, sms_opt_out=?, marketing_consent=?
WHERE id=?"
)->execute([$phone, $address, $city, $postal_code, $email_opt, $sms_opt, $marketing, $user['id']]);
$saved = true;
if (($_POST['form'] ?? '') === 'password') {
$current = $_POST['current_password'] ?? '';
$new = $_POST['new_password'] ?? '';
$confirm = $_POST['confirm_password'] ?? '';
// Re-authenticate against the stored hash: a hijacked session must not
// be enough to change the password and lock the owner out.
$row = db_get_user($pdo, (int) $user['id']);
if (!$row || empty($row['password_hash']) || !password_verify($current, $row['password_hash'])) {
$pw_error = 'A palavra-passe atual está incorreta.';
} elseif (strlen($new) < 8) {
$pw_error = 'A nova palavra-passe deve ter pelo menos 8 caracteres.';
} elseif ($new !== $confirm) {
$pw_error = 'As palavras-passe não coincidem.';
} else {
auth_set_password($pdo, (int) $user['id'], $new);
// Fresh session id on a credential change — see auth_set_session().
auth_set_session($row);
$pw_saved = true;
}
} else {
$phone = trim($_POST['phone'] ?? '');
$address = trim($_POST['address'] ?? '');
$city = trim($_POST['city'] ?? '');
$postal_code = trim($_POST['postal_code'] ?? '');
$email_opt = isset($_POST['email_opt_out']) ? 1 : 0;
$sms_opt = isset($_POST['sms_opt_out']) ? 1 : 0;
$marketing = isset($_POST['marketing_consent']) ? 1 : 0;
$pdo->prepare(
"UPDATE users SET phone=?, address=?, city=?, postal_code=?,
email_opt_out=?, sms_opt_out=?, marketing_consent=?
WHERE id=?"
)->execute([$phone, $address, $city, $postal_code, $email_opt, $sms_opt, $marketing, $user['id']]);
$saved = true;
}
}
$row = db_get_user($pdo, (int) $user['id']) ?? [];
@@ -33,22 +60,21 @@ include __DIR__ . '/../../includes/header.php';
<div class="card shadow-sm mb-3"><div class="card-body">
<div class="row mb-2"><div class="col-4 text-muted">Nome</div><div class="col-8"><?= htmlspecialchars($row['name'] ?? '') ?></div></div>
<div class="row mb-2"><div class="col-4 text-muted">Email</div><div class="col-8"><?= htmlspecialchars($row['email'] ?? '') ?></div></div>
<p class="text-muted small mb-0">Nome, email e palavra-passe são geridos no Andmore ID.
<a href="<?= htmlspecialchars(rtrim(ANDMORE_ID_URL, '/')) ?>/" target="_blank" rel="noopener">Gerir conta &rarr;</a>
</p>
<p class="text-muted small mb-0">Para alterar o nome ou o email, contacte-nos.</p>
</div></div>
<form method="POST" class="card shadow-sm"><div class="card-body">
<form method="POST" class="card shadow-sm mb-3"><div class="card-body">
<?= csrf_field() ?>
<div class="mb-3"><label class="form-label">Telefone</label>
<input class="form-control" name="phone" value="<?= htmlspecialchars($row['phone'] ?? '') ?>"></div>
<div class="mb-3"><label class="form-label">Morada</label>
<input class="form-control" name="address" value="<?= htmlspecialchars($row['address'] ?? '') ?>"></div>
<input type="hidden" name="form" value="details">
<div class="mb-3"><label class="form-label" for="pf-phone">Telefone</label>
<input class="form-control" id="pf-phone" name="phone" value="<?= htmlspecialchars($row['phone'] ?? '') ?>"></div>
<div class="mb-3"><label class="form-label" for="pf-address">Morada</label>
<input class="form-control" id="pf-address" name="address" value="<?= htmlspecialchars($row['address'] ?? '') ?>"></div>
<div class="row">
<div class="col-md-8 mb-3"><label class="form-label">Localidade</label>
<input class="form-control" name="city" value="<?= htmlspecialchars($row['city'] ?? '') ?>"></div>
<div class="col-md-4 mb-3"><label class="form-label">Código postal</label>
<input class="form-control" name="postal_code" value="<?= htmlspecialchars($row['postal_code'] ?? '') ?>"></div>
<div class="col-md-8 mb-3"><label class="form-label" for="pf-city">Localidade</label>
<input class="form-control" id="pf-city" name="city" value="<?= htmlspecialchars($row['city'] ?? '') ?>"></div>
<div class="col-md-4 mb-3"><label class="form-label" for="pf-postal">Código postal</label>
<input class="form-control" id="pf-postal" name="postal_code" value="<?= htmlspecialchars($row['postal_code'] ?? '') ?>"></div>
</div>
<div class="form-check"><input class="form-check-input" type="checkbox" name="email_opt_out" id="eo" <?= !empty($row['email_opt_out']) ? 'checked' : '' ?>>
<label class="form-check-label" for="eo">Não receber emails</label></div>
@@ -58,5 +84,20 @@ include __DIR__ . '/../../includes/header.php';
<label class="form-check-label" for="mc">Aceito comunicações de marketing</label></div>
<button class="btn btn-primary">Guardar</button>
</div></form>
<form method="POST" class="card shadow-sm"><div class="card-body">
<?= csrf_field() ?>
<input type="hidden" name="form" value="password">
<h2 class="h6 mb-3">Alterar palavra-passe</h2>
<?php if ($pw_saved): ?><div class="alert alert-success py-2 small">Palavra-passe alterada.</div><?php endif; ?>
<?php if ($pw_error): ?><div class="alert alert-danger py-2 small"><?= htmlspecialchars($pw_error) ?></div><?php endif; ?>
<div class="mb-3"><label class="form-label" for="pf-current">Palavra-passe atual</label>
<input type="password" class="form-control" id="pf-current" name="current_password" required autocomplete="current-password"></div>
<div class="mb-3"><label class="form-label" for="pf-new">Nova palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<input type="password" class="form-control" id="pf-new" name="new_password" required minlength="8" autocomplete="new-password"></div>
<div class="mb-3"><label class="form-label" for="pf-confirm">Confirmar nova palavra-passe</label>
<input type="password" class="form-control" id="pf-confirm" name="confirm_password" required autocomplete="new-password"></div>
<button class="btn btn-primary">Alterar palavra-passe</button>
</div></form>
</div>
<?php include __DIR__ . '/../../includes/footer.php'; ?>
views/user/set_password.php
+121
View File
@@ -0,0 +1,121 @@
<?php
// Admin override for a user's password — the way in for anyone whose email is
// wrong or undeliverable, and for the accounts carried over from the Andmore ID
// era that have no local password yet.
//
// Two actions:
// set — write a password the admin chose, and read it out once.
// invite — mail a single-use "define a sua palavra-passe" link instead, so
// the admin never handles the password at all. Preferred.
require __DIR__ . '/../../config/db.php';
require __DIR__ . '/../../config/functions.php';
$user = require_admin();
$target = db_get_user($pdo, (int) ($_GET['id'] ?? $_POST['id'] ?? 0));
if (!$target) {
header('Location: ' . base_url('views/user/index.php'));
exit;
}
// Guards. Self-service goes through profile.php, which demands the current
// password — routing it through here would let a hijacked admin session change
// the password without knowing the old one. And a plain admin must not be able
// to take over a sysadmin account; only a sysadmin can act on a sysadmin.
$is_self = ((int) $target['id'] === (int) $user['id']);
$blocked = '';
if ($is_self) {
$blocked = 'Para alterar a sua própria palavra-passe use O meu perfil.';
} elseif ($target['role'] === 'sysadmin' && !is_sysadmin()) {
$blocked = 'Apenas um administrador de sistema pode alterar a palavra-passe de outro administrador de sistema.';
}
$error = '';
$success = '';
$plain = ''; // shown once, only for the `set` action
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $blocked === '') {
csrf_check();
$action = $_POST['action'] ?? '';
if ($action === 'invite') {
if (send_password_invite_email($pdo, $target)) {
$success = 'Email enviado para ' . $target['email'] . '. O link é válido durante 2 horas.';
} else {
$error = 'Não foi possível enviar o email. Verifique as definições de notificações e tente novamente.';
}
} elseif ($action === 'set') {
$password = $_POST['password'] ?? '';
$confirm = $_POST['confirm'] ?? '';
if (strlen($password) < 8) {
$error = 'A palavra-passe deve ter pelo menos 8 caracteres.';
} elseif ($password !== $confirm) {
$error = 'As palavras-passe não coincidem.';
} else {
auth_set_password($pdo, (int) $target['id'], $password);
$plain = $password;
$success = 'Palavra-passe definida.';
}
}
$target = db_get_user($pdo, (int) $target['id']) ?? $target;
}
$page_title = 'Palavra-passe';
include __DIR__ . '/../../includes/header.php';
?>
<div class="container" style="max-width:640px;">
<h1 class="h3 mb-1">Palavra-passe</h1>
<p class="text-muted mb-4">
<?= htmlspecialchars($target['name']) ?>
· <?= htmlspecialchars($target['email']) ?>
· <span class="badge text-bg-secondary"><?= htmlspecialchars(role_label($target['role'])) ?></span>
</p>
<?php if ($blocked): ?>
<div class="alert alert-warning"><?= htmlspecialchars($blocked) ?></div>
<a class="btn btn-outline-secondary" href="<?= base_url('views/user/index.php') ?>">Voltar</a>
<?php else: ?>
<?php if ($error): ?><div class="alert alert-danger"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<?php if ($success): ?><div class="alert alert-success"><?= htmlspecialchars($success) ?></div><?php endif; ?>
<?php if ($plain !== ''): ?>
<div class="alert alert-warning">
Comunique-a por um canal seguro e peça que a altere no primeiro acesso.
Esta é a única vez que aparece:
<code class="d-block mt-2 fs-6"><?= htmlspecialchars($plain) ?></code>
</div>
<?php endif; ?>
<div class="card shadow-sm mb-3"><div class="card-body">
<h2 class="h6">Enviar link por email</h2>
<p class="text-muted small">
A pessoa define a própria palavra-passe. Ninguém no backoffice chega a conhecê-la.
<?php if (empty($target['password_hash'])): ?>
<br><strong>Esta conta ainda não tem palavra-passe definida.</strong>
<?php endif; ?>
</p>
<form method="POST">
<?= csrf_field() ?>
<input type="hidden" name="id" value="<?= (int) $target['id'] ?>">
<input type="hidden" name="action" value="invite">
<button class="btn btn-primary"><i class="bi bi-envelope me-1"></i>Enviar link</button>
</form>
</div></div>
<form method="POST" class="card shadow-sm"><div class="card-body">
<?= csrf_field() ?>
<input type="hidden" name="id" value="<?= (int) $target['id'] ?>">
<input type="hidden" name="action" value="set">
<h2 class="h6">Definir manualmente</h2>
<p class="text-muted small">Use apenas quando o email não for uma opção.</p>
<div class="mb-3"><label class="form-label" for="sp-password">Nova palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
<input type="password" class="form-control" id="sp-password" name="password" required minlength="8" autocomplete="new-password"></div>
<div class="mb-3"><label class="form-label" for="sp-confirm">Confirmar</label>
<input type="password" class="form-control" id="sp-confirm" name="confirm" required autocomplete="new-password"></div>
<button class="btn btn-outline-primary">Definir palavra-passe</button>
<a class="btn btn-link" href="<?= base_url('views/user/index.php') ?>">Voltar</a>
</div></form>
<?php endif; ?>
</div>
<?php include __DIR__ . '/../../includes/footer.php'; ?>