andreandClaude Opus 5.5
0e8b53f620
- shared/platform-tools: ea3616a → 12f26fd (27 commits). Traz o módulo de audit (f761d99, o pin da frota), «manter sessão iniciada», o registo de segurança da frota (o gancho que o login já tinha passa a funcionar) e a correção do IP do cliente encontrada nesta auditoria (último X-Forwarded-For / X-Real-IP), promovida ao partilhado. client_ip() da app delega nele. - config/functions_audit.php: audit() sobre platform_audit(); tabela audit_log criada no primeiro uso, segredos ocultados, nunca parte a ação. - Registado: login, falha de login, bloqueio por excesso de tentativas, logout, pedidos de recuperação, mudança/definição de palavra-passe, registo e criação de utilizadores, convites, perfil (antes/depois), todas as definições (db_update_setting, com valor anterior), cada passo da lixeira (apagar, restaurar, eliminar de vez) e ações nas mensagens. - Sistema → Auditoria (views/sysadmin/audit.php), só sysadmin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
113 lines
6.9 KiB
PHP
113 lines
6.9 KiB
PHP
<?php
|
|
require __DIR__ . '/../../config/db.php';
|
|
require __DIR__ . '/../../config/functions.php';
|
|
$user = require_login();
|
|
|
|
// Two forms on this page, told apart by the hidden `form` field: the contact
|
|
// details and the password change. Name and email are not self-editable — an
|
|
// admin changes those, so a client can't quietly take over another address.
|
|
$saved = false;
|
|
$pw_saved = false;
|
|
$pw_error = '';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
csrf_check();
|
|
|
|
if (($_POST['form'] ?? '') === 'password') {
|
|
$current = $_POST['current_password'] ?? '';
|
|
$new = $_POST['new_password'] ?? '';
|
|
$confirm = $_POST['confirm_password'] ?? '';
|
|
|
|
// Re-authenticate against the stored hash: a hijacked session must not
|
|
// be enough to change the password and lock the owner out.
|
|
$row = db_get_user($pdo, (int) $user['id']);
|
|
if (!$row || empty($row['password_hash']) || !password_verify($current, $row['password_hash'])) {
|
|
$pw_error = 'A palavra-passe atual está incorreta.';
|
|
} elseif (strlen($new) < 8) {
|
|
$pw_error = 'A nova palavra-passe deve ter pelo menos 8 caracteres.';
|
|
} elseif ($new !== $confirm) {
|
|
$pw_error = 'As palavras-passe não coincidem.';
|
|
} else {
|
|
auth_set_password($pdo, (int) $user['id'], $new);
|
|
// Fresh session id on a credential change — see auth_set_session().
|
|
auth_set_session($row);
|
|
$pw_saved = true;
|
|
}
|
|
} else {
|
|
$phone = trim($_POST['phone'] ?? '');
|
|
$address = trim($_POST['address'] ?? '');
|
|
$city = trim($_POST['city'] ?? '');
|
|
$postal_code = trim($_POST['postal_code'] ?? '');
|
|
$email_opt = isset($_POST['email_opt_out']) ? 1 : 0;
|
|
$sms_opt = isset($_POST['sms_opt_out']) ? 1 : 0;
|
|
$marketing = isset($_POST['marketing_consent']) ? 1 : 0;
|
|
$before = db_get_user($pdo, (int) $user['id']) ?? [];
|
|
$pdo->prepare(
|
|
"UPDATE users SET phone=?, address=?, city=?, postal_code=?,
|
|
email_opt_out=?, sms_opt_out=?, marketing_consent=?
|
|
WHERE id=?"
|
|
)->execute([$phone, $address, $city, $postal_code, $email_opt, $sms_opt, $marketing, $user['id']]);
|
|
audit('user.profile_update', [
|
|
'target_type' => 'user', 'target_id' => (int) $user['id'], 'target_label' => (string) $user['name'],
|
|
'changes' => platform_audit_diff(
|
|
array_intersect_key($before, array_flip(['phone', 'address', 'city', 'postal_code', 'email_opt_out', 'sms_opt_out', 'marketing_consent'])),
|
|
['phone' => $phone, 'address' => $address, 'city' => $city, 'postal_code' => $postal_code,
|
|
'email_opt_out' => (string) $email_opt, 'sms_opt_out' => (string) $sms_opt, 'marketing_consent' => (string) $marketing]
|
|
),
|
|
]);
|
|
$saved = true;
|
|
}
|
|
}
|
|
|
|
$row = db_get_user($pdo, (int) $user['id']) ?? [];
|
|
include __DIR__ . '/../../includes/header.php';
|
|
?>
|
|
<div class="container" style="max-width:640px;">
|
|
<h1 class="h3 mb-4">O meu perfil</h1>
|
|
<?php if ($saved): ?><div class="alert alert-success">Perfil atualizado.</div><?php endif; ?>
|
|
|
|
<div class="card shadow-sm mb-3"><div class="card-body">
|
|
<div class="row mb-2"><div class="col-4 text-muted">Nome</div><div class="col-8"><?= htmlspecialchars($row['name'] ?? '') ?></div></div>
|
|
<div class="row mb-2"><div class="col-4 text-muted">Email</div><div class="col-8"><?= htmlspecialchars($row['email'] ?? '') ?></div></div>
|
|
<p class="text-muted small mb-0">Para alterar o nome ou o email, contacte-nos.</p>
|
|
</div></div>
|
|
|
|
<form method="POST" class="card shadow-sm mb-3"><div class="card-body">
|
|
<?= csrf_field() ?>
|
|
<input type="hidden" name="form" value="details">
|
|
<div class="mb-3"><label class="form-label" for="pf-phone">Telefone</label>
|
|
<input class="form-control" id="pf-phone" name="phone" value="<?= htmlspecialchars($row['phone'] ?? '') ?>"></div>
|
|
<div class="mb-3"><label class="form-label" for="pf-address">Morada</label>
|
|
<input class="form-control" id="pf-address" name="address" value="<?= htmlspecialchars($row['address'] ?? '') ?>"></div>
|
|
<div class="row">
|
|
<div class="col-md-8 mb-3"><label class="form-label" for="pf-city">Localidade</label>
|
|
<input class="form-control" id="pf-city" name="city" value="<?= htmlspecialchars($row['city'] ?? '') ?>"></div>
|
|
<div class="col-md-4 mb-3"><label class="form-label" for="pf-postal">Código postal</label>
|
|
<input class="form-control" id="pf-postal" name="postal_code" value="<?= htmlspecialchars($row['postal_code'] ?? '') ?>"></div>
|
|
</div>
|
|
<div class="form-check"><input class="form-check-input" type="checkbox" name="email_opt_out" id="eo" <?= !empty($row['email_opt_out']) ? 'checked' : '' ?>>
|
|
<label class="form-check-label" for="eo">Não receber emails</label></div>
|
|
<div class="form-check"><input class="form-check-input" type="checkbox" name="sms_opt_out" id="so" <?= !empty($row['sms_opt_out']) ? 'checked' : '' ?>>
|
|
<label class="form-check-label" for="so">Não receber SMS</label></div>
|
|
<div class="form-check mb-3"><input class="form-check-input" type="checkbox" name="marketing_consent" id="mc" <?= !empty($row['marketing_consent']) ? 'checked' : '' ?>>
|
|
<label class="form-check-label" for="mc">Aceito comunicações de marketing</label></div>
|
|
<button class="btn btn-primary">Guardar</button>
|
|
</div></form>
|
|
|
|
<form method="POST" class="card shadow-sm"><div class="card-body">
|
|
<?= csrf_field() ?>
|
|
<input type="hidden" name="form" value="password">
|
|
<h2 class="h6 mb-3">Alterar palavra-passe</h2>
|
|
<?php if ($pw_saved): ?><div class="alert alert-success py-2 small">Palavra-passe alterada.</div><?php endif; ?>
|
|
<?php if ($pw_error): ?><div class="alert alert-danger py-2 small"><?= htmlspecialchars($pw_error) ?></div><?php endif; ?>
|
|
<div class="mb-3"><label class="form-label" for="pf-current">Palavra-passe atual</label>
|
|
<input type="password" class="form-control" id="pf-current" name="current_password" required autocomplete="current-password"></div>
|
|
<div class="mb-3"><label class="form-label" for="pf-new">Nova palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
|
|
<input type="password" class="form-control" id="pf-new" name="new_password" required minlength="8" autocomplete="new-password"></div>
|
|
<div class="mb-3"><label class="form-label" for="pf-confirm">Confirmar nova palavra-passe</label>
|
|
<input type="password" class="form-control" id="pf-confirm" name="confirm_password" required autocomplete="new-password"></div>
|
|
<button class="btn btn-primary">Alterar palavra-passe</button>
|
|
</div></form>
|
|
</div>
|
|
<?php include __DIR__ . '/../../includes/footer.php'; ?>
|