andreandClaude Opus 5
aec7b47820
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.
Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.
Added, ported from the fotografia.andmore.pt sibling rather than invented:
- auth_login() with transparent password_needs_rehash upgrades and the
last_login trail; auth_register_client(); auth_set_password(); the
single-use 2h reset tokens.
- Real login / register / forgot_password / reset_password pages on a new
anonymous shell (includes/auth_header.php). includes/header.php renders
the backoffice sidebar and a logout button, which is wrong for a visitor
who is not signed in yet.
- safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
authenticated user off-site.
- Per-IP throttling on login, register and reset-request. Successes count
too, so a guessed password cannot be parlayed into stuffing the rest of
the user list from the same IP.
- views/user/set_password.php: admin override for anyone whose email is
undeliverable. Prefers mailing an invite link so the backoffice never
handles the password. A plain admin cannot act on a sysadmin, and nobody
can use it on themselves — self-service goes through profile.php, which
demands the current password so a hijacked session cannot lock the owner
out.
Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.
users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.
Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
104 lines
6.2 KiB
PHP
104 lines
6.2 KiB
PHP
<?php
|
|
require __DIR__ . '/../../config/db.php';
|
|
require __DIR__ . '/../../config/functions.php';
|
|
$user = require_login();
|
|
|
|
// Two forms on this page, told apart by the hidden `form` field: the contact
|
|
// details and the password change. Name and email are not self-editable — an
|
|
// admin changes those, so a client can't quietly take over another address.
|
|
$saved = false;
|
|
$pw_saved = false;
|
|
$pw_error = '';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
csrf_check();
|
|
|
|
if (($_POST['form'] ?? '') === 'password') {
|
|
$current = $_POST['current_password'] ?? '';
|
|
$new = $_POST['new_password'] ?? '';
|
|
$confirm = $_POST['confirm_password'] ?? '';
|
|
|
|
// Re-authenticate against the stored hash: a hijacked session must not
|
|
// be enough to change the password and lock the owner out.
|
|
$row = db_get_user($pdo, (int) $user['id']);
|
|
if (!$row || empty($row['password_hash']) || !password_verify($current, $row['password_hash'])) {
|
|
$pw_error = 'A palavra-passe atual está incorreta.';
|
|
} elseif (strlen($new) < 8) {
|
|
$pw_error = 'A nova palavra-passe deve ter pelo menos 8 caracteres.';
|
|
} elseif ($new !== $confirm) {
|
|
$pw_error = 'As palavras-passe não coincidem.';
|
|
} else {
|
|
auth_set_password($pdo, (int) $user['id'], $new);
|
|
// Fresh session id on a credential change — see auth_set_session().
|
|
auth_set_session($row);
|
|
$pw_saved = true;
|
|
}
|
|
} else {
|
|
$phone = trim($_POST['phone'] ?? '');
|
|
$address = trim($_POST['address'] ?? '');
|
|
$city = trim($_POST['city'] ?? '');
|
|
$postal_code = trim($_POST['postal_code'] ?? '');
|
|
$email_opt = isset($_POST['email_opt_out']) ? 1 : 0;
|
|
$sms_opt = isset($_POST['sms_opt_out']) ? 1 : 0;
|
|
$marketing = isset($_POST['marketing_consent']) ? 1 : 0;
|
|
$pdo->prepare(
|
|
"UPDATE users SET phone=?, address=?, city=?, postal_code=?,
|
|
email_opt_out=?, sms_opt_out=?, marketing_consent=?
|
|
WHERE id=?"
|
|
)->execute([$phone, $address, $city, $postal_code, $email_opt, $sms_opt, $marketing, $user['id']]);
|
|
$saved = true;
|
|
}
|
|
}
|
|
|
|
$row = db_get_user($pdo, (int) $user['id']) ?? [];
|
|
include __DIR__ . '/../../includes/header.php';
|
|
?>
|
|
<div class="container" style="max-width:640px;">
|
|
<h1 class="h3 mb-4">O meu perfil</h1>
|
|
<?php if ($saved): ?><div class="alert alert-success">Perfil atualizado.</div><?php endif; ?>
|
|
|
|
<div class="card shadow-sm mb-3"><div class="card-body">
|
|
<div class="row mb-2"><div class="col-4 text-muted">Nome</div><div class="col-8"><?= htmlspecialchars($row['name'] ?? '') ?></div></div>
|
|
<div class="row mb-2"><div class="col-4 text-muted">Email</div><div class="col-8"><?= htmlspecialchars($row['email'] ?? '') ?></div></div>
|
|
<p class="text-muted small mb-0">Para alterar o nome ou o email, contacte-nos.</p>
|
|
</div></div>
|
|
|
|
<form method="POST" class="card shadow-sm mb-3"><div class="card-body">
|
|
<?= csrf_field() ?>
|
|
<input type="hidden" name="form" value="details">
|
|
<div class="mb-3"><label class="form-label" for="pf-phone">Telefone</label>
|
|
<input class="form-control" id="pf-phone" name="phone" value="<?= htmlspecialchars($row['phone'] ?? '') ?>"></div>
|
|
<div class="mb-3"><label class="form-label" for="pf-address">Morada</label>
|
|
<input class="form-control" id="pf-address" name="address" value="<?= htmlspecialchars($row['address'] ?? '') ?>"></div>
|
|
<div class="row">
|
|
<div class="col-md-8 mb-3"><label class="form-label" for="pf-city">Localidade</label>
|
|
<input class="form-control" id="pf-city" name="city" value="<?= htmlspecialchars($row['city'] ?? '') ?>"></div>
|
|
<div class="col-md-4 mb-3"><label class="form-label" for="pf-postal">Código postal</label>
|
|
<input class="form-control" id="pf-postal" name="postal_code" value="<?= htmlspecialchars($row['postal_code'] ?? '') ?>"></div>
|
|
</div>
|
|
<div class="form-check"><input class="form-check-input" type="checkbox" name="email_opt_out" id="eo" <?= !empty($row['email_opt_out']) ? 'checked' : '' ?>>
|
|
<label class="form-check-label" for="eo">Não receber emails</label></div>
|
|
<div class="form-check"><input class="form-check-input" type="checkbox" name="sms_opt_out" id="so" <?= !empty($row['sms_opt_out']) ? 'checked' : '' ?>>
|
|
<label class="form-check-label" for="so">Não receber SMS</label></div>
|
|
<div class="form-check mb-3"><input class="form-check-input" type="checkbox" name="marketing_consent" id="mc" <?= !empty($row['marketing_consent']) ? 'checked' : '' ?>>
|
|
<label class="form-check-label" for="mc">Aceito comunicações de marketing</label></div>
|
|
<button class="btn btn-primary">Guardar</button>
|
|
</div></form>
|
|
|
|
<form method="POST" class="card shadow-sm"><div class="card-body">
|
|
<?= csrf_field() ?>
|
|
<input type="hidden" name="form" value="password">
|
|
<h2 class="h6 mb-3">Alterar palavra-passe</h2>
|
|
<?php if ($pw_saved): ?><div class="alert alert-success py-2 small">Palavra-passe alterada.</div><?php endif; ?>
|
|
<?php if ($pw_error): ?><div class="alert alert-danger py-2 small"><?= htmlspecialchars($pw_error) ?></div><?php endif; ?>
|
|
<div class="mb-3"><label class="form-label" for="pf-current">Palavra-passe atual</label>
|
|
<input type="password" class="form-control" id="pf-current" name="current_password" required autocomplete="current-password"></div>
|
|
<div class="mb-3"><label class="form-label" for="pf-new">Nova palavra-passe <span class="text-muted small">(mín. 8 caracteres)</span></label>
|
|
<input type="password" class="form-control" id="pf-new" name="new_password" required minlength="8" autocomplete="new-password"></div>
|
|
<div class="mb-3"><label class="form-label" for="pf-confirm">Confirmar nova palavra-passe</label>
|
|
<input type="password" class="form-control" id="pf-confirm" name="confirm_password" required autocomplete="new-password"></div>
|
|
<button class="btn btn-primary">Alterar palavra-passe</button>
|
|
</div></form>
|
|
</div>
|
|
<?php include __DIR__ . '/../../includes/footer.php'; ?>
|