andreandClaude Opus 5
aec7b47820
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.
Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.
Added, ported from the fotografia.andmore.pt sibling rather than invented:
- auth_login() with transparent password_needs_rehash upgrades and the
last_login trail; auth_register_client(); auth_set_password(); the
single-use 2h reset tokens.
- Real login / register / forgot_password / reset_password pages on a new
anonymous shell (includes/auth_header.php). includes/header.php renders
the backoffice sidebar and a logout button, which is wrong for a visitor
who is not signed in yet.
- safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
authenticated user off-site.
- Per-IP throttling on login, register and reset-request. Successes count
too, so a guessed password cannot be parlayed into stuffing the rest of
the user list from the same IP.
- views/user/set_password.php: admin override for anyone whose email is
undeliverable. Prefers mailing an invite link so the backoffice never
handles the password. A plain admin cannot act on a sysadmin, and nobody
can use it on themselves — self-service goes through profile.php, which
demands the current password so a hijacked session cannot lock the owner
out.
Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.
users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.
Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
70 lines
3.2 KiB
PHP
70 lines
3.2 KiB
PHP
<?php
|
|
// ─── Per-IP attempt throttling ───────────────────────────────────────────────
|
|
// Generic, scope-scoped IP throttle for endpoints where an attacker gains by
|
|
// repeating: login, password-reset requests, registration.
|
|
//
|
|
// Two limits applied together:
|
|
// - burst: N attempts per minute (default 5)
|
|
// - sustained: N attempts per hour (default 30)
|
|
//
|
|
// Counts FAILED *and* SUCCESSFUL attempts, so a guessed password can't be
|
|
// parlayed into stuffing the rest of the user list from the same IP.
|
|
//
|
|
// Schema: database/migration_20260913_local_auth.sql (`auth_attempts`).
|
|
|
|
function _throttle_ip(): string {
|
|
$ip = $_SERVER['REMOTE_ADDR'] ?? '';
|
|
return $ip !== '' ? $ip : '0.0.0.0';
|
|
}
|
|
|
|
function throttle_check(PDO $pdo, string $scope, int $maxPerMinute = 5, int $maxPerHour = 30): bool {
|
|
try {
|
|
$stmt = $pdo->prepare(
|
|
"SELECT
|
|
SUM(attempted_at > DATE_SUB(NOW(), INTERVAL 1 MINUTE)) AS minute,
|
|
SUM(attempted_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)) AS hour
|
|
FROM auth_attempts
|
|
WHERE ip = ? AND scope = ? AND attempted_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)"
|
|
);
|
|
$stmt->execute([_throttle_ip(), $scope]);
|
|
$row = $stmt->fetch(PDO::FETCH_ASSOC) ?: ['minute' => 0, 'hour' => 0];
|
|
} catch (PDOException $e) {
|
|
// Fail open if the table is missing (migration not applied yet during a
|
|
// deploy). Log loudly so an operator notices.
|
|
error_log('[throttle] check failed (run migration_20260913_local_auth.sql?): ' . $e->getMessage());
|
|
return true;
|
|
}
|
|
if ((int) $row['minute'] >= $maxPerMinute) return false;
|
|
if ((int) $row['hour'] >= $maxPerHour) return false;
|
|
return true;
|
|
}
|
|
|
|
function throttle_record(PDO $pdo, string $scope): void {
|
|
try {
|
|
$pdo->prepare("INSERT INTO auth_attempts (ip, scope) VALUES (?, ?)")
|
|
->execute([_throttle_ip(), $scope]);
|
|
// Probabilistic cleanup so the table doesn't grow forever — cheap on a
|
|
// 1% sample of writes, and saves wiring up a cron for a small install.
|
|
if (random_int(0, 99) === 0) {
|
|
@$pdo->exec("DELETE FROM auth_attempts WHERE attempted_at < DATE_SUB(NOW(), INTERVAL 1 DAY)");
|
|
}
|
|
} catch (PDOException $e) {
|
|
error_log('[throttle] record failed (run migration_20260913_local_auth.sql?): ' . $e->getMessage());
|
|
}
|
|
}
|
|
|
|
// Convenience: 429 + generic message, then exit. Callers that would rather keep
|
|
// the visitor on the form can use throttle_check() and render their own error.
|
|
function throttle_block(string $reason = ''): void {
|
|
http_response_code(429);
|
|
header('Retry-After: 60');
|
|
header('Content-Type: text/html; charset=utf-8');
|
|
echo '<!doctype html><meta charset="utf-8"><title>Demasiadas tentativas</title>'
|
|
. '<div style="font-family:sans-serif;max-width:520px;margin:80px auto;text-align:center;">'
|
|
. '<h2>Demasiadas tentativas</h2>'
|
|
. '<p>Aguarde alguns minutos antes de tentar novamente.</p>'
|
|
. '</div>';
|
|
if ($reason !== '') error_log("[throttle] blocked: {$reason} ip=" . _throttle_ip());
|
|
exit;
|
|
}
|