andreandClaude Opus 5
aec7b47820
fitme3070.pt delegated all authentication to hub.andmore.pt: views/auth/*
were bounce stubs, and because this domain is outside the .andmore.pt cookie
scope the real handoff was a one-time HTTPS ticket redeem. Bring identity back
in-house — passwords live in users.password_hash, which the SSO migration
never dropped.
Removed: config/sso.php, IDENTITY_MODE, every SSO_* constant and env key,
identity_is_federated() and the cookie/ticket paths in the auth views and the
public-site bootstrap. ANDMORE_ID_URL stays — it is still the hub /notify
endpoint for outbound email/SMS, which the reset mails ride on, and has
nothing to do with authentication now.
Added, ported from the fotografia.andmore.pt sibling rather than invented:
- auth_login() with transparent password_needs_rehash upgrades and the
last_login trail; auth_register_client(); auth_set_password(); the
single-use 2h reset tokens.
- Real login / register / forgot_password / reset_password pages on a new
anonymous shell (includes/auth_header.php). includes/header.php renders
the backoffice sidebar and a logout button, which is wrong for a visitor
who is not signed in yet.
- safe_return_path(), so a crafted ?return_to= cannot bounce a freshly
authenticated user off-site.
- Per-IP throttling on login, register and reset-request. Successes count
too, so a guessed password cannot be parlayed into stuffing the rest of
the user list from the same IP.
- views/user/set_password.php: admin override for anyone whose email is
undeliverable. Prefers mailing an invite link so the backoffice never
handles the password. A plain admin cannot act on a sysadmin, and nobody
can use it on themselves — self-service goes through profile.php, which
demands the current password so a hijacked session cannot lock the owner
out.
Accounts provisioned during the SSO era have password_hash NULL. They get in
via the reset email, or by registering again with the same address:
auth_register_client() claims a passwordless row, but only a plain `client`
one, so knowing a staff address does not let anyone self-assign the role.
users.andmore_id is deliberately left in place. No code reads it any more, but
it records which central identity each row was linked to.
Deployment: apply database/migration_20260913_local_auth.sql (password_resets
+ auth_attempts) in the SAME sysadmin session that pulls this commit — the
forgot-password flow needs that table, and after the pull a login requires a
local password.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
107 lines
4.4 KiB
PHP
107 lines
4.4 KiB
PHP
<?php
|
|
// Local login form. This install owns its passwords (users.password_hash);
|
|
// there is no identity provider in front of it.
|
|
//
|
|
// Carries through ?return_to=/path, set by require_login(), so the visitor
|
|
// lands back on the page they originally asked for.
|
|
|
|
require __DIR__ . '/../../config/db.php';
|
|
require_once __DIR__ . '/../../config/functions.php';
|
|
|
|
$return_to = safe_return_path($_GET['return_to'] ?? '');
|
|
|
|
$destination = function (string $role) use ($return_to): string {
|
|
return $return_to !== '' ? $return_to : post_login_destination($role);
|
|
};
|
|
|
|
if (!empty($_SESSION['user_id'])) {
|
|
header('Location: ' . base_url($destination($_SESSION['user']['role'] ?? '')));
|
|
exit;
|
|
}
|
|
|
|
$error = '';
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
csrf_check();
|
|
|
|
// Counts successes too, so a guessed password can't be parlayed into
|
|
// stuffing the rest of the user list from the same IP.
|
|
if (!throttle_check($pdo, 'login')) {
|
|
throttle_block('login form');
|
|
}
|
|
throttle_record($pdo, 'login');
|
|
|
|
$user = auth_login($pdo, $_POST['email'] ?? '', $_POST['password'] ?? '');
|
|
if ($user) {
|
|
auth_set_session($user);
|
|
header('Location: ' . base_url($destination($user['role'])));
|
|
exit;
|
|
}
|
|
// Deliberately vague — doesn't reveal whether the address exists.
|
|
$error = 'Email ou palavra-passe incorretos.';
|
|
}
|
|
|
|
// Preserve the redirect intent across the POST.
|
|
$form_qs = $return_to !== '' ? ('?' . http_build_query(['return_to' => $_GET['return_to'] ?? ''])) : '';
|
|
|
|
$page_title = 'Entrar';
|
|
include __DIR__ . '/../../includes/auth_header.php';
|
|
?>
|
|
<p class="auth-sub">Entre na sua conta para continuar.</p>
|
|
|
|
<?php if ($error): ?>
|
|
<div class="alert alert-danger py-2 small mb-2"><?= htmlspecialchars($error) ?></div>
|
|
<?php // Shown on any failure — an account created by an admin (or carried
|
|
// over from the Andmore ID era) has no password yet and would
|
|
// otherwise be stuck here. Phrased so it never confirms the address
|
|
// exists. ?>
|
|
<p class="small auth-foot">
|
|
Se a sua conta foi criada por nós, ainda não tem palavra-passe definida —
|
|
use <a href="<?= htmlspecialchars(base_url('views/auth/forgot_password.php')) ?>">Esqueceu a palavra-passe?</a>
|
|
para definir uma.
|
|
</p>
|
|
<?php endif; ?>
|
|
<?php if (isset($_GET['registered'])): ?>
|
|
<div class="alert alert-success py-2 small">Conta criada. Já pode entrar.</div>
|
|
<?php endif; ?>
|
|
<?php if (isset($_GET['reset'])): ?>
|
|
<div class="alert alert-success py-2 small">Palavra-passe alterada. Entre com a nova palavra-passe.</div>
|
|
<?php endif; ?>
|
|
<?php if (isset($_GET['loggedout'])): ?>
|
|
<div class="alert alert-success py-2 small">Sessão terminada.</div>
|
|
<?php endif; ?>
|
|
|
|
<form method="POST" action="<?= htmlspecialchars('login.php' . $form_qs) ?>" novalidate>
|
|
<?= csrf_field() ?>
|
|
<div class="mb-3">
|
|
<label class="form-label" for="login-email">Email</label>
|
|
<input type="email" id="login-email" name="email" class="form-control" required autofocus
|
|
autocomplete="email" inputmode="email"
|
|
value="<?= htmlspecialchars($_POST['email'] ?? '') ?>">
|
|
</div>
|
|
<div class="mb-4">
|
|
<!-- O link de recuperação vem DEPOIS do input: dentro do <label> ficava
|
|
antes dele no DOM, e o Tab a partir do email saltava para o link
|
|
em vez de ir para a palavra-passe. -->
|
|
<label class="form-label" for="login-password">Palavra-passe</label>
|
|
<div class="input-group">
|
|
<input type="password" id="login-password" name="password" class="form-control" required
|
|
autocomplete="current-password">
|
|
<button class="btn btn-outline-secondary" type="button" tabindex="-1"
|
|
data-toggle-password="login-password" aria-label="Mostrar palavra-passe">
|
|
<i class="bi bi-eye"></i>
|
|
</button>
|
|
</div>
|
|
<div class="text-end mt-1">
|
|
<a href="<?= htmlspecialchars(base_url('views/auth/forgot_password.php')) ?>" class="small">Esqueceu a <span class="text-nowrap">palavra-passe</span>?</a>
|
|
</div>
|
|
</div>
|
|
<button type="submit" class="btn btn-primary w-100">Entrar</button>
|
|
</form>
|
|
|
|
<hr class="my-3">
|
|
<p class="text-center small mb-0 auth-foot">
|
|
Novo cliente?
|
|
<a href="<?= htmlspecialchars(base_url('views/auth/register.php')) ?>">Criar conta</a>
|
|
</p>
|
|
<?php include __DIR__ . '/../../includes/auth_footer.php'; ?>
|