UbuntuandClaude Opus 4.6
420bcb37fd
- Fix all SQL injection vulnerabilities across Service_model, User_model, Module_model, Log_model, and Admin controller using parameterized queries - Add htmlspecialchars() to all user-controlled output in admin views (bookings, services, workers, service categories, login form) - Fix XSS in AJAX worker response and manage-booking-cancelled view - Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads - Remove webshell (pentest2.php) from assets/img/profiles/ - Stop logging plaintext passwords on failed login attempts - Migrate database.php hostname from localhost to AWS RDS endpoint - Fix dropdown styling (white-on-white) in worker calendar view Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
96 lines
3.0 KiB
PHP
Executable File
96 lines
3.0 KiB
PHP
Executable File
<?php
|
|
defined('BASEPATH') OR exit('No direct script access allowed');
|
|
|
|
class Login extends CI_Controller {
|
|
|
|
/**
|
|
* Index Page for this controller.
|
|
*
|
|
* Maps to the following URL
|
|
* http://example.com/index.php/welcome
|
|
* - or -
|
|
* http://example.com/index.php/welcome/index
|
|
* - or -
|
|
* Since this controller is set as the default controller in
|
|
* config/routes.php, it's displayed at http://example.com/
|
|
*
|
|
* So any other public methods not prefixed with an underscore will
|
|
* map to /index.php/welcome/<method_name>
|
|
* @see https://codeigniter.com/user_guide/general/urls.html
|
|
*/
|
|
public function index(){
|
|
$this->load->helper('url');
|
|
$this->load->helper('cookie');
|
|
$this->load->model('User_model');
|
|
$this->load->model('Log_model');
|
|
|
|
$data['message'] = '';
|
|
$data['message_class'] = '';
|
|
|
|
$data['username'] = '';
|
|
$data['password'] = '';
|
|
|
|
if(isset($_GET['logout']) && isset($_SESSION['username'])){
|
|
$this->Log_model->addLog('logout', 'Sikeres kijelentkezés - '.$_SESSION['username'],$_SESSION['username']);
|
|
unset($_SESSION['username']);
|
|
unset($_SESSION['password']);
|
|
$data['message'] = 'Sikeres kijelentkezés!';
|
|
$data['message_class'] = 'success';
|
|
}
|
|
|
|
elseif(isset($_POST['sendLogin'])){
|
|
if($this->User_model->userCanLogin($_POST['username'], $_POST['password'])){
|
|
if($_POST['remember'] == 'on'){
|
|
$cookie = array(
|
|
'name' => 'username',
|
|
'value' => $_POST['username'],
|
|
'expire' => '300',
|
|
'secure' => TRUE
|
|
);
|
|
$this->input->set_cookie($cookie);
|
|
|
|
$cookie = array(
|
|
'name' => 'password',
|
|
'value' => $_POST['password'],
|
|
'expire' => '300',
|
|
'secure' => TRUE
|
|
);
|
|
$this->input->set_cookie($cookie);
|
|
|
|
}
|
|
else{
|
|
delete_cookie("username");
|
|
delete_cookie("password");
|
|
}
|
|
|
|
$this->Log_model->addLog('login', 'Sikeres bejelentkezés - '.$_POST['username'],$_POST['username']);
|
|
$_SESSION['username'] = $_POST['username'];
|
|
$_SESSION['password'] = $_POST['password'];
|
|
$data['currentUser'] = $this->User_model->getUserByUsername($_SESSION['username']);
|
|
|
|
header('location:'.base_url().'dashboard');
|
|
|
|
}
|
|
else{
|
|
$this->Log_model->addLog('login', 'Sikertelen bejelentkezési kísérlet - '.$_POST['username'],$_POST['username']);
|
|
$data['message'] = 'Sikertelen bejelentkezés!';
|
|
$data['message_class'] = 'error';
|
|
}
|
|
}
|
|
|
|
$data['username'] = get_cookie('username');
|
|
$data['password'] = get_cookie('password');
|
|
|
|
$data['pageTitle'] = 'Bejelentkezés';
|
|
$this->load->view('login',$data);
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
?>
|