fluid/password_protect.php at main · JulesText/fluid · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
<?php

// login form
if (!function_exists('showLoginPasswordProtect')) {

    function showLoginPasswordProtect($error_msg)
    {

        ?>
        <html>
        <head>
          <title>Please enter password to access this page</title>
          <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">
          <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
          <script>
            window.onload = function() {
                document.getElementById("access_login").focus();
            };
          </script>
        </head>
        <body>
          <style>
            input { border: 1px solid black; }
          </style>
          <div style="width:500px; margin-left:auto; margin-right:auto; text-align:center">
          <form method="post">
            <h3>Please enter password to access this page</h3>
            <font color="red"><?php echo $error_msg; ?></font><br />
            Login:<br />
            <input type="text" name="access_login" value="" /><br />
            Password:<br />
            <input type="password" name="access_password" id="access_password" /><p></p><input type="submit" name="Submit" value="Submit" />
          </form>
          </div>
        </body>
        </html>

        <?php
          // stop at this point and wait for form process
          die();
    }
}

// assume invalid login
$verified = false;

# local development servers do not require the application login
$local_hosts = array('localhost', '127.0.0.1', '::1');
$server_name = isset($_SERVER['SERVER_NAME']) ? trim($_SERVER['SERVER_NAME'], '[]') : '';
$is_local_host = in_array($server_name, $local_hosts, true);
$client_ip = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
$password_ip_whitelist = isset($config['password_ip_whitelist'])
    && is_array($config['password_ip_whitelist'])
    ? $config['password_ip_whitelist']
    : array();
$is_whitelisted_ip = in_array($client_ip, $password_ip_whitelist, true);

# check if call turn turn pass off currently active
if (!$config['password_on'] || $is_local_host || $is_whitelisted_ip) {
  // $_SESSION['message'][] = 'Password turned off until ' . date('Y-m-d H:i', $config['pass_off_to']);
    $verified = true;
}

// check if user submitted password
$submitted = false;
if (isset($_POST['access_login']) && isset($_POST['access_password'])) {
    $submitted = true;
    $cred = md5($_POST['access_login'] . '%' . $_POST['access_password']);
  // clear password protector variables in case of $_POST calls in other scripts
    unset($_POST['access_login']);
    unset($_POST['access_password']);
}

// check cookie if exists
$has_cookie = false;
if (isset($_COOKIE['verify'])) {
    $has_cookie = true;
    $cred = $_COOKIE['verify'];
}

// check creds
if ($submitted || $has_cookie) {
    foreach ($login_information as $login => $pass) {
        if ($cred == md5($login . '%' . $pass)) {
            $verified = true;
        }
    }
}

// if invalid, call form and die
if (!$verified) {
    setcookie('verify', '', array(
        'expires' => time() - 3600,
        'path' => '/',
        'secure' => true,
        'httponly' => true,
        'samesite' => 'Strict'
    ));
    showLoginPasswordProtect("Submit password");
}

// if valid, save or renew
if ($verified && ($submitted || $has_cookie)) {
    $cooked = array(
        'expires' => time() + $config['login_timeout'] * 24 * 60 * 60,
        'path' => '/',
        'secure' => true,
        'httponly' => true,
        'samesite' => 'Strict'
    );

    setcookie('verify', $cred, $cooked);
    if ($submitted) {
        mail($config['email_admin'], 'New fluid login ' . $_SERVER['REMOTE_ADDR'], 'EOM');
    }
}

# check if call to turn pass off, i.e. for local app site access such as FR
# if so set off and reload index
if (
    isset($_GET['pass_off'])
    && $_GET['pass_off'] == 'TRUE'
    && $config['password_on']
    && $verified
) {
    $off_to = $config['time_now'] + 60 * $config['pass_off_minutes'];
    file_put_contents('config_pass_off_to.txt', $off_to);
    $msg = 'Password turned off for ' . $config['pass_off_minutes'] . ' minutes';
    mail($config['email_admin'], $msg, 'EOM');
    $_SESSION['message'][] = $msg . ' until ' . date('Y-m-d H:i', $off_to);
    nextScreen('index.php');
}

?>