WebOrbiton
v3.0.0.2

FlatlyPage

← Changes All versions
407 lines · 18.7 KB
  1. <?php
  2. require_once '../config.php';
  3. require_once __DIR__ . '/login_tracking.php';
  4. ​
  5. if (session_status() === PHP_SESSION_NONE) {
  6. session_start();
  7. }
  8. ​
  9. if (isset($_SESSION['admin_logged_in']) && $_SESSION['admin_logged_in'] === true) {
  10. header('Location: ' . BASE_URL . '/admin/dashboard.php');
  11. exit;
  12. }
  13. ​
  14. $error = '';
  15. $success = '';
  16. ​
  17. try {
  18. $loginTracker = new LoginTracker();
  20. $clientIP = $loginTracker->getClientIP();
  21. if ($loginTracker->isIPBanned($clientIP)) {
  22. http_response_code(403);
  23. die('<!DOCTYPE html><html><head><meta charset="UTF-8"><title>Access Denied</title><style>body{font-family:Arial,sans-serif;background:#f1f5f9;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;}div{background:#fff;padding:40px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);text-align:center;}h1{color:#dc2626;margin:0 0 10px;}p{color:#64748b;margin:0;}</style></head><body><div><h1>Access Denied</h1><p>Access from your IP address has been blocked.</p></div></body></html>');
  24. }
  25. } catch (Exception $e) {
  26. error_log('Login tracker initialization failed: ' . $e->getMessage());
  27. $loginTracker = null;
  28. }
  29. ​
  30. function checkRateLimit() {
  31. $rateLimitFile = DATA_DIR . '/rate_limit.json';
  32. $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
  33. $now = time();
  34. $windowSeconds = 300; // 5 minutes
  35. $maxAttempts = 5;
  37. $rateLimits = [];
  38. if (file_exists($rateLimitFile)) {
  39. $rateLimits = json_decode(@file_get_contents($rateLimitFile), true) ?: [];
  40. }
  42. $rateLimits = array_filter($rateLimits, function($data) use ($now, $windowSeconds) {
  43. return ($now - $data['first_attempt']) < $windowSeconds;
  44. });
  46. if (isset($rateLimits[$ip])) {
  47. if ($rateLimits[$ip]['attempts'] >= $maxAttempts) {
  48. $timeLeft = $windowSeconds - ($now - $rateLimits[$ip]['first_attempt']);
  49. return [
  50. 'allowed' => false,
  51. 'timeLeft' => ceil($timeLeft / 60)
  52. ];
  53. }
  54. }
  56. return ['allowed' => true];
  57. }
  58. ​
  59. function recordLoginAttempt($success = false) {
  60. $rateLimitFile = DATA_DIR . '/rate_limit.json';
  61. $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
  62. $now = time();
  64. $rateLimits = [];
  65. if (file_exists($rateLimitFile)) {
  66. $rateLimits = json_decode(@file_get_contents($rateLimitFile), true) ?: [];
  67. }
  69. if ($success) {
  70. unset($rateLimits[$ip]);
  71. } else {
  72. if (!isset($rateLimits[$ip])) {
  73. $rateLimits[$ip] = [
  74. 'attempts' => 1,
  75. 'first_attempt' => $now
  76. ];
  77. } else {
  78. $rateLimits[$ip]['attempts']++;
  79. }
  80. }
  82. @file_put_contents($rateLimitFile, json_encode($rateLimits));
  83. }
  84. ​
  85. $adminFile = DATA_DIR . '/admin.json';
  86. $adminExists = file_exists($adminFile);
  87. ​
  88. if (!$adminExists && $_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'register') {
  89. $username = trim($_POST['username'] ?? '');
  90. $password = $_POST['password'] ?? '';
  91. $confirmPassword = $_POST['confirm_password'] ?? '';
  92. $email = strtolower(trim($_POST['email'] ?? ''));
  94. if (empty($username) || empty($password)) {
  95. $error = 'Please fill in all fields.';
  96. } elseif (strlen($password) < 8) {
  97. $error = 'Password must be at least 8 characters.';
  98. } elseif ($password !== $confirmPassword) {
  99. $error = "The passwords don't match.";
  100. } elseif ($email !== '' && !filter_var($email, FILTER_VALIDATE_EMAIL)) {
  101. $error = 'Please enter a valid email address.';
  102. } else {
  103. $adminData = [
  104. 'username' => $username,
  105. 'password' => password_hash($password, PASSWORD_DEFAULT),
  106. 'email' => $email,
  107. 'created_at' => date('Y-m-d H:i:s')
  108. ];
  110. if (file_put_contents($adminFile, json_encode($adminData, JSON_PRETTY_PRINT))) {
  111. $success = 'Your admin account is ready. You can sign in now.';
  112. $adminExists = true;
  113. } else {
  114. $error = "Couldn't create the account. Make sure the data folder on your server can be written to.";
  115. }
  116. }
  117. }
  118. ​
  119. if ($adminExists && $_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'login') {
  120. $rateLimitCheck = checkRateLimit();
  121. if (!$rateLimitCheck['allowed']) {
  122. $error = 'Too many attempts. Please wait ' . $rateLimitCheck['timeLeft'] . ' minute(s) and try again.';
  123. } else {
  124. $username = trim($_POST['username'] ?? '');
  125. $password = $_POST['password'] ?? '';
  127. if (empty($username) || empty($password)) {
  128. $error = 'Please fill in all fields.';
  129. recordLoginAttempt(false);
  130. } else {
  131. $adminData = json_decode(@file_get_contents($adminFile), true) ?: [];
  133. if ($adminData && $adminData['username'] === $username && password_verify($password, $adminData['password'])) {
  134. recordLoginAttempt(true);
  135. ​
  136. $adminEmail = $adminData['email'] ?? '';
  137. $lastLoginFile = DATA_DIR . '/lastlogin.json';
  138. $currentIP = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
  139. $currentUA = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown';
  140. $now = date('Y-m-d H:i:s');
  141. ​
  142. $prevLogin = [];
  143. if (file_exists($lastLoginFile)) {
  144. $prevLogin = json_decode(@file_get_contents($lastLoginFile), true) ?: [];
  145. }
  146. ​
  147. $shouldNotify = empty($prevLogin)
  148. || $prevLogin['ip'] !== $currentIP
  149. || $prevLogin['user_agent'] !== $currentUA;
  150. ​
  151. if ($adminEmail !== '' && $shouldNotify) {
  152. $alertTo = $adminEmail;
  153. $alertFrom = 'alert@flatlypage.com';
  154. $alertSubject = 'New login detected - FlatlyPage CMS';
  155. ​
  156. $currentIPSafe = htmlspecialchars($currentIP, ENT_QUOTES, 'UTF-8');
  157. $currentUASafe = htmlspecialchars($currentUA, ENT_QUOTES, 'UTF-8');
  158. $nowSafe = htmlspecialchars($now, ENT_QUOTES, 'UTF-8');
  159. ​
  160. $prevBlock = '';
  161. if (!empty($prevLogin)) {
  162. $prevIPSafe = htmlspecialchars($prevLogin['ip'] ?? '', ENT_QUOTES, 'UTF-8');
  163. $prevUASafe = htmlspecialchars($prevLogin['user_agent'] ?? '', ENT_QUOTES, 'UTF-8');
  164. $prevTimeSafe = htmlspecialchars($prevLogin['time'] ?? '', ENT_QUOTES, 'UTF-8');
  166. $prevBlock = "
  167. <tr><td colspan='2' style='padding:16px 0 4px;font-size:12px;color:#94a3b8;text-transform:uppercase;letter-spacing:.05em;'>Previous login</td></tr>
  168. <tr>
  169. <td style='padding:4px 0;color:#64748b;font-size:13px;'>IP address</td>
  170. <td style='padding:4px 0;color:#1e293b;font-size:13px;font-weight:500;'>{$prevIPSafe}</td>
  171. </tr>
  172. <tr>
  173. <td style='padding:4px 0;color:#64748b;font-size:13px;'>Device</td>
  174. <td style='padding:4px 0;color:#1e293b;font-size:13px;font-weight:500;'>{$prevUASafe}</td>
  175. </tr>
  176. <tr>
  177. <td style='padding:4px 0;color:#64748b;font-size:13px;'>Time</td>
  178. <td style='padding:4px 0;color:#1e293b;font-size:13px;font-weight:500;'>{$prevTimeSafe}</td>
  179. </tr>";
  180. }
  181. ​
  182. $alertHtml = "<!DOCTYPE html>
  183. <html><head><meta charset='UTF-8'></head>
  184. <body style='font-family:Arial,sans-serif;background:#f1f5f9;margin:0;padding:24px 0;'>
  185. <div style='max-width:520px;margin:0 auto;background:#fff;border-radius:12px;overflow:hidden;box-shadow:0 2px 8px rgba(0,0,0,.08);'>
  186. <div style='background:#1e293b;padding:28px 32px;'>
  187. <h1 style='margin:0;color:#fff;font-size:18px;font-weight:600;'>FlatlyPage CMS</h1>
  188. <p style='margin:4px 0 0;color:#94a3b8;font-size:13px;'>Security alert</p>
  189. </div>
  190. <div style='padding:28px 32px 32px;'>
  191. <p style='margin:0 0 20px;font-size:15px;color:#1e293b;font-weight:600;'>Someone just signed in to your account.</p>
  192. <table style='width:100%;border-collapse:collapse;'>
  193. <tr><td colspan='2' style='padding:0 0 4px;font-size:12px;color:#94a3b8;text-transform:uppercase;letter-spacing:.05em;'>Current login</td></tr>
  194. <tr>
  195. <td style='padding:4px 0;color:#64748b;font-size:13px;width:100px;'>IP address</td>
  196. <td style='padding:4px 0;color:#1e293b;font-size:13px;font-weight:500;'>{$currentIPSafe}</td>
  197. </tr>
  198. <tr>
  199. <td style='padding:4px 0;color:#64748b;font-size:13px;'>Device</td>
  200. <td style='padding:4px 0;color:#1e293b;font-size:13px;font-weight:500;'>{$currentUASafe}</td>
  201. </tr>
  202. <tr>
  203. <td style='padding:4px 0;color:#64748b;font-size:13px;'>Time (UTC)</td>
  204. <td style='padding:4px 0;color:#1e293b;font-size:13px;font-weight:500;'>{$nowSafe}</td>
  205. </tr>
  206. {$prevBlock}
  207. </table>
  208. <hr style='border:none;border-top:1px solid #e2e8f0;margin:24px 0 20px;'>
  209. <p style='margin:0;font-size:12px;color:#94a3b8;'>If this wasn't you, change your password right away.</p>
  210. </div>
  211. </div>
  212. </body></html>";
  213. ​
  214. $alertHeaders = "MIME-Version: 1.0\r\n";
  215. $alertHeaders .= "Content-type: text/html; charset=UTF-8\r\n";
  216. $alertHeaders .= "From: FlatlyPage CMS <{$alertFrom}>\r\n";
  217. $alertHeaders .= "Reply-To: {$alertFrom}\r\n";
  218. ​
  219. @mail($alertTo, $alertSubject, $alertHtml, $alertHeaders);
  220. }
  221. ​
  222. $newLogin = [
  223. 'ip' => $currentIP,
  224. 'user_agent' => $currentUA,
  225. 'time' => $now,
  226. ];
  227. @file_put_contents($lastLoginFile, json_encode($newLogin, JSON_PRETTY_PRINT));
  228. ​
  229. if ($loginTracker !== null) {
  230. try {
  231. $loginTracker->recordLogin($username);
  232. } catch (Exception $e) {
  233. error_log('Failed to record login in tracker: ' . $e->getMessage());
  234. }
  235. }
  236. ​
  237. $_SESSION['admin_logged_in'] = true;
  238. $_SESSION['admin_username'] = $username;
  239. $_SESSION['admin_login_time'] = time();
  240. ​
  241. session_regenerate_id(true);
  242. ​
  243. header('Location: ' . BASE_URL . '/admin/dashboard.php');
  244. exit;
  245. } else {
  246. $error = "That username or password isn't right.";
  247. recordLoginAttempt(false);
  248. }
  249. }
  250. }
  251. }
  252. ?>
  253. <!DOCTYPE html>
  254. <html lang="en">
  255. <head>
  256. <meta charset="UTF-8">
  257. <meta name="viewport" content="width=device-width, initial-scale=1.0">
  258. <title><?php echo $adminExists ? 'Login' : 'Setup'; ?> - Admin Dashboard</title>
  259. <link rel="icon" href="/admin/admin.ico" type="image/x-icon">
  260. <script src="https://cdn.tailwindcss.com"></script>
  261. <?= admin_font_head() ?>
  262. <script src="/assets/js/admin-theme.js?v=5"></script>
  263. <style>
  264. * { font-family: var(--font-interface, 'Space Grotesk'), sans-serif; }
  265. </style>
  266. </head>
  267. <body class="min-h-screen bg-gradient-to-br from-slate-900 via-slate-800 to-slate-900 flex items-center justify-center p-4">
  268. <div class="w-full max-w-md">
  269. <div class="text-center mb-8">
  270. <div class="inline-flex items-center justify-center w-16 h-16 bg-blue-600 rounded-2xl mb-4">
  271. <img src="/logos/flatlypage_light.svg" alt="Logo" class="w-10 h-10">
  272. </div>
  273. <h1 class="text-2xl font-bold text-white">FlatlyPage CMS</h1>
  274. <p class="text-slate-400 mt-2">
  275. <?php echo $adminExists ? 'Sign in to your account' : 'Create an admin account'; ?>
  276. </p>
  277. </div>
  278. ​
  279. <div class="bg-white rounded-2xl shadow-2xl p-8">
  280. <?php if ($error): ?>
  281. <div class="mb-6 p-4 bg-red-50 border border-red-200 rounded-xl">
  282. <div class="flex items-center gap-3">
  283. <svg class="w-5 h-5 text-red-500 flex-shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
  284. <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/>
  285. </svg>
  286. <p class="text-red-700 text-sm"><?php echo htmlspecialchars($error, ENT_QUOTES, 'UTF-8'); ?></p>
  287. </div>
  288. </div>
  289. <?php endif; ?>
  290. ​
  291. <?php if ($success): ?>
  292. <div class="mb-6 p-4 bg-green-50 border border-green-200 rounded-xl">
  293. <div class="flex items-center gap-3">
  294. <svg class="w-5 h-5 text-green-500 flex-shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
  295. <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/>
  296. </svg>
  297. <p class="text-green-700 text-sm"><?php echo htmlspecialchars($success, ENT_QUOTES, 'UTF-8'); ?></p>
  298. </div>
  299. </div>
  300. <?php endif; ?>
  301. ​
  302. <?php if (!$adminExists): ?>
  303. <form method="POST" action="" class="space-y-5">
  304. <input type="hidden" name="action" value="register">
  306. <div>
  307. <label for="username" class="block text-sm font-medium text-gray-700 mb-2">
  308. Username
  309. </label>
  310. <input type="text"
  311. id="username"
  312. name="username"
  313. required
  314. autocomplete="username"
  315. class="w-full px-4 py-3 border border-gray-300 rounded-xl focus:ring-2 focus:ring-blue-500 focus:border-blue-500 transition-colors"
  316. placeholder="Enter username">
  317. </div>
  318. ​
  319. <div>
  320. <label for="password" class="block text-sm font-medium text-gray-700 mb-2">
  321. Password
  322. </label>
  323. <input type="password"
  324. id="password"
  325. name="password"
  326. required
  327. minlength="8"
  328. autocomplete="new-password"
  329. class="w-full px-4 py-3 border border-gray-300 rounded-xl focus:ring-2 focus:ring-blue-500 focus:border-blue-500 transition-colors"
  330. placeholder="Minimum 8 characters">
  331. </div>
  332. ​
  333. <div>
  334. <label for="confirm_password" class="block text-sm font-medium text-gray-700 mb-2">
  335. Confirm Password
  336. </label>
  337. <input type="password"
  338. id="confirm_password"
  339. name="confirm_password"
  340. required
  341. minlength="8"
  342. autocomplete="new-password"
  343. class="w-full px-4 py-3 border border-gray-300 rounded-xl focus:ring-2 focus:ring-blue-500 focus:border-blue-500 transition-colors"
  344. placeholder="Confirm your password">
  345. </div>
  346. ​
  347. <div>
  348. <label for="reg_email" class="block text-sm font-medium text-gray-700 mb-2">
  349. Email <span class="text-gray-400 font-normal">(optional, for login alerts)</span>
  350. </label>
  351. <input type="email"
  352. id="reg_email"
  353. name="email"
  354. autocomplete="email"
  355. class="w-full px-4 py-3 border border-gray-300 rounded-xl focus:ring-2 focus:ring-blue-500 focus:border-blue-500 transition-colors"
  356. placeholder="you@example.com">
  357. </div>
  358. ​
  359. <button type="submit"
  360. class="w-full py-3 px-4 bg-blue-600 text-white font-semibold rounded-xl hover:bg-blue-700 focus:ring-4 focus:ring-blue-200 transition-all">
  361. Create Account
  362. </button>
  363. </form>
  364. <?php else: ?>
  365. <form method="POST" action="" class="space-y-5">
  366. <input type="hidden" name="action" value="login">
  368. <div>
  369. <label for="username" class="block text-sm font-medium text-gray-700 mb-2">
  370. Username
  371. </label>
  372. <input type="text"
  373. id="username"
  374. name="username"
  375. required
  376. autocomplete="username"
  377. class="w-full px-4 py-3 border border-gray-300 rounded-xl focus:ring-2 focus:ring-blue-500 focus:border-blue-500 transition-colors"
  378. placeholder="Enter your username">
  379. </div>
  380. ​
  381. <div>
  382. <label for="password" class="block text-sm font-medium text-gray-700 mb-2">
  383. Password
  384. </label>
  385. <input type="password"
  386. id="password"
  387. name="password"
  388. required
  389. autocomplete="current-password"
  390. class="w-full px-4 py-3 border border-gray-300 rounded-xl focus:ring-2 focus:ring-blue-500 focus:border-blue-500 transition-colors"
  391. placeholder="Enter your password">
  392. </div>
  393. ​
  394. <button type="submit"
  395. class="w-full py-3 px-4 bg-blue-600 text-white font-semibold rounded-xl hover:bg-blue-700 focus:ring-4 focus:ring-blue-200 transition-all">
  396. Sign In
  397. </button>
  398. </form>
  399. <?php endif; ?>
  400. </div>
  401. ​
  402. <p class="text-center text-slate-500 text-sm mt-8">
  403. FlatlyPage CMS &copy; <?php echo date('Y'); ?>
  404. </p>
  405. </div>
  406. </body>
  407. </html>