sync

2025-03-06 23:08:52 -07:00
parent 86d501c980
commit 551abb66b5
12 changed files with 514 additions and 20 deletions
@@ -0,0 +1,114 @@
+<?php
+
+if (!isset($_GET['action']))
+    header('Location: .');
+
+include_once('includes/functions.php');
+
+$action = $_GET['action'];
+
+switch ($action) {
+    case 'login':
+        $error_location = 'login.php?error=';
+        $success_location = 'pages/home.php';
+
+        // If fields are empty, redirect to login with error state.
+        if (empty($_POST['login_username']) || empty($_POST['login_password']))
+            header('Location: ' . $error_location . 'empty');
+
+        include_once('fields/login_fields.php');
+        // If field inputs are invalid, redirect to login with error state.
+        foreach ($_POST as $field => $value) {
+            if (!validate($value, $login_fields[$field]['validators']))
+                header('Location: ' . $error_location . 'invalid');
+        }
+
+        $username = $_POST['login_username'];
+        $password_hash = hash('sha256', $_POST['login_password']);
+
+        // If username/password hash are incorrect, redirect to login with error state.
+        if (!authorize($username, $password_hash))
+            header('Location: ' . $error_location . 'incorrect');
+
+        unset($_POST['login_username']);
+        unset($_POST['login_password']);
+
+        // auth() handles setting $_SESSION variables, user is now OK to proceed to home.php.
+        // header('Location: ' . $success_location);
+    default:
+        // code...
+        break;
+}
+
+function validate($input, $validators)
+{
+    include_once('includes/input_validation.php');
+
+    foreach ($validators as $v) {
+        switch ($v) {
+            case 'no_spaces':
+                if (!no_spaces($input))
+                    return false;
+                break;
+
+            case 'no_digits':
+                if (!no_digits($input))
+                    return false;
+                break;
+
+            case 'no_backslash':
+                if (!no_backslash($input))
+                    return false;
+                break;
+
+            case 'no_special':
+                if (!no_special($input))
+                    return false;
+                break;
+
+            case 'only_digits':
+                if (!only_digits($input))
+                    return false;
+                break;
+
+            // TODO: Need to get x.
+            case 'only_digits_x':
+                if (!only_digits_x($input, 5))
+                    return false;
+                break;
+
+            case 'only_letters':
+                if (!only_letters($input))
+                    return false;
+                break;
+
+            // TODO: Need to get x.
+            case 'only_letters_x':
+                if (!only_letters_x($input, 5))
+                    return false;
+                break;
+
+            case 'valid_email':
+                if (!valid_email($input))
+                    return false;
+                break;
+
+            case 'valid_phone':
+                if (!valid_phone($input))
+                    return false;
+                break;
+
+            case 'pw_strength':
+                if (!pw_strength($input))
+                    return false;
+                break;
+
+            case 'check_sql':
+                if (check_sql($input))
+                    return false;
+                break;
+        }
+    }
+
+    return true;
+}