115 lines
3.2 KiB
PHP
115 lines
3.2 KiB
PHP
<?php
|
|
|
|
if (!isset($_GET['action']))
|
|
header('Location: .');
|
|
|
|
include_once ('includes/functions.php');
|
|
|
|
$action = $_GET['action'];
|
|
|
|
switch ($action) {
|
|
case 'login':
|
|
$error_location = 'login.php?error=';
|
|
$success_location = 'pages/home.php';
|
|
|
|
// If fields are empty, redirect to login with error state.
|
|
if (empty($_POST['login_username']) || empty($_POST['login_password']))
|
|
header('Location: ' . $error_location . 'empty');
|
|
|
|
include_once ('fields/login_fields.php');
|
|
// If field inputs are invalid, redirect to login with error state.
|
|
foreach ($_POST as $field => $value) {
|
|
if (!validate($value, $login_fields[$field]['validators']))
|
|
header('Location: ' . $error_location . 'invalid');
|
|
}
|
|
|
|
$username = $_POST['login_username'];
|
|
$password_hash = hash('sha256', $_POST['login_password']);
|
|
|
|
// If username/password hash are incorrect, redirect to login with error state.
|
|
if (!authorize($username, $password_hash))
|
|
header('Location: ' . $error_location . 'incorrect');
|
|
|
|
unset($_POST['login_username']);
|
|
unset($_POST['login_password']);
|
|
|
|
// auth() handles setting $_SESSION variables, user is now OK to proceed to home.php.
|
|
header('Location: ' . $success_location);
|
|
default:
|
|
// code...
|
|
break;
|
|
}
|
|
|
|
function validate($input, $validators)
|
|
{
|
|
include_once ('includes/input_validation.php');
|
|
|
|
foreach ($validators as $v) {
|
|
switch ($v) {
|
|
case 'no_spaces':
|
|
if (!no_spaces($input))
|
|
return false;
|
|
break;
|
|
|
|
case 'no_digits':
|
|
if (!no_digits($input))
|
|
return false;
|
|
break;
|
|
|
|
case 'no_backslash':
|
|
if (!no_backslash($input))
|
|
return false;
|
|
break;
|
|
|
|
case 'no_special':
|
|
if (!no_special($input))
|
|
return false;
|
|
break;
|
|
|
|
case 'only_digits':
|
|
if (!only_digits($input))
|
|
return false;
|
|
break;
|
|
|
|
// TODO: Need to get x.
|
|
case 'only_digits_x':
|
|
if (!only_digits_x($input, 5))
|
|
return false;
|
|
break;
|
|
|
|
case 'only_letters':
|
|
if (!only_letters($input))
|
|
return false;
|
|
break;
|
|
|
|
// TODO: Need to get x.
|
|
case 'only_letters_x':
|
|
if (!only_letters_x($input, 5))
|
|
return false;
|
|
break;
|
|
|
|
case 'valid_email':
|
|
if (!valid_email($input))
|
|
return false;
|
|
break;
|
|
|
|
case 'valid_phone':
|
|
if (!valid_phone($input))
|
|
return false;
|
|
break;
|
|
|
|
case 'pw_strength':
|
|
if (!pw_strength($input))
|
|
return false;
|
|
break;
|
|
|
|
case 'check_sql':
|
|
if (check_sql($input))
|
|
return false;
|
|
break;
|
|
}
|
|
}
|
|
|
|
return true;
|
|
}
|