cief/ARCHIVED-IZYIM
1
0
Fork 0
mirror of https://gitlab.com/CIEFWorldwideSdnBhd/ARCHIVED-IZYIM.git synced 2026-08-19 04:14:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

added encrpytion for password

Browse Source
This commit is contained in:
Jackk Goh
2018-03-09 17:19:45 +08:00
parent 8b411ff273
commit 24314b5e33
2 changed files with 41 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/func.class/login.func.php
+37 -21
View File
@@ -18,7 +18,6 @@ $sid = 'ACf33c135ae826f004d380c8ef3e437eae';
$token = '3b0fcbf497d12ce4a13c99020046a880';
$twilio = new Client($sid, $token);
function get_client_ip() {
$ipaddress = '';
if (isset($_SERVER['HTTP_CLIENT_IP']))
@@ -52,27 +51,36 @@ function loginLog($user_id, $status) {
$app->post('/login/auth', function (Request $request) {
global $db;
$username = $request->get('username');
$password = $request->get('password');
$raw_password = $request->get('password');
// Password encoding
$password = password_hash($raw_password, PASSWORD_BCRYPT);
echo $password;
// Prevent SQL Injection
$db->bind("username", $username);
$db->bind("password", $password);
$db->bind("password", (string)$password);
// Execute
$users = $db->query("SELECT * FROM users WHERE username= :username && password= :password && status = 1");
$users = $db->query("SELECT * FROM users WHERE username= :username");
if (count($users) > 0) {
$_SESSION["username"] = $username;
$_SESSION["user_id"] = $users[0]["user_id"];
$_SESSION["role"] = $users[0]["role"];
$_SESSION["group_id"] = $users[0]["group_id"];
if($users[0]["role"] > 0){
$_SESSION["company_id"] = getCompany($users[0]["user_id"]);
$_SESSION["branch_id"] = getBranch($users[0]["user_id"]);
}else{
$_SESSION["company_id"] = 0;
$_SESSION["branch_id"] = 0;
}
loginLog($_SESSION["user_id"], "SUCCESS");
return new Response('Success', 200);
if (password_verify($password, $users['password'])) {
$_SESSION["username"] = $username;
$_SESSION["user_id"] = $users[0]["user_id"];
$_SESSION["role"] = $users[0]["role"];
$_SESSION["group_id"] = $users[0]["group_id"];
if($users[0]["role"] > 0){
$_SESSION["company_id"] = getCompany($users[0]["user_id"]);
$_SESSION["branch_id"] = getBranch($users[0]["user_id"]);
}else{
$_SESSION["company_id"] = 0;
$_SESSION["branch_id"] = 0;
}
loginLog($_SESSION["user_id"], "SUCCESS");
return new Response('Success', 200);
}
else{
return new Response('Failed', 401);
}
} else {
loginLog($_SESSION["user_id"], "FAILED");
return new Response('Failed', 401);
@@ -158,12 +166,17 @@ $app->post('/register/send-verification', function(Request $request) {
$app->post('/register/submit', function(Request $request) {
global $db;
global $global_env;
global $app;
// Catch the GET
$username = $request->get('username');
$password = $request->get('password');
$raw_password = $request->get('password');
$group_id = $request->get('role');
$created_on = date("Y-m-d H:i:s");
// Password encoding
$password = password_hash($raw_password, PASSWORD_BCRYPT);
// END
// Check if the request match the conditional
if (!userExist($username) && groupExist($group_id) && is_numeric($group_id)) {
@@ -191,10 +204,13 @@ $app->post('/register/submit', function(Request $request) {
return new Response("SUCCESS", 200);
} else {
// action_log($_SESSION['user_id'], "User Registration " . $first_name . " " . $last_name ." (" .$username . ")", "FAILED");
return new Response('FAILED', 200);
return new Response('FAILED', 400);
}
}
}
else{
return new Response('FAILED', 400);
}
});
$app->get('/login', function() {
global $app;
includes/func.class/logs/2018-03-09.txt
+4
View File
@@ -1,3 +1,7 @@
Time : 17:19:24
SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
Raw SQL : SELECT * FROM users WHERE username= :username
Time : 16:23:44
SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
Raw SQL : SELECT * FROM mobile_verifications WHERE mobile = :username AND verification_code = :verification_no