diff --git a/includes/func.class/login.func.php b/includes/func.class/login.func.php index 626bb5a..6f3173f 100755 --- a/includes/func.class/login.func.php +++ b/includes/func.class/login.func.php @@ -51,19 +51,16 @@ function loginLog($user_id, $status) { $app->post('/login/auth', function (Request $request) { global $db; $username = $request->get('username'); - $raw_password = $request->get('password'); - - // Password encoding - $password = password_hash($raw_password, PASSWORD_BCRYPT); - echo $password; + $password = $request->get('password'); // Prevent SQL Injection $db->bind("username", $username); - $db->bind("password", (string)$password); + // Execute - $users = $db->query("SELECT * FROM users WHERE username= :username"); + $users = $db->query("SELECT * FROM users WHERE username= :username && status = 1"); if (count($users) > 0) { - if (password_verify($password, $users['password'])) { + echo $users['password']; + if (password_verify($password, $users[0]["password"])) { $_SESSION["username"] = $username; $_SESSION["user_id"] = $users[0]["user_id"]; $_SESSION["role"] = $users[0]["role"]; @@ -76,14 +73,15 @@ $app->post('/login/auth', function (Request $request) { $_SESSION["branch_id"] = 0; } loginLog($_SESSION["user_id"], "SUCCESS"); - return new Response('Success', 200); + return new Response('Success', 200); } else{ + loginLog($_SESSION["user_id"], "FAILED"); return new Response('Failed', 401); } } else { loginLog($_SESSION["user_id"], "FAILED"); - return new Response('Failed', 401); + return new Response('Failed. User not Found.', 401); } }); $app->post('/forgot-password/reset', function (Request $request) { @@ -175,7 +173,7 @@ $app->post('/register/submit', function(Request $request) { $created_on = date("Y-m-d H:i:s"); // Password encoding - $password = password_hash($raw_password, PASSWORD_BCRYPT); + $password = password_hash($raw_password, PASSWORD_DEFAULT); // END // Check if the request match the conditional diff --git a/includes/func.class/logs/2018-03-09.txt b/includes/func.class/logs/2018-03-09.txt index fb0095e..951ee59 100644 --- a/includes/func.class/logs/2018-03-09.txt +++ b/includes/func.class/logs/2018-03-09.txt @@ -1,3 +1,103 @@ +Time : 22:49:09 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:49:04 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:48:22 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username=:username + +Time : 22:47:49 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username=:username + +Time : 22:46:27 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT user_id FROM users WHERE username = :username + +Time : 22:45:39 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT user_id FROM users WHERE username = :username + +Time : 22:44:59 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT user_id FROM users WHERE username = :username + +Time : 22:43:36 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT user_id FROM users WHERE username = :username + +Time : 22:40:34 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username = :username + +Time : 22:39:09 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username = :username + +Time : 22:35:45 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:35:37 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:33:48 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:33:16 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:31:46 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:31:16 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:30:57 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:28:31 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:28:23 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:26:28 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 22:23:17 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 21:21:32 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 21:20:29 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 17:23:49 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + +Time : 17:19:48 +SQLSTATE[HY093]: Invalid parameter number: parameter was not defined +Raw SQL : SELECT * FROM users WHERE username= :username + Time : 17:19:24 SQLSTATE[HY093]: Invalid parameter number: parameter was not defined Raw SQL : SELECT * FROM users WHERE username= :username diff --git a/includes/tpl/login.php b/includes/tpl/login.php index 80819b8..bae31f1 100755 --- a/includes/tpl/login.php +++ b/includes/tpl/login.php @@ -82,7 +82,7 @@ - +