diff --git a/includes/func.class/login.func.php b/includes/func.class/login.func.php
index 626bb5a..6f3173f 100755
--- a/includes/func.class/login.func.php
+++ b/includes/func.class/login.func.php
@@ -51,19 +51,16 @@ function loginLog($user_id, $status) {
$app->post('/login/auth', function (Request $request) {
global $db;
$username = $request->get('username');
- $raw_password = $request->get('password');
-
- // Password encoding
- $password = password_hash($raw_password, PASSWORD_BCRYPT);
- echo $password;
+ $password = $request->get('password');
// Prevent SQL Injection
$db->bind("username", $username);
- $db->bind("password", (string)$password);
+
// Execute
- $users = $db->query("SELECT * FROM users WHERE username= :username");
+ $users = $db->query("SELECT * FROM users WHERE username= :username && status = 1");
if (count($users) > 0) {
- if (password_verify($password, $users['password'])) {
+ echo $users['password'];
+ if (password_verify($password, $users[0]["password"])) {
$_SESSION["username"] = $username;
$_SESSION["user_id"] = $users[0]["user_id"];
$_SESSION["role"] = $users[0]["role"];
@@ -76,14 +73,15 @@ $app->post('/login/auth', function (Request $request) {
$_SESSION["branch_id"] = 0;
}
loginLog($_SESSION["user_id"], "SUCCESS");
- return new Response('Success', 200);
+ return new Response('Success', 200);
}
else{
+ loginLog($_SESSION["user_id"], "FAILED");
return new Response('Failed', 401);
}
} else {
loginLog($_SESSION["user_id"], "FAILED");
- return new Response('Failed', 401);
+ return new Response('Failed. User not Found.', 401);
}
});
$app->post('/forgot-password/reset', function (Request $request) {
@@ -175,7 +173,7 @@ $app->post('/register/submit', function(Request $request) {
$created_on = date("Y-m-d H:i:s");
// Password encoding
- $password = password_hash($raw_password, PASSWORD_BCRYPT);
+ $password = password_hash($raw_password, PASSWORD_DEFAULT);
// END
// Check if the request match the conditional
diff --git a/includes/func.class/logs/2018-03-09.txt b/includes/func.class/logs/2018-03-09.txt
index fb0095e..951ee59 100644
--- a/includes/func.class/logs/2018-03-09.txt
+++ b/includes/func.class/logs/2018-03-09.txt
@@ -1,3 +1,103 @@
+Time : 22:49:09
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:49:04
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:48:22
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username=:username
+
+Time : 22:47:49
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username=:username
+
+Time : 22:46:27
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT user_id FROM users WHERE username = :username
+
+Time : 22:45:39
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT user_id FROM users WHERE username = :username
+
+Time : 22:44:59
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT user_id FROM users WHERE username = :username
+
+Time : 22:43:36
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT user_id FROM users WHERE username = :username
+
+Time : 22:40:34
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username = :username
+
+Time : 22:39:09
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username = :username
+
+Time : 22:35:45
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:35:37
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:33:48
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:33:16
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:31:46
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:31:16
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:30:57
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:28:31
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:28:23
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:26:28
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 22:23:17
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 21:21:32
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 21:20:29
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 17:23:49
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
+Time : 17:19:48
+SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
+Raw SQL : SELECT * FROM users WHERE username= :username
+
Time : 17:19:24
SQLSTATE[HY093]: Invalid parameter number: parameter was not defined
Raw SQL : SELECT * FROM users WHERE username= :username
diff --git a/includes/tpl/login.php b/includes/tpl/login.php
index 80819b8..bae31f1 100755
--- a/includes/tpl/login.php
+++ b/includes/tpl/login.php
@@ -82,7 +82,7 @@
-
+