From 7e211c7a8bb17776dac924433886d0c12eff76b9 Mon Sep 17 00:00:00 2001 From: Lain Iwakura Date: Mon, 16 Jun 2025 02:25:29 +0300 Subject: [PATCH] clean debug --- main/login.php | 173 ++++++++++++++++++---------------------------- main/register.php | 151 ++++++++++++++++++---------------------- 2 files changed, 136 insertions(+), 188 deletions(-) diff --git a/main/login.php b/main/login.php index f74ec5a..d89386d 100644 --- a/main/login.php +++ b/main/login.php @@ -1,124 +1,89 @@ setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); - $debug[] = "Database connected"; -} catch (PDOException $e) { - $debug[] = "Database error: " . $e->getMessage(); - die("Database connection error: " . $e->getMessage()); -} - -$error = ''; -$success = ''; - if ($_SERVER['REQUEST_METHOD'] === 'POST') { - $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); - $password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING); + $username = $_POST['username'] ?? ''; + $password = $_POST['password'] ?? ''; - $debug[] = "Login attempt for: " . $username; - - if ($username && $password) { - try { - $stmt = $db->prepare('SELECT id, password, is_blocked, login_attempts, last_attempt FROM users WHERE username = ?'); - $stmt->execute([$username]); - $user = $stmt->fetch(PDO::FETCH_ASSOC); - - $debug[] = "User found: " . ($user ? 'yes' : 'no'); - + try { + $pdo = new PDO( + "mysql:host={$config['db_host']};dbname={$config['db_name']};charset=utf8mb4", + $config['db_user'], + $config['db_pass'], + [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION] + ); + + $stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?"); + $stmt->execute([$username]); + $user = $stmt->fetch(); + + if ($user && password_verify($password, $user['password'])) { + if ($user['is_blocked']) { + $error = "Аккаунт заблокирован: " . htmlspecialchars($user['block_reason']); + } else { + $_SESSION['user_id'] = $user['id']; + $_SESSION['username'] = $user['username']; + $_SESSION['is_moderator'] = $user['is_moderator']; + + $stmt = $pdo->prepare("UPDATE users SET login_attempts = 0, last_attempt = NULL WHERE id = ?"); + $stmt->execute([$user['id']]); + + header("Location: index.php"); + exit; + } + } else { if ($user) { - if ($user['is_blocked']) { - $error = 'Account is blocked'; - $debug[] = "Account blocked"; - } else if ($user['login_attempts'] >= 5 && strtotime($user['last_attempt']) > strtotime('-15 minutes')) { - $error = 'Too many login attempts'; - $debug[] = "Too many attempts"; - } else if (password_verify($password, $user['password'])) { - $stmt = $db->prepare('UPDATE users SET login_attempts = 0, last_attempt = NOW() WHERE id = ?'); + $stmt = $pdo->prepare("UPDATE users SET login_attempts = login_attempts + 1, last_attempt = CURRENT_TIMESTAMP WHERE id = ?"); + $stmt->execute([$user['id']]); + + if ($user['login_attempts'] >= 4) { + $stmt = $pdo->prepare("UPDATE users SET is_blocked = 1, block_reason = 'Превышено количество попыток входа' WHERE id = ?"); $stmt->execute([$user['id']]); - $_SESSION['user_id'] = $user['id']; - $_SESSION['username'] = $username; - $debug[] = "Login successful"; - header('Location: index.php'); - exit; + $error = "Аккаунт заблокирован из-за превышения количества попыток входа"; } else { - $stmt = $db->prepare('UPDATE users SET login_attempts = login_attempts + 1, last_attempt = NOW() WHERE id = ?'); - $stmt->execute([$user['id']]); - $error = 'Invalid password'; - $debug[] = "Invalid password"; + $error = "Неверный пароль"; } } else { - $error = 'User not found'; - $debug[] = "User not found"; + $error = "Пользователь не найден"; } - } catch (PDOException $e) { - $error = 'Server error'; - $debug[] = "SQL Error: " . $e->getMessage(); - $debug[] = "SQL State: " . $e->getCode(); } + } catch (PDOException $e) { + $error = "Ошибка сервера"; } } ?> - + - - Text0Nly - Login - + + + Вход + -

Login

- -
- - -
- - -
-
- -
-
- -
- -
-

Register | Back to chat

- - -
- Debug info:
- -
- -
- +
+

Вход

+ +
+ + +
+ +
+
+ + +
+
+ + +
+ +
+

Нет аккаунта? Зарегистрироваться

+
- - \ No newline at end of file + \ No newline at end of file diff --git a/main/register.php b/main/register.php index a8e79d2..8b22af6 100644 --- a/main/register.php +++ b/main/register.php @@ -1,100 +1,83 @@ setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); - -$error = ''; -$success = ''; - if ($_SERVER['REQUEST_METHOD'] === 'POST') { - $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING); - $password = filter_input(INPUT_POST, 'password', FILTER_SANITIZE_STRING); - $pgp_key = filter_input(INPUT_POST, 'pgp_key', FILTER_SANITIZE_STRING); - - if ($username && $password) { - if (strlen($username) > 50 || strlen($password) < 8 || !preg_match('/^[a-zA-Z0-9_]+$/', $username)) { - $error = 'Invalid data'; - } else if (strlen($pgp_key) > 4096) { - $error = 'PGP key is too long'; + $username = $_POST['username'] ?? ''; + $password = $_POST['password'] ?? ''; + $pgp_key = $_POST['pgp_key'] ?? ''; + + try { + $pdo = new PDO( + "mysql:host={$config['db_host']};dbname={$config['db_name']};charset=utf8mb4", + $config['db_user'], + $config['db_pass'], + [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION] + ); + + $stmt = $pdo->prepare("SELECT COUNT(*) FROM registrations WHERE created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)"); + $stmt->execute(); + $recent_registrations = $stmt->fetchColumn(); + + if ($recent_registrations >= 3) { + $error = "Слишком много регистраций за последний час. Попробуйте позже."; } else { - $stmt = $db->prepare('SELECT COUNT(*) FROM registrations WHERE created_at > DATE_SUB(NOW(), INTERVAL 1 HOUR)'); - $stmt->execute(); - $count = $stmt->fetchColumn(); - - if ($count >= 20) { - $error = 'Registration limit exceeded'; + $stmt = $pdo->prepare("SELECT COUNT(*) FROM users WHERE username = ?"); + $stmt->execute([$username]); + if ($stmt->fetchColumn() > 0) { + $error = "Пользователь с таким именем уже существует"; } else { - try { - $stmt = $db->prepare('INSERT INTO users (username, password, pgp_key, login_attempts, last_attempt) VALUES (?, ?, ?, 0, NOW())'); - $stmt->execute([ - $username, - password_hash($password, PASSWORD_DEFAULT, ['cost' => 12]), - $pgp_key - ]); - - $stmt = $db->prepare('INSERT INTO registrations () VALUES ()'); - $stmt->execute(); - - $success = 'Registration successful'; - } catch (PDOException $e) { - $error = 'Username already exists'; - } + $hashed_password = password_hash($password, PASSWORD_DEFAULT); + + $stmt = $pdo->prepare("INSERT INTO users (username, password, pgp_key) VALUES (?, ?, ?)"); + $stmt->execute([$username, $hashed_password, $pgp_key]); + + $stmt = $pdo->prepare("INSERT INTO registrations (created_at) VALUES (NOW())"); + $stmt->execute(); + + $success = "Регистрация успешна! Теперь вы можете войти."; } } + } catch (PDOException $e) { + $error = "Ошибка сервера"; } } ?> - + - - Text0Nly - Registration - + + + Регистрация + -

Registration

- -
- - -
- - -
-
- -
-
- -
-
- -
- -
-

Back to chat

+
+

Регистрация

+ +
+ + +
+ +
+
+ + +
+
+ + +
+
+ + +
+ +
+

Уже есть аккаунт? Войти

+
- - \ No newline at end of file + \ No newline at end of file