From 290aa31aa7cf1dfaea2c5e282cad0bec3ebcd200 Mon Sep 17 00:00:00 2001 From: Jacek Pyziak Date: Thu, 11 Dec 2025 23:57:22 +0100 Subject: [PATCH] Add two-factor authentication fields to pp_users table and update .htaccess for security - Added columns for two-factor authentication (2FA) in the pp_users table: - twofa_enabled (TINYINT) - twofa_email (VARCHAR) - twofa_code_hash (VARCHAR) - twofa_expires_at (DATETIME) - twofa_sent_at (DATETIME) - twofa_failed_attempts (INT) - Updated the twofa_enabled and twofa_email for user with id 0. - Enhanced .htaccess to disable directory listing, block execution of sensitive files, and prevent serving hidden files. --- admin/index.php | 17 +++ admin/layout/.htaccess | 20 +++ admin/templates/.htaccess | 20 +++ admin/templates/site/unlogged-layout.php | 12 +- admin/templates/site/unlogged.php | 60 ++++++++ admin/templates/users/user-2fa.php | 18 +++ admin/templates/users/user-edit.php | 29 ++-- autoload/admin/class.Site.php | 176 +++++++++++++++++++++-- autoload/admin/controls/class.Users.php | 8 +- autoload/admin/factory/class.Users.php | 172 +++++++++++++++++----- autoload/admin/view/class.Page.php | 6 +- layout/.htaccess | 20 +++ libraries/.htaccess | 20 +++ plugins/.htaccess | 20 +++ templates/.htaccess | 20 +++ updates/0.20/ver_0.231.zip | Bin 0 -> 1219051 bytes updates/0.20/ver_0.231_sql.txt | 7 + updates/changelog.php | 3 + updates/versions.php | 2 +- upload/.htaccess | 20 +++ 20 files changed, 590 insertions(+), 60 deletions(-) create mode 100644 admin/layout/.htaccess create mode 100644 admin/templates/.htaccess create mode 100644 admin/templates/site/unlogged.php create mode 100644 admin/templates/users/user-2fa.php create mode 100644 layout/.htaccess create mode 100644 libraries/.htaccess create mode 100644 plugins/.htaccess create mode 100644 templates/.htaccess create mode 100644 updates/0.20/ver_0.231.zip create mode 100644 updates/0.20/ver_0.231_sql.txt create mode 100644 upload/.htaccess diff --git a/admin/index.php b/admin/index.php index ad2b68d..170dfca 100644 --- a/admin/index.php +++ b/admin/index.php @@ -85,5 +85,22 @@ $user = \S::get_session( 'user', true ); \admin\Site::update(); \admin\Site::special_actions(); +$domain = preg_replace( '#^(http(s)?://)?w{3}\.#', '$1', $_SERVER['SERVER_NAME'] ); +$cookie_name = str_replace( '.', '-', $domain ); + +if ( isset( $_COOKIE[$cookie_name] ) && !isset( $_SESSION['user'] ) ) +{ + $obj = json_decode( $_COOKIE[$cookie_name] ); + $login = $obj -> {'login'}; + $password = $obj -> {'hash'}; + + if ( $mdb -> get( 'pp_users', '*', [ 'AND' => [ 'login' => $login, 'status' => 1, 'password' => $password ] ] ) ) + { + \S::set_session( 'user', \admin\factory\Users::details( $login ) ); + header( 'Location: /admin/articles/view_list/' ); + exit; + } +} + echo \admin\view\Page::show(); ?> \ No newline at end of file diff --git a/admin/layout/.htaccess b/admin/layout/.htaccess new file mode 100644 index 0000000..4aba16f --- /dev/null +++ b/admin/layout/.htaccess @@ -0,0 +1,20 @@ +# Wyłącz listowanie +Options -Indexes + +# Domyślnie blokujemy wszystko… +Require all denied + +# …a dopiero potem pozwalamy na pliki statyczne + + Require all granted + + +# Twardo blokuj cokolwiek, co mogłoby się wykonać + + Require all denied + + +# Nie serwuj plików ukrytych (.env itp.) + + Require all denied + \ No newline at end of file diff --git a/admin/templates/.htaccess b/admin/templates/.htaccess new file mode 100644 index 0000000..4aba16f --- /dev/null +++ b/admin/templates/.htaccess @@ -0,0 +1,20 @@ +# Wyłącz listowanie +Options -Indexes + +# Domyślnie blokujemy wszystko… +Require all denied + +# …a dopiero potem pozwalamy na pliki statyczne + + Require all granted + + +# Twardo blokuj cokolwiek, co mogłoby się wykonać + + Require all denied + + +# Nie serwuj plików ukrytych (.env itp.) + + Require all denied + \ No newline at end of file diff --git a/admin/templates/site/unlogged-layout.php b/admin/templates/site/unlogged-layout.php index ffe1aaa..9e24134 100644 --- a/admin/templates/site/unlogged-layout.php +++ b/admin/templates/site/unlogged-layout.php @@ -63,9 +63,15 @@ -
- -
+
+
+ + +
+
+
+ +