Jacek Pyziak
290aa31aa7
- Added columns for two-factor authentication (2FA) in the pp_users table: - twofa_enabled (TINYINT) - twofa_email (VARCHAR) - twofa_code_hash (VARCHAR) - twofa_expires_at (DATETIME) - twofa_sent_at (DATETIME) - twofa_failed_attempts (INT) - Updated the twofa_enabled and twofa_email for user with id 0. - Enhanced .htaccess to disable directory listing, block execution of sensitive files, and prevent serving hidden files.
106 lines
2.9 KiB
PHP
106 lines
2.9 KiB
PHP
<?
|
|
error_reporting( E_ALL ^ E_NOTICE ^ E_STRICT ^ E_WARNING ^ E_DEPRECATED );
|
|
if ( file_exists( 'ip.conf' ) )
|
|
{
|
|
$ips = file_get_contents( 'ip.conf' );
|
|
$ips = preg_split( "/\\r\\n|\\r|\\n/", $ips );
|
|
$ips = array_filter( $ips );
|
|
if ( is_array( $ips ) and!empty( $ips ) )
|
|
{
|
|
if ( !in_array( $_SERVER['REMOTE_ADDR'], $ips ) )
|
|
die( 'Brak dostępu.' );
|
|
}
|
|
}
|
|
|
|
function __autoload_my_classes( $classname )
|
|
{
|
|
$q = explode( '\\', $classname );
|
|
$c = array_pop( $q );
|
|
$f = '../autoload/' . implode( '/', $q ) . '/class.' . $c . '.php';
|
|
if ( file_exists( $f ) )
|
|
require_once( $f );
|
|
}
|
|
|
|
spl_autoload_register( '__autoload_my_classes' );
|
|
require_once '../config.php';
|
|
require_once '../libraries/medoo/medoo.php';
|
|
require_once '../libraries/grid/config.php';
|
|
require_once '../libraries/rb.php';
|
|
require_once '../libraries/phpmailer/class.phpmailer.php';
|
|
require_once '../libraries/phpmailer/class.smtp.php';
|
|
|
|
define( 'REDBEAN_MODEL_PREFIX', '' );
|
|
\R::setup( 'mysql:host=' . $database['host'] . ';dbname=' . $database['name'], $database['user'], $database['password'] );
|
|
\R::ext( 'xdispense', function ( $type )
|
|
{
|
|
return R::getRedBean() -> dispense( $type );
|
|
} );
|
|
|
|
date_default_timezone_set( 'Europe/Warsaw' );
|
|
|
|
$settings = \front\factory\Settings::settings_details();
|
|
|
|
if ( file_exists( 'config.php' ) )
|
|
include 'config.php';
|
|
|
|
session_start();
|
|
|
|
if ( !isset( $_SESSION['check'] ) )
|
|
{
|
|
session_regenerate_id();
|
|
$_SESSION['check'] = true;
|
|
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
|
|
}
|
|
|
|
if ( $_SESSION['ip'] !== $_SERVER['REMOTE_ADDR'] )
|
|
{
|
|
session_destroy();
|
|
header( 'Location: /admin/' );
|
|
exit;
|
|
}
|
|
|
|
if ( !$lang_id = \S::get_session( 'current-lang' ) )
|
|
{
|
|
$lang_id = \front\factory\Languages::default_language();
|
|
\S::set_session( 'current-lang', $lang_id );
|
|
}
|
|
|
|
if ( !$lang = \S::get_session( 'lang-' . $lang_id ) )
|
|
{
|
|
$lang = \front\factory\Languages::lang_translations( $lang_id );
|
|
\S::set_session( 'lang-' . $lang_id, $lang );
|
|
}
|
|
|
|
$mdb = new medoo( [
|
|
'database_type' => 'mysql',
|
|
'database_name' => $database['name'],
|
|
'server' => $database['host'],
|
|
'username' => $database['user'],
|
|
'password' => $database['password'],
|
|
'charset' => 'utf8'
|
|
] );
|
|
|
|
$user = \S::get_session( 'user', true );
|
|
|
|
\admin\Site::update();
|
|
\admin\Site::special_actions();
|
|
|
|
$domain = preg_replace( '#^(http(s)?://)?w{3}\.#', '$1', $_SERVER['SERVER_NAME'] );
|
|
$cookie_name = str_replace( '.', '-', $domain );
|
|
|
|
if ( isset( $_COOKIE[$cookie_name] ) && !isset( $_SESSION['user'] ) )
|
|
{
|
|
$obj = json_decode( $_COOKIE[$cookie_name] );
|
|
$login = $obj -> {'login'};
|
|
$password = $obj -> {'hash'};
|
|
|
|
if ( $mdb -> get( 'pp_users', '*', [ 'AND' => [ 'login' => $login, 'status' => 1, 'password' => $password ] ] ) )
|
|
{
|
|
\S::set_session( 'user', \admin\factory\Users::details( $login ) );
|
|
header( 'Location: /admin/articles/view_list/' );
|
|
exit;
|
|
}
|
|
}
|
|
|
|
echo \admin\view\Page::show();
|
|
?>
|