99 lines
3.0 KiB
PHP
99 lines
3.0 KiB
PHP
|
<?php
|
||
|
|
require_once('../config.php');
|
||
|
|
require_once ('mencrypt.php');
|
||
|
|
session_name($CFG->sessionname);
|
||
|
|
session_start();
|
||
|
|
global $link;
|
||
|
|
dbConnect();
|
||
|
|
|
||
|
|
// Check connection
|
||
|
|
if (!$link) {
|
||
|
|
die("Connection failed: " . mysqli_connect_error());
|
||
|
|
}
|
||
|
|
|
||
|
|
$numerodeempleado = isset($_POST['numempl']) ? trim($_POST['numempl']) : '';
|
||
|
|
|
||
|
|
// Límite de intentos por IP (mitiga enumeración / fuerza bruta)
|
||
|
|
function lms_rate_limit($key, $max = 60, $window = 600) {
|
||
|
|
$file = sys_get_temp_dir() . '/lms_rl_' . md5($key);
|
||
|
|
$now = time();
|
||
|
|
$data = array();
|
||
|
|
if (is_file($file)) {
|
||
|
|
$tmp = json_decode(@file_get_contents($file), true);
|
||
|
|
if (is_array($tmp)) { $data = $tmp; }
|
||
|
|
}
|
||
|
|
$data = array_values(array_filter($data, function ($t) use ($now, $window) {
|
||
|
|
return $t > $now - $window;
|
||
|
|
}));
|
||
|
|
if (count($data) >= $max) { return false; }
|
||
|
|
$data[] = $now;
|
||
|
|
@file_put_contents($file, json_encode($data), LOCK_EX);
|
||
|
|
return true;
|
||
|
|
}
|
||
|
|
|
||
|
|
$userip = getUserIP();
|
||
|
|
if (!lms_rate_limit('login_' . $userip)) {
|
||
|
|
header("Location:".$CFG->wwwroot.'?errorcode=0');
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Buscar usuario (consulta preparada)
|
||
|
|
$stmt = mysqli_prepare($link, "select * from user where numempl = ? and habilitado = 1 limit 1");
|
||
|
|
mysqli_stmt_bind_param($stmt, 's', $numerodeempleado);
|
||
|
|
mysqli_stmt_execute($stmt);
|
||
|
|
$result = mysqli_stmt_get_result($stmt);
|
||
|
|
$user = $result ? mysqli_fetch_array($result) : null;
|
||
|
|
mysqli_stmt_close($stmt);
|
||
|
|
|
||
|
|
if (!$user) {
|
||
|
|
header("Location:".$CFG->wwwroot.'?errorcode=0');
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Actualizar último acceso (consulta preparada)
|
||
|
|
$stmt = mysqli_prepare($link, "update user set lastip = ?, lastlogin = NOW() where numempl = ?");
|
||
|
|
mysqli_stmt_bind_param($stmt, 'ss', $userip, $numerodeempleado);
|
||
|
|
mysqli_stmt_execute($stmt);
|
||
|
|
mysqli_stmt_close($stmt);
|
||
|
|
|
||
|
|
// Evitar fijación de sesión
|
||
|
|
session_regenerate_id(true);
|
||
|
|
|
||
|
|
$_SESSION['usersession'] = json_encode($user, JSON_UNESCAPED_UNICODE);
|
||
|
|
$_SESSION['numerodeempleado'] = $numerodeempleado;
|
||
|
|
|
||
|
|
$url_encriptado = $encriptar($numerodeempleado);
|
||
|
|
if ($user['idrol'] == 1) {
|
||
|
|
$_SESSION['isadmin'] = false;
|
||
|
|
$vars = "../dashboard.php?uniq=".urlencode($url_encriptado);
|
||
|
|
header('Location: '.$vars);
|
||
|
|
exit;
|
||
|
|
} else {
|
||
|
|
$_SESSION['isadmin'] = true;
|
||
|
|
header('Location: ../admin/');
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
function getUserIP() {
|
||
|
|
$ipaddress = '';
|
||
|
|
if (isset($_SERVER['HTTP_CLIENT_IP']))
|
||
|
|
$ipaddress = $_SERVER['HTTP_CLIENT_IP'];
|
||
|
|
else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
|
||
|
|
$ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR'];
|
||
|
|
else if(isset($_SERVER['HTTP_X_FORWARDED']))
|
||
|
|
$ipaddress = $_SERVER['HTTP_X_FORWARDED'];
|
||
|
|
else if(isset($_SERVER['HTTP_X_CLUSTER_CLIENT_IP']))
|
||
|
|
$ipaddress = $_SERVER['HTTP_X_CLUSTER_CLIENT_IP'];
|
||
|
|
else if(isset($_SERVER['HTTP_FORWARDED_FOR']))
|
||
|
|
$ipaddress = $_SERVER['HTTP_FORWARDED_FOR'];
|
||
|
|
else if(isset($_SERVER['HTTP_FORWARDED']))
|
||
|
|
$ipaddress = $_SERVER['HTTP_FORWARDED'];
|
||
|
|
else if(isset($_SERVER['REMOTE_ADDR']))
|
||
|
|
$ipaddress = $_SERVER['REMOTE_ADDR'];
|
||
|
|
else
|
||
|
|
$ipaddress = 'UNKNOWN';
|
||
|
|
return substr($ipaddress, 0, 100);
|
||
|
|
}
|
||
|
|
|
||
|
|
?>
|