Initial commit

htdocs/upload.xytriza.com/api/loginAccount.php

@@ -0,0 +1,137 @@
+<?php
+require '../config/config.php';
+require '../incl/main.php';
+
+$ip = $_SERVER['REMOTE_ADDR'];
+
+$token = isset($_POST['captcha_token']) ? $_POST['captcha_token'] : '';
+
+$url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
+$data = [
+    'secret'    => '0x4AAAAAAARIYYLl4IlaAeS9Q40g-Y6QZ9M',
+    'response'  => $token,
+    'remoteip'  => $ip,
+];
+
+$options = [
+    'http' => [
+        'header'  => 'Content-type: application/x-www-form-urlencoded',
+        'method'  => 'POST',
+        'content' => http_build_query($data),
+    ],
+];
+
+$context = stream_context_create($options);
+$result = file_get_contents($url, false, $context);
+
+if ($result !== false) {
+    $outcome = json_decode($result, true);
+
+    if (!isset($outcome['success']) || !$outcome['success']) {
+        $response = [
+            'success' => 'false',
+            'response' => 'Invalid captcha',
+        ];
+    
+        http_response_code(403);
+        header('Content-Type: application/json');
+        die(json_encode($response));
+    }
+} else {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to validate captcha',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+
+if ($conn->connect_error) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to access database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+function generateRandomString($length) {
+    $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+    $randomString = '';
+    for ($i = 0; $i < $length; $i++) {
+        $randomString .= $characters[random_int(0, strlen($characters) - 1)];
+    }
+    return $randomString;
+}
+
+$request_username = $_POST['username'];
+$request_password = $_POST['password'];
+
+$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
+$stmt->bind_param("s", $request_username);
+
+$stmt->execute();
+
+$result = $stmt->get_result();
+
+if ($result->num_rows > 0) {
+    while($row = $result->fetch_assoc()) {
+        if (password_verify($request_password, $row["password"])) {
+            $login_ip = $_SERVER['REMOTE_ADDR'];
+            $login_time = time();
+            $session_token = generateRandomString(255);
+            $session_expires = $login_time + (7 * 24 * 60 * 60);
+            $uid = $row['uid'];
+
+            $stmt = $conn->prepare("UPDATE users SET session = ?, session_expire = ?, latest_ip = ? WHERE uid = ?");
+            $stmt->bind_param("sssi", $session_token, $session_expires, $login_ip, $uid);
+            $stmt->execute();
+
+            $stmt = $conn->prepare("INSERT INTO logins (uid, session_token, session_expire, login_ip, login_time) VALUES (?, ?, ?, ?, ?)");
+            $stmt->bind_param("isssi", $uid, $session_token, $session_expires, $login_ip, $login_time);
+            $stmt->execute();
+
+            $row['session_token'] = $session_token;
+            $row['session_expires'] = $session_expires;
+
+            $response = [
+                'success' => 'true',
+                'session' => $session_token,
+                'session_expires' => $session_expires,
+            ];
+
+            header('Content-Type: application/json');
+            die(json_encode($response));
+        } else {
+            $response = [
+                'success' => 'false',
+                'response' => 'Incorrect username or password',
+            ];
+            
+            http_response_code(401);
+            header('Content-Type: application/json');
+            die(json_encode($response));
+        }
+    }
+} else {
+    $response = [
+        'success' => 'false',
+        'response' => 'Incorrect username or password',
+    ];
+    
+    http_response_code(401);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$stmt->close();
+$conn->close();
+
+?>