time()) { $remaining = $blockedUntil - time(); $erreur = sprintf( $translations['trop_de_tentatives_connexion'] ?? 'Trop de tentatives. Réessayez dans %d secondes.', $remaining ); } else { if ($email === '' || $mot_de_passe === '') { $erreur = $translations['erreur_champs_vides']; } else { $stmt = $pdo->prepare("SELECT * FROM compte WHERE email = :email LIMIT 1"); $stmt->execute(['email' => $email]); $compte = $stmt->fetch(); if ($compte && password_verify($mot_de_passe, $compte['mot_de_passe'])) { // ✅ reset brute force $_SESSION['login_tries'] = 0; unset($_SESSION['login_blocked_until']); if (empty($compte['email_valide'])) { $_SESSION['pending_validation_resend'] = [ 'compte_id' => (int) $compte['id'], 'email' => (string) $compte['email'], 'authorized' => true, 'expires_at' => time() + 900, ]; $erreur = $translations['tvalidat_erreur_email_non_valide'] ?? $translations['erreur_email_non_valide'] ?? 'Veuillez valider votre adresse email.'; } else { session_regenerate_id(true); $_SESSION['compte_id'] = $compte['id']; $_SESSION['role'] = strtolower(trim($compte['role'] ?? '')); $_SESSION['reference_id'] = $compte['reference_id']; $_SESSION['email'] = $compte['email']; $_SESSION['last_activity'] = time(); // 🔁 redirection next $next = $_POST['next'] ?? $_GET['next'] ?? ($_SESSION['redirect_to'] ?? null); $next = next_safe($next); if ($next) { unset($_SESSION['redirect_to']); header('Location: ' . $next); exit; } // 🎯 fallback rôle if ($_SESSION['role'] === 'client') { header('Location: /public/client/mes_rendez_vous.php');exit; } elseif ($_SESSION['role'] === 'admin') { header('Location: /admin/index.php');exit; } elseif ($_SESSION['role'] === 'secretaire') { header('Location: /public/cabinet/dashboard.php');exit; } else { header('Location: /public/praticien/agenda.php');exit; } } } else { // ❌ Mauvais login $_SESSION['login_tries']++; // ⏱️ Blocage après 5 tentatives if ($_SESSION['login_tries'] >= 3) { $_SESSION['login_blocked_until'] = time() + 600; // 10 min } // 🐢 ralentissement progressif sleep(min($_SESSION['login_tries'], 3)); $erreur = $translations['erreur_identifiants']; } } } } ?> <?php echo htmlspecialchars($translations['seo_connexion_title'], ENT_QUOTES, 'UTF-8') ?>
uslugi.fr uslugi.fr

= time() && ! empty($email) && ! empty($_SESSION['pending_validation_resend']['email']) && hash_equals( (string) $_SESSION['pending_validation_resend']['email'], (string) $email ); ?>
👁️
|