111 lines
3.8 KiB
PHP
111 lines
3.8 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../public/includes/init_admin.php';
|
|
if (($_GET['page'] ?? '') !== 'reauth') return;
|
|
|
|
|
|
$roles = (array)($_SESSION['role'] ?? []);
|
|
if (!in_array('admin', $roles, true)) {
|
|
echo '<div class="container my-4"><div class="alert alert-danger">'
|
|
. htmlspecialchars($translations['non_autorise'] ?? 'Accès refusé.', ENT_QUOTES, 'UTF-8')
|
|
. '</div></div>';
|
|
return;
|
|
}
|
|
|
|
|
|
try { $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); } catch (Throwable) {}
|
|
|
|
$e = static fn($s) => htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8');
|
|
|
|
if (empty($_SESSION['csrf_token'])) {
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
}
|
|
$CSRF = $_SESSION['csrf_token'];
|
|
$msg = null;
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'reauth') {
|
|
if (!hash_equals($CSRF, $_POST['csrf'] ?? '')) {
|
|
$msg = $translations['reauth_csrf_invalid'] ?? 'Token CSRF invalide.';
|
|
} else {
|
|
$password = (string)($_POST['password'] ?? '');
|
|
$uid = (int)($_SESSION['compte_id'] ?? $_SESSION['user_id'] ?? 0);
|
|
|
|
// fallback email
|
|
if ($uid <= 0 && !empty($_SESSION['email'])) {
|
|
$st = $pdo->prepare("SELECT id FROM compte WHERE email = ? LIMIT 1");
|
|
$st->execute([(string)$_SESSION['email']]);
|
|
$uid = (int)$st->fetchColumn();
|
|
}
|
|
|
|
$ok = false;
|
|
if ($uid > 0) {
|
|
$st = $pdo->prepare("SELECT mot_de_passe FROM compte WHERE id = ? AND role = 'admin' LIMIT 1");
|
|
$st->execute([$uid]);
|
|
$hash = $st->fetchColumn();
|
|
|
|
if ($hash && password_verify($password, $hash)) {
|
|
$ok = true;
|
|
|
|
if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
|
|
$new = password_hash($password, PASSWORD_DEFAULT);
|
|
$up = $pdo->prepare("UPDATE compte SET mot_de_passe = ? WHERE id = ?");
|
|
$up->execute([$new, $uid]);
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($ok) {
|
|
$_SESSION['admin_reauth_at'] = time();
|
|
$redir = $_GET['redir'] ?? 'index.php?page=maintenance';
|
|
header('Location: '.$redir);
|
|
exit;
|
|
} else {
|
|
$msg = $translations['reauth_invalid_password'] ?? 'Неверный пароль.';
|
|
}
|
|
}
|
|
}
|
|
?>
|
|
|
|
<div class="shadow p-4 rounded bg-light">
|
|
<div class="container my-5" style="max-width:560px">
|
|
<h3><?= $e($translations['reauth_title'] ?? 'Подтвердите свою личность') ?></h3>
|
|
<p class="text-muted"><?= $e($translations['reauth_intro'] ?? 'Чтобы продолжить выполнение чувствительного действия, пожалуйста, введите ваш пароль.') ?></p>
|
|
|
|
<?php if ($msg): ?>
|
|
<div class="alert alert-danger"><?= $e($msg) ?></div>
|
|
<?php endif; ?>
|
|
|
|
<form method="post" class="card card-body">
|
|
<input type="hidden" name="csrf" value="<?= $e($CSRF) ?>">
|
|
|
|
<div class="mb-3">
|
|
<label class="form-label"><?= $e($translations['reauth_password_label'] ?? 'Пароль') ?></label>
|
|
<input type="password"
|
|
name="password"
|
|
class="form-control"
|
|
required
|
|
autocomplete="current-password">
|
|
</div>
|
|
|
|
<div class="d-flex gap-2">
|
|
<button class="btn btn-danger"
|
|
style="border-radius:999px"
|
|
name="action"
|
|
value="reauth">
|
|
<?= $e($translations['reauth_confirm'] ?? 'Подтвердить') ?>
|
|
</button>
|
|
|
|
<a class="btn btn-outline-secondary"
|
|
style="border-radius:999px"
|
|
href="index.php?page=maintenance">
|
|
<?= $e($translations['btn_annuler'] ?? 'Отмена') ?>
|
|
</a>
|
|
</div>
|
|
|
|
<p class="small text-muted mt-3">
|
|
<?= $e($translations['reauth_footer_notice'] ?? 'Внимание! Усиленная безопасность, ведётся аудит.') ?>
|
|
</p>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
|