287 lines
9.1 KiB
PHP
287 lines
9.1 KiB
PHP
<?php
|
|
/**
|
|
* Web & PC Studio - Beveiligd Inlogscherm
|
|
* Server-side authenticatie voor server.webenpcstudio.nl met brute-force protectie.
|
|
*/
|
|
|
|
require_once __DIR__ . '/auth.php';
|
|
|
|
// Als gebruiker al ingelogd is, direct doorsturen
|
|
if (is_logged_in()) {
|
|
header('Location: index.php');
|
|
exit;
|
|
}
|
|
|
|
$error = '';
|
|
$lockoutTime = 300; // 5 minuten blokkade bij te veel pogingen
|
|
|
|
// Initialiseer rate limiting
|
|
if (!isset($_SESSION['login_attempts'])) {
|
|
$_SESSION['login_attempts'] = 0;
|
|
$_SESSION['last_attempt_time'] = time();
|
|
}
|
|
|
|
// Controleer of de gebruiker tijdelijk geblokkeerd is
|
|
if ($_SESSION['login_attempts'] >= 5) {
|
|
$timePassed = time() - $_SESSION['last_attempt_time'];
|
|
if ($timePassed < $lockoutTime) {
|
|
$remaining = ceil(($lockoutTime - $timePassed) / 60);
|
|
$error = "Te veel mislukte inlogpogingen. Probeer het over {$remaining} minuten opnieuw.";
|
|
} else {
|
|
// Reset na verloop van blokkade
|
|
$_SESSION['login_attempts'] = 0;
|
|
}
|
|
}
|
|
|
|
// Verwerk inlogverzoek
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST' && empty($error)) {
|
|
$csrfToken = $_POST['csrf_token'] ?? '';
|
|
$username = trim($_POST['username'] ?? '');
|
|
$password = $_POST['password'] ?? '';
|
|
|
|
// Kleine vertraging tegen timing-aanvallen
|
|
usleep(200000);
|
|
|
|
if (!verify_csrf_token($csrfToken)) {
|
|
$error = 'Beveiligingstoken (CSRF) ongeldig of verlopen. Ververs de pagina.';
|
|
} else {
|
|
// Vergelijk gebruikersnaam hash (timing-safe) en wachtwoord via bcrypt
|
|
$userMatches = hash_equals(AUTH_USER_HASH, hash('sha256', strtolower($username)));
|
|
$passMatches = password_verify($password, AUTH_PASS_HASH);
|
|
|
|
if ($userMatches && $passMatches) {
|
|
// Sessie fixatie voorkomen via regeneratie
|
|
session_regenerate_id(true);
|
|
|
|
$_SESSION['wpc_auth'] = true;
|
|
$_SESSION['wpc_user_email'] = htmlspecialchars($username);
|
|
$_SESSION['wpc_last_activity'] = time();
|
|
$_SESSION['login_attempts'] = 0;
|
|
|
|
// Veilige doorverwijzing
|
|
$redirect = $_GET['redirect'] ?? 'index.php';
|
|
// Alleen relatieve redirects toestaan
|
|
if (empty($redirect) || strpos($redirect, '://') !== false || strpos($redirect, '//') === 0) {
|
|
$redirect = 'index.php';
|
|
}
|
|
|
|
header("Location: {$redirect}");
|
|
exit;
|
|
} else {
|
|
$_SESSION['login_attempts']++;
|
|
$_SESSION['last_attempt_time'] = time();
|
|
$attemptsLeft = max(0, 5 - $_SESSION['login_attempts']);
|
|
$error = "Ongeldige gebruikersnaam of wachtwoord. (Nog {$attemptsLeft} pogingen)";
|
|
}
|
|
}
|
|
}
|
|
|
|
$csrfToken = get_csrf_token();
|
|
$logoutMessage = isset($_GET['logout']) ? 'U bent succesvol en veilig uitgelogd.' : '';
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="nl">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Web & PC Studio - Beveiligde Toegang</title>
|
|
<link rel="stylesheet" href="style.css">
|
|
<script src="theme.js"></script>
|
|
<style>
|
|
body {
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
min-height: 100vh;
|
|
padding: 20px;
|
|
}
|
|
|
|
.login-card {
|
|
width: 100%;
|
|
max-width: 440px;
|
|
background: var(--bg-surface);
|
|
backdrop-filter: blur(20px);
|
|
-webkit-backdrop-filter: blur(20px);
|
|
border: 1px solid var(--border-subtle);
|
|
border-radius: var(--radius-xl);
|
|
padding: 38px 32px;
|
|
box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.6);
|
|
text-align: left;
|
|
}
|
|
|
|
.login-header {
|
|
text-align: center;
|
|
margin-bottom: 28px;
|
|
}
|
|
|
|
.login-logo {
|
|
background: linear-gradient(135deg, var(--primary), var(--accent));
|
|
width: 52px;
|
|
height: 52px;
|
|
border-radius: 14px;
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: center;
|
|
font-weight: 800;
|
|
font-size: 1.5rem;
|
|
color: white;
|
|
box-shadow: 0 6px 20px var(--primary-glow);
|
|
margin: 0 auto 16px;
|
|
}
|
|
|
|
.login-title {
|
|
font-size: 1.45rem;
|
|
font-weight: 800;
|
|
color: var(--text-main);
|
|
margin-bottom: 6px;
|
|
}
|
|
|
|
.login-subtitle {
|
|
font-size: 0.85rem;
|
|
color: var(--text-muted);
|
|
}
|
|
|
|
.form-group {
|
|
margin-bottom: 18px;
|
|
}
|
|
|
|
.form-label {
|
|
display: block;
|
|
font-size: 0.82rem;
|
|
font-weight: 600;
|
|
color: var(--text-muted);
|
|
margin-bottom: 6px;
|
|
}
|
|
|
|
.input-wrap {
|
|
position: relative;
|
|
display: flex;
|
|
align-items: center;
|
|
}
|
|
|
|
.form-control {
|
|
width: 100%;
|
|
background: rgba(0, 0, 0, 0.35);
|
|
border: 1px solid var(--border-subtle);
|
|
border-radius: var(--radius-md);
|
|
padding: 12px 14px;
|
|
color: var(--text-main);
|
|
font-size: 0.92rem;
|
|
outline: none;
|
|
transition: all 0.2s ease;
|
|
}
|
|
|
|
[data-theme="light"] .form-control {
|
|
background: rgba(241, 245, 249, 0.8);
|
|
}
|
|
|
|
.form-control:focus {
|
|
border-color: var(--primary);
|
|
box-shadow: 0 0 0 3px var(--primary-glow);
|
|
}
|
|
|
|
.toggle-pwd {
|
|
position: absolute;
|
|
right: 12px;
|
|
background: transparent;
|
|
border: none;
|
|
color: var(--text-subtle);
|
|
cursor: pointer;
|
|
font-size: 1rem;
|
|
padding: 4px;
|
|
}
|
|
|
|
.alert-error {
|
|
background: rgba(239, 68, 68, 0.12);
|
|
border: 1px solid rgba(239, 68, 68, 0.3);
|
|
color: #f87171;
|
|
padding: 12px 14px;
|
|
border-radius: var(--radius-md);
|
|
font-size: 0.84rem;
|
|
margin-bottom: 20px;
|
|
}
|
|
|
|
.alert-success {
|
|
background: rgba(16, 185, 129, 0.12);
|
|
border: 1px solid rgba(16, 185, 129, 0.3);
|
|
color: #34d399;
|
|
padding: 12px 14px;
|
|
border-radius: var(--radius-md);
|
|
font-size: 0.84rem;
|
|
margin-bottom: 20px;
|
|
}
|
|
|
|
.login-footer {
|
|
margin-top: 24px;
|
|
padding-top: 18px;
|
|
border-top: 1px solid var(--border-subtle);
|
|
display: flex;
|
|
justify-content: space-between;
|
|
align-items: center;
|
|
font-size: 0.78rem;
|
|
color: var(--text-subtle);
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="login-card">
|
|
<!-- Logo & Header -->
|
|
<div class="login-header">
|
|
<div class="login-logo">🔒</div>
|
|
<h1 class="login-title">Beveiligde Toegang</h1>
|
|
<p class="login-subtitle">server.webenpcstudio.nl • Testdrive Hub</p>
|
|
</div>
|
|
|
|
<?php if (!empty($logoutMessage)): ?>
|
|
<div class="alert-success"><?= htmlspecialchars($logoutMessage); ?></div>
|
|
<?php endif; ?>
|
|
|
|
<?php if (!empty($error)): ?>
|
|
<div class="alert-error"><?= htmlspecialchars($error); ?></div>
|
|
<?php endif; ?>
|
|
|
|
<!-- Formulier -->
|
|
<form method="POST" action="">
|
|
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken); ?>">
|
|
|
|
<div class="form-group">
|
|
<label class="form-label" for="username">Gebruikersnaam (E-mail):</label>
|
|
<div class="input-wrap">
|
|
<input type="email" id="username" name="username" class="form-control"
|
|
placeholder="naam@domein.nl" required autofocus autocomplete="username">
|
|
</div>
|
|
</div>
|
|
|
|
<div class="form-group" style="margin-bottom: 24px;">
|
|
<label class="form-label" for="password">Wachtwoord:</label>
|
|
<div class="input-wrap">
|
|
<input type="password" id="password" name="password" class="form-control"
|
|
placeholder="••••••••••••" required autocomplete="current-password">
|
|
<button type="button" class="toggle-pwd" onclick="togglePasswordVisibility()" title="Toon/verberg wachtwoord">👁️</button>
|
|
</div>
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-primary" style="width: 100%; padding: 12px; font-size: 0.95rem;">
|
|
Inloggen op Server
|
|
</button>
|
|
</form>
|
|
|
|
<div class="login-footer">
|
|
<span>TLS / SSL Beveiligd</span>
|
|
<button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()" style="padding: 4px 8px;">🌙 Thema</button>
|
|
</div>
|
|
</div>
|
|
|
|
<script>
|
|
function togglePasswordVisibility() {
|
|
const pwdInput = document.getElementById('password');
|
|
if (pwdInput.type === 'password') {
|
|
pwdInput.type = 'text';
|
|
} else {
|
|
pwdInput.type = 'password';
|
|
}
|
|
}
|
|
</script>
|
|
</body>
|
|
</html>
|