2 pièce(s) jointe(s)
Correction - Page de connexion
Salut, je voudrais savoir mon travail est correct, notamment en terme de sécurité :)
Mit à jour le 12/06/2019 à 10:10
L'index :
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
| <?php
//SESSION
session_start();
if (isset($_SESSION['name'])) {
header('Location: ok.php');
exit();
}
?>
<!DOCTYPEhtml>
<html>
<head>
<meta charset="utf-8" />
<link rel="stylesheet" href="index.css" />
<title>fict.io - Connexion</title>
</head>
<body>
<h1>CONNEXION</h1>
<form id="connect_form" method="post" action="wrks/connect.php">
<div>
<label for="login">Utilisateur</label>
<input type="text" name="login" autofocus required />
</div>
<div>
<label for="password">Mot de passe</label>
<input type="password" name="password" pattern="(?=^.{8,}$)((?=.*\d)|(?=.*\W+))(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$" required />
</div>
<input type="submit" value="Connexion" />
</form>
<h1>INSCRIPTION</h1>
<form id="subscribe_form" method="post" action="wrks/subscribe.php">
<div>
<label for="login">Utilisateur</label>
<input type="text" name="login" required />
</div>
<div>
<label for="password">Mot de passe</label>
<input type="password" name="password" pattern="(?=^.{8,}$)((?=.*\d)|(?=.*\W+))(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$" required />
</div>
<div>
<label for="confirm_password">Confirmer le mot de passe</label>
<input type="password" name="confirm_password" pattern="(?=^.{8,}$)((?=.*\d)|(?=.*\W+))(?![.\n])(?=.*[A-Z])(?=.*[a-z]).*$" required />
</div>
<div>
<label for="not_a_robot">17 + 25 (A écrire en toutes lettres)</label>
<input type="text" name="not_a_robot" required />
</div>
<input type="submit" value="Inscription" />
</form>
</body>
</html> |
La page d'inscription :
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
| <?php
//Démarrage de la session
session_start();
//Connexion à la BDD
$bdd = new PDO('mysql:host=localhost;
dbname=fict_io;
charset=utf8',
'user',
'',
array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ));
//Préparation de la commande
$prep = $bdd->prepare('INSERT INTO accounts(username,
password,
level) VALUES(?, ?, 0)' );
//Vérification de l'entrée spam
if (!isset($_POST['not_a_robot'])) {
//Redirection_ERROR
//header('Location: ../index.php');
} else {
//Vérification de la clé spam
if (md5($_POST['not_a_robot']) !== 'be2afdf0c7b6beabf937fc1672a920c7') {
//Redirection_ERROR
//header('Location: ../index.php');
} else {
//Récupération des informations
$login = $_POST['login'];
$password = $_POST['password'];
$confirm = $_POST['confirm_password'];
$hashed_pass = password_hash($password, PASSWORD_ARGON2ID);
//Préparation des paramètres
$prep->bindParam(1, $login);
$prep->bindParam(2, $hashed_pass);
//Vérification du mot de passe
if ($password !== $confirm) {
//Redirection_ERROR
//header('Location: ../index.php');
} else {
//Vérification de la disponibilité du pseudonyme
$user_fetch = $bdd->query('SELECT * FROM accounts');
while ($user = $user_fetch->fetch()) {
if ($login === $user['username']) {
//Redirection_ERROR
header('Location: ../index.php');
}
}
//Ecriture de l'entrée BDD
$prep->execute();
//Redirection_OK
//header ('Location: ../index.php');
}
}
} |
La page de connexion :
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
| <?php
//debug
$error_token = array();
//Connexion à la BDD
$bdd = new PDO('mysql:host=localhost;
dbname=fict_io;
charset=utf8',
'user',
'',
array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION ));
//Récupération des informations
$login = $_POST['login'];
$password = $_POST['password'];
//Récupération des noms des comptes
$users = $bdd->query('SELECT username FROM accounts');
$usernames = array ();
while ($user = $users->fetch()) {
array_push($usernames, $user['username']);
}
//Vérification de l'éxistance du comptes
if (!in_array($login, $usernames)) {
//Redirection_ERROR - WRONG_NAME
//header('Location: ../index.php');
} else {
//Vérification du mot de passe
$pass = $bdd->query("SELECT password FROM accounts WHERE username='{$login}'");
while ($pw = $pass->fetch()) {
if (!password_verify($password, $pw['password']))
{
//Redirection_ERROR - WRONG_PASS
header('Location: ../index.php');
} else {
//Récupération des informations de la session
session_start();
$_SESSION['name'] = $login;
//Redirection_OK
header('Location: ../index.php');
}
}
} |
La page sécurisée :
Code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
| <?php
session_start();
session_destroy();
?>
<html>
<head>
<meta charset="utf-8" />
</head>
<body>
<p>OK</p>
<a href="index.php">RETOUR</a>
</body>
</html> |
Voilà le pavé :D
Pour ceux qui voudraient les fichiers :
Pièce jointe 482709
Voilà, un grand merci d'avance :D
