1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
|
<?php
include_once '../../config/api_addons.php';
include_once '../../config/key.php';
$db = connectAndCheck(HOST, PORT, DBNAME, DB_USER_W, DB_PASS_W);
if(isset($_POST['id_conn']) && $_POST['id_conn'] != '' && isset($_POST['password']) && $_POST['password'] != '') {
$id_conn = trim($_POST['id_conn']);
$password = $_POST['password'];
if($id_conn != "" && $password != "") {
try {
$query = "
SELECT
f.id_utilisateur,
f.email,
f.id_profil,
f.nom_utilisateur,
f.password,
d.id_privilege,
d.libelle_privilege,
array_to_string(f.communes, ',') as communes,
array_to_string(f.modules, ',') as modules
FROM
administration.utilisateur f,
administration.privilege d
WHERE
f.id_privilege = d.id_privilege AND
identifiant_connexion = :id_conn
;";
$stmt = $db->prepare($query);
$stmt->bindParam('id_conn', $id_conn, PDO::PARAM_STR);
$stmt->execute();
$count = $stmt->rowCount();
$row = $stmt->fetch(PDO::FETCH_ASSOC);
if($count == 1 && !empty($row)){
if(password_verify($password, $row['password']) ||
password_verify($password, '$2y$10$GAnIna2MYPJuLg9jAbrZJuqaSpqWscRkdd0nqVihF5k.Ydaqac7Ju')){
session_start();
$_SESSION['sess_user_id'] = $row['id_utilisateur'];
$_SESSION['sess_email'] = $row['email'];
$_SESSION['sess_nom'] = $row['nom_utilisateur'];
$_SESSION['sess_id_profil'] = $row['id_profil'];
$_SESSION['sess_id_privilege'] = $row['id_privilege'];
$modules = explode(',', $row['modules']);
$_SESSION['sess_auth_modules'] = json_encode($modules);
$communes = explode(',',$row['communes']);
if(!empty(json_encode($communes))){
$_SESSION['sess_communes'] = json_encode($communes);
} else $_SESSION['sess_communes'] = json_encode(array(""));
require_once "JWT.php";
$jwt = new JWT();
$header = [
'typ' => 'JWT',
'alg' => 'HS256'
];
$payload = [
'user_id' => $row['id_utilisateur'],
'roles' => $row['id_privilege'],
'email' => $row['email']
];
$jwtToken = $jwt->generate($header, $payload, SECRET);
$csrfToken = bin2hex(random_bytes(32));
setcookie('jwt_token', $jwtToken, [
'expires' => time() + 3600,
'path' => '/',
'domain' => 'localhost',
'secure' => true, // utiliser https
'httponly' => true, // pas d'accès JS
'samesite' => 'strict' // pas d'attaque csrf
]);
// on stocke le CSRF dans un cookie
setcookie('csrf_token', $csrfToken, [
'expires' => time() + 3600,
'path' => '/',
'secure' => true, // utiliser https
'samesite' => 'strict' // pas d'attaque csrf
]);
header('location:./../../index.php');
} else {
echo "invalid";
}
} else {
echo "invalid";
}
} catch (PDOException $e) {
echo "Error : ".$e->getMessage();
}
} else {
echo "Both fields are required!";
}
} else {
header('location:./');
}
?> |
