login: block concurrent login, single-factor auth for staff/viewer

2026-05-25 09:43:30 +07:00
parent 5ca6b49fd0
commit 45a78a3fed
9 changed files with 124 additions and 22 deletions
@@ -108,6 +108,17 @@
      action: 'read',
      onSuccess: function(res) {

+        if (res.skip_otp) {
+          // Staff/viewer — no OTP required, confirm session directly
+          return ajax_request({
+            url: "<?php echo $server_url?>login/api/engine/login_confirm.php",
+            data: { json: JSON.stringify({ otp: '', action: 'read' }) },
+            onSuccess: function() {
+              window.location.href = "<?php echo $server_url?>index.php";
+            }
+          });
+        }
+
        window.location.href = "<?php echo $server_url?>index.php";

      }