nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete security audit fixes

Browse Source
This commit is contained in:
Thanakorn S
2026-03-09 14:31:39 +07:00
parent 93d903c4b2
commit 7cb78d013b
33 changed files with 317 additions and 313 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/login/api/engine/request_new_otp.php
+9 -18
View File
@@ -1,37 +1,28 @@
<?php
session_start();
require '../../../config.php';
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$data["username"] = $_SESSION["login_data"]['username'];
$data["password"] = $_SESSION["login_data"]['password'];
$user_id = (int)$_SESSION["login_user_id"];
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select * from user where user_id = {$user_id} limit 1;");
$sth->execute();
// get password
$sth = $pdo1->prepare("select * from user where user_id = :user_id limit 1;");
$sth->execute([
":user_id" => $user_id
]);
$temp = $sth->fetch(PDO::FETCH_ASSOC);
// user email
$user_email = $temp["email"];
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
if(password_verify(trim($data["password"]), $temp["password"])) {
/**
* Generate OTP
@@ -63,7 +54,7 @@
return str_pad($result, 6, 'A', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$otp = generateOTP($temp["password"]);
$reference_number = numberToLetters(generateOTP($otp));