This commit is contained in:
Thanakorn S
2026-02-19 14:48:40 +07:00
commit 9a50080ae5
221 changed files with 30788 additions and 0 deletions
+14
View File
@@ -0,0 +1,14 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
sleep(1);
session_destroy();
$answer["success"] = 1;
exit(json_encode($answer));
?>
+98
View File
@@ -0,0 +1,98 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$data["username"] = $_SESSION["login_data"]['username'];
$data["password"] = $_SESSION["login_data"]['password'];
$user_id = $_SESSION["login_user_id"];
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
/**
* Validate OTP
*/
function generateOTP($sercet_key, $time_step = 180, $length = 6){
$counter = floor($_SESSION["otpTime"] / $time_step);
$data = pack("NN", 0, $counter);
$hash = hash_hmac('sha1', $data, $sercet_key, true);
$offset = ord(substr($hash, -1)) & 0x0F;
$value = unpack("N", substr($hash, $offset, 4));
$otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);
return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
}
$otp = generateOTP($password);
// time diff between $_SESSION["otpTime"] and now() in minutes
$otp_time = isset($_SESSION['otpTime']) ? (int)$_SESSION['otpTime'] : 0;
$now = time();
$otp_diff_seconds = max(0, $now - $otp_time);
$otp_diff_minutes = $otp_diff_seconds / 60.0;
// print time
$_SESSION["now"] = $now;
$_SESSION["diff"] = $otp_diff_minutes;
/**
* Validate OTP
*/
if( $data["otp"]!=$otp || $otp_diff_minutes > 5 ){
$answer["message"] = "Wrong OTP! Please try again. (Our OTP is valid for 5 minute)";
exit(json_encode($answer));
}
// get password
$sth = $pdo1->prepare("select * from user where user_id = {$user_id} limit 1;");
$sth->execute();
$temp = $sth->fetch(PDO::FETCH_ASSOC);
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
// create user session
if( strtolower($data["username"]) == "support" ){
$s = $pdo1->query("select *, 'info@trcloud.co' as email from user where username='support' limit 1;");
$temp = $s->fetch(PDO::FETCH_ASSOC);
}
/**
* Create login session
*/
$_SESSION["login_status"] = 1;
$_SESSION["login_username"] = $temp["username"];
$_SESSION["login_name"] = $temp["name"];
$_SESSION["login_surname"] = $temp["surname"];
$_SESSION["login_company_id"] = $temp["default_company"];
$answer["success"] = 1;
$answer["message"] = "Login Complete!";
exit(json_encode($answer));
}
else
{
$answer["message"] = "Incorrect Password";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
exit(json_encode($answer));
}
$answer["success"] = 1;
exit(json_encode($answer));
?>
+209
View File
@@ -0,0 +1,209 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
// get user_id by username or password
$sth = $pdo1->prepare("select user_id from user where ? in (username,email) ");
$sth->execute(array(strtolower($data["username"])));
$user_id = $sth->fetchColumn();
$username = strtolower($data["username"]);
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select password from user where username = ? or email = ? limit 1;");
$sth->execute(array($username,$username));
$temp = $sth->fetch(PDO::FETCH_ASSOC);
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
// create user session
if( strtolower($data["username"]) == "support" ){
$s = $pdo1->query("select *, 'info@trcloud.co' as email from user where username='support' limit 1;");
$r = $s->fetch(PDO::FETCH_ASSOC);
}else{
$s = $pdo1->prepare("select * from user where (username=? or email=?) and user_id = ? limit 1;");
$s->execute(array($username,$username,$user_id));
$r = $s->fetch(PDO::FETCH_ASSOC);
}
// user email
$user_email = $r["email"];
if(strpos($user_email,"@")===false){
$answer["message"] = "<b>".$user_email."</b> is not eligible email, please contact your administrator to change your email.";
exit(json_encode($answer));
}
if( $r["status"] == "not activated" ){
$answer["message"] = "Cannot Login: This user is not activated!?!";
exit(json_encode($answer));
}
//~ access control
if( isset($pinform["secure_login"]) && $pinform["secure_login"] == "on" && $_SESSION["license"] != "lord"){
$sth = $pdo1->prepare("select * from whitelist where cookie = :cookie");
$sth->execute(array(":cookie"=>$data["cookie"]));
if($sth->rowCount()==0){
$s = $pdo1->prepare("INSERT INTO `whitelist` (`cookie`, `status`, `ip`) VALUES (:cookie, '1', :ip) on duplicate key update ip = values(ip);");
$s->execute(array(":cookie"=>$data["cookie"],":ip"=>$_SERVER["REMOTE_ADDR"]));
session_destroy();
$answer["message"] = "wait";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
echo json_encode($answer);
}else{
$coo = $sth->fetch(PDO::FETCH_ASSOC);
if( $coo["status"] == "0" ){
session_destroy();
$answer["message"] = "block";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
echo json_encode($answer);
$deviceDecision = [
'type' => 'BLOCKED',
'status' => 0
];
}else if( $coo["status"] == "1" ){
session_destroy();
$answer["message"] = "wait";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
echo json_encode($answer);
$deviceDecision = [
'type' => 'WAIT_APPROVAL',
'status' => 1
];
include __DIR__ . "/api/engine-notification/new_device_login_alert.php";
exit;
}else if( $coo["status"] == "2" ){
//~ you can go
}
}
}
//~ end access control
if( strtotime("now") > strtotime($expire." + 1 day") ){
session_destroy();
$answer["expire"] = "expire";
exit(json_encode($answer));
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
}
/**
* Generate OTP
*/
function generateOTP($sercet_key, $time_step = 180, $length = 6){
global $otpTime;
$otpTime = time();
$counter = floor($otpTime / $time_step);
$data = pack("NN", 0, $counter);
$hash = hash_hmac('sha1', $data, $sercet_key, true);
$offset = ord(substr($hash, -1)) & 0x0F;
$value = unpack("N", substr($hash, $offset, 4));
$otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);
return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
}
function numberToLetters($num) {
$result = '';
while ($num > 0) {
$mod = ($num - 1) % 26;
$result = chr(65 + $mod) . $result;
$num = intval(($num - $mod) / 26);
}
return str_pad($result, 6, 'A', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$reference_number = numberToLetters(generateOTP($otp));
/**
* Sent Email With OTP
*/
require "../../../assets/utils/module/mailer.php";
// send email
if(true){
$mailer = new mailer(["pdo1"=>$pdo1,"pdo2"=>$pdo2]);
$mailer->send_email([
"company_id" => 0,
"smtp" => $SMTP,
"subject" => "One Time Password (OTP) For reference number ".$reference_number,
"message" => "Your OTP is ".$otp." for reference number ".$reference_number,
"channel_name" => "WMS LOGIN OTP ",
"to" => $user_email,
"key" => $pinkey,
]);
}
$_SESSION = [];
$_SESSION["login_data"] = $data; // store variables
$_SESSION["otp"] = $otp;
$_SESSION["otpTime"] = $otpTime;
$_SESSION["reference"] = $reference_number;
$_SESSION["user_email"] = $user_email;
$_SESSION["login_user_id"] = $user_id;
$answer["success"] = 1;
$answer["message"] = "Login Complete!";
exit(json_encode($answer));
}
else
{
$answer["message"] = "Incorrect Password";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
exit(json_encode($answer));
}
$answer["success"] = 1;
exit(json_encode($answer));
?>
+124
View File
@@ -0,0 +1,124 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$data["username"] = $_SESSION["login_data"]['username'];
$data["password"] = $_SESSION["login_data"]['password'];
$user_id = (int)$_SESSION["login_user_id"];
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select * from user where user_id = {$user_id} limit 1;");
$sth->execute();
$temp = $sth->fetch(PDO::FETCH_ASSOC);
// user email
$user_email = $temp["email"];
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
/**
* Generate OTP
*/
function generateOTP($sercet_key, $time_step = 180, $length = 6){
global $otpTime;
$otpTime = time();
$counter = floor($otpTime / $time_step);
$data = pack("NN", 0, $counter);
$hash = hash_hmac('sha1', $data, $sercet_key, true);
$offset = ord(substr($hash, -1)) & 0x0F;
$value = unpack("N", substr($hash, $offset, 4));
$otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);
return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
}
function numberToLetters($num) {
$result = '';
while ($num > 0) {
$mod = ($num - 1) % 26;
$result = chr(65 + $mod) . $result;
$num = intval(($num - $mod) / 26);
}
return str_pad($result, 6, 'A', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$reference_number = numberToLetters(generateOTP($otp));
/**
* Sent Email With OTP
*/
require "../../../assets/utils/module/mailer.php";
// send email
if(true){
$mailer = new mailer(["pdo1"=>$pdo1,"pdo2"=>$pdo2]);
$mailer->send_email([
"company_id" => 0,
"smtp" => $SMTP,
"subject" => "One Time Password (OTP) For reference number ".$reference_number,
"message" => "Your OTP is ".$otp." for reference number ".$reference_number,
"channel_name" => "WMS LOGIN OTP ",
"to" => $user_email,
"key" => $pinkey,
]);
}
$_SESSION = [];
$_SESSION["login_data"] = $data; // store variables
$_SESSION["otp"] = $otp;
$_SESSION["otpTime"] = $otpTime;
$_SESSION["reference"] = $reference_number;
$_SESSION["user_email"] = $user_email;
$_SESSION["login_user_id"] = $user_id;
$answer["success"] = 1;
$answer["message"] = "Login Complete!";
exit(json_encode($answer));
}
else
{
$answer["message"] = "Incorrect Password";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
exit(json_encode($answer));
}
$answer["success"] = 1;
exit(json_encode($answer));
?>
+158
View File
@@ -0,0 +1,158 @@
<?php
session_start();
require '../config.php';
require '../include_header.php';
// successful login
if(!empty($_SESSION["login_status"])){
header('Location: '.$server_url.'dashboard/index.php');
exit;
}
?>
<body>
<div class="container d-flex align-items-center justify-content-center min-vh-100">
<div class="card " style="max-width:420px; width:100%;">
<div class="card-body p-5">
<div class="text-center mb-3">
<a href="index.html" class="mb-5 d-inline-block"><img
src="data:image/svg+xml,%3csvg%20width='62'%20height='67'%20viewBox='0%200%2062%2067'%20fill='none'%20xmlns='http://www.w3.org/2000/svg'%3e%3cpath%20d='M30.604%2066.378L0.00805664%2048.1582V35.7825L30.604%2054.0023V66.378Z'%20fill='%23302C4D'/%3e%3cpath%20d='M61.1996%2048.1582L30.604%2066.378V54.0023L61.1996%2035.7825V48.1582Z'%20fill='%23E66239'/%3e%3cpath%20d='M30.5955%200L0%2018.2198V30.5955L30.5955%2012.3757V0Z'%20fill='%23657E92'/%3e%3cpath%20d='M61.191%2018.2198L30.5955%200V12.3757L61.191%2030.5955V18.2198Z'%20fill='%23A3B2BE'/%3e%3cpath%20d='M30.604%2048.8457L0.00805664%2030.6259V18.2498L30.604%2036.47V48.8457Z'%20fill='%23302C4D'/%3e%3cpath%20d='M61.1996%2030.6259L30.604%2048.8457V36.47L61.1996%2018.2498V30.6259Z'%20fill='%23E66239'/%3e%3c/svg%3e"
alt="" width="36">
<span class=" ms-2"> <img src="<?php echo $server_url?>assets/images/logo.svg" alt=""></span>
</a>
<h1 class="card-title mb-5 h5">Sign in to your account</h1>
</div>
<form class="needs-validation mt-3" novalidate id="login-form">
<!-- first step login [OTP] -->
<?php if(!isset($_SESSION['login_data'])){?>
<div class="mb-3">
<label for="username" class="form-label">Username</label>
<input id="username" type="username" class="form-control" placeholder="username" required autofocus>
<div class="invalid-feedback">Please enter a valid email.</div>
</div>
<div class="mb-3">
<label for="password" class="form-label d-flex justify-content-between">
<span>Password</span>
</label>
<input id="password" type="password" class="form-control" placeholder="Password" required minlength="6">
<div class="invalid-feedback">Please provide a password (min 6 characters).</div>
</div>
<div class="d-flex justify-content-between align-items-center mb-3">
<div class="form-check">
<input id="remember" class="form-check-input" type="checkbox">
<label class="form-check-label small" for="remember">Remember me</label>
</div>
</div>
<button class="btn btn-primary w-100" onclick="login();">Sign in</button>
<?php }else{ ?>
<!-- second step login -->
<div class="mb-3">
<label for="otp" class="form-label d-flex justify-content-between">
<span>One Time Password</span>
</label>
<input id="otp" type="otp" class="form-control"
placeholder="your otp for reference number <?php echo $_SESSION["reference"]?>" required minlength="6">
<div class="invalid-feedback">Please provide a otp (min 6 characters).</div>
</div>
<div class="mb-3">
<label for="password" class="form-label d-flex justify-content-between">
<a href="javascript:;" class="small link-primary" onclick="back()">Back</a>
<a href="javascript:;" class="small link-primary" onclick="request_new_otp();">Request New OTP</a>
</label>
</div>
<button class="btn btn-primary w-100" onclick="login_confirm();">Sign in</button>
<?php } ?>
</form>
</div>
</div>
</div>
<script>
// login function
function login() {
return ajax_request({
url: "<?php echo $server_url?>login/api/engine/login_otp.php",
autoPrepare: true,
checkRequired: 0,
action: 'read',
onSuccess: function(res) {
window.location.href = "<?php echo $server_url?>index.php";
}
});
}
// reqquest new otp function
function request_new_otp() {
return ajax_request({
url: "<?php echo $server_url?>login/api/engine/request_new_otp.php",
autoPrepare: true,
checkRequired: 0,
action: 'read',
onSuccess: function(res) {
window.location.href = "<?php echo $server_url?>index.php";
}
});
}
// log_out function
function back() {
return ajax_request({
url: "<?php echo $server_url?>login/api/engine/back.php",
autoPrepare: true,
checkRequired: 0,
action: 'read',
onSuccess: function(res) {
window.location.href = "<?php echo $server_url?>index.php";
}
});
}
// log_in confirm
function login_confirm() {
return ajax_request({
url: "<?php echo $server_url?>login/api/engine/login_confirm.php",
autoPrepare: true,
checkRequired: 0,
action: 'read',
onSuccess: function(res) {
window.location.href = "index.php";
}
});
}
</script>
</body>
</html>