Thanakorn
73c680e844
- OTP attempt limits, constant-time compare, random reference codes - DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding - one generic sign-in failure message; reset request no longer reveals accounts - no password kept in the session; real status codes on failures
42 lines
1.4 KiB
PHP
42 lines
1.4 KiB
PHP
<?php
|
|
/**
|
|
* request_reset_otp.php — login page "Forgot password?" step 1.
|
|
*
|
|
* Unauthenticated. Answers the same way whether or not the username/email
|
|
* matches an account (see PasswordResetManager::handleRequestOtpPublic), and is
|
|
* throttled per client IP and per identifier because every hit can send email.
|
|
*/
|
|
|
|
require_once '../../../session.php';
|
|
define('UNAUTHENTICATED_ROUTE', true);
|
|
require_once '../../../assets/utils/db_auth.php';
|
|
require_once '../../../assets/utils/rate_limit.php';
|
|
|
|
// Resolve user by username or email
|
|
$identifier = strtolower(trim($data['identifier'] ?? ''));
|
|
|
|
if (!$identifier) {
|
|
http_response_code(422);
|
|
$answer['message'] = 'Please enter your username or email.';
|
|
exit(json_encode($answer));
|
|
}
|
|
|
|
rate_limit_guard($pdo1, [
|
|
['reset_req_ip', rate_limit_client_ip(), 10, 900],
|
|
['reset_req_id', $identifier, 3, 900],
|
|
]);
|
|
|
|
$sth = $pdo1->prepare(
|
|
"SELECT user_id, default_company FROM user WHERE username = :i OR email = :i LIMIT 1"
|
|
);
|
|
$sth->execute([':i' => $identifier]);
|
|
$user = $sth->fetch(PDO::FETCH_ASSOC);
|
|
|
|
$user_id = $user ? (int)$user['user_id'] : null;
|
|
$company_id = $user ? (int)($user['default_company'] ?? 0) : 0;
|
|
|
|
require_once '../../../assets/utils/classes/PasswordResetManager.php';
|
|
|
|
$manager = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
|
|
$manager->handleRequestOtpPublic($user_id, $company_id);
|