Thanakorn
73c680e844
- OTP attempt limits, constant-time compare, random reference codes - DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding - one generic sign-in failure message; reset request no longer reveals accounts - no password kept in the session; real status codes on failures
32 lines
1.0 KiB
PHP
32 lines
1.0 KiB
PHP
<?php
|
|
/**
|
|
* reset_password_otp.php — login page "Forgot password?" step 2.
|
|
*
|
|
* Unauthenticated. Needs the reset state written by request_reset_otp.php in
|
|
* this session. For a username that matched no account that state is a decoy
|
|
* (reset_user_id 0) which always answers "Incorrect OTP", so this step does not
|
|
* reveal whether the account exists either.
|
|
*/
|
|
|
|
require_once '../../../session.php';
|
|
define('UNAUTHENTICATED_ROUTE', true);
|
|
require_once '../../../assets/utils/db_auth.php';
|
|
require_once '../../../assets/utils/rate_limit.php';
|
|
|
|
rate_limit_guard($pdo1, [
|
|
['reset_confirm_ip', rate_limit_client_ip(), 30, 900],
|
|
]);
|
|
|
|
if (!isset($_SESSION['reset_user_id'])) {
|
|
http_response_code(400);
|
|
$answer['message'] = 'No active reset request. Please request a new OTP.';
|
|
exit(json_encode($answer));
|
|
}
|
|
|
|
$user_id = (int)$_SESSION['reset_user_id'];
|
|
|
|
require_once '../../../assets/utils/classes/PasswordResetManager.php';
|
|
|
|
$manager = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
|
|
$manager->handleConfirmReset($user_id, $data);
|