162 lines
5.0 KiB
PHP
162 lines
5.0 KiB
PHP
<?php
|
|
|
|
require_once __DIR__."/../../config.php";
|
|
require_once __DIR__."/../../dbconn.php";
|
|
|
|
|
|
/**
|
|
* Check PDO statement for errors
|
|
* Logs full error server-side, returns generic message to client
|
|
*
|
|
* @param PDOStatement $sth - The executed PDO statement
|
|
* @param array &$answer - Response array passed by reference
|
|
* @param array $options - Optional settings:
|
|
* 'message' => Custom client-facing error message
|
|
* 'log' => Custom server log label
|
|
* 'code' => HTTP response code (default: 500)
|
|
* 'before_exit' => Callback function before exit
|
|
*
|
|
* @example
|
|
* // Simple — use all defaults
|
|
* db_check($sth, $answer);
|
|
*
|
|
* @example
|
|
* // Custom client message
|
|
* db_check($sth, $answer, [
|
|
* 'message' => "Contact not found."
|
|
* ]);
|
|
*
|
|
* @example
|
|
* // Custom log label + message
|
|
* db_check($sth, $answer, [
|
|
* 'log' => "Failed to fetch contact",
|
|
* 'message' => "Could not load contact. Please try again."
|
|
* ]);
|
|
*
|
|
* @example
|
|
* // Custom HTTP status code
|
|
* db_check($sth, $answer, [
|
|
* 'code' => 403,
|
|
* 'message' => "Access denied."
|
|
* ]);
|
|
*
|
|
* @example
|
|
* // Cleanup callback before exit
|
|
* db_check($sth, $answer, [
|
|
* 'message' => "Upload failed.",
|
|
* 'before_exit' => function() use ($tmp_file) {
|
|
* if(file_exists($tmp_file)) unlink($tmp_file);
|
|
* }
|
|
* ]);
|
|
*/
|
|
function db_check($sth, &$answer, $options = []) {
|
|
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
|
|
|
|
$trace = debug_backtrace()[0];
|
|
|
|
$log_message = $options['log'] ?? "DB Error";
|
|
error_log($log_message . " in " . $trace['file'] . " line " . $trace['line'] . ": " . $sth->errorInfo()[2]);
|
|
|
|
$answer["message"] = $options['message'] ?? "A server error occurred. Please try again.";
|
|
|
|
http_response_code($options['code'] ?? 500);
|
|
|
|
if(isset($options['before_exit'])) {
|
|
call_user_func($options['before_exit']);
|
|
}
|
|
|
|
exit(json_encode($answer));
|
|
}
|
|
}
|
|
|
|
|
|
|
|
if(!empty($_SESSION["login_company_id"])){
|
|
|
|
// CSRF Validation — add right at the top of the logged-in block
|
|
if($_SERVER['REQUEST_METHOD'] === 'POST'){
|
|
$csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
|
|
if(empty($csrf_token) || $csrf_token !== $_SESSION['csrf_token']){
|
|
http_response_code(403);
|
|
exit(json_encode(["message" => "Invalid request"]));
|
|
}
|
|
}
|
|
|
|
// validate otp
|
|
$sql = "SELECT `password`
|
|
FROM user
|
|
WHERE user_id = :company_id";
|
|
$sth = $pdo1->prepare($sql);
|
|
$sth->execute([
|
|
":company_id" => $_SESSION["login_user_id"]
|
|
]);
|
|
db_check($sth, $answer);
|
|
$password = $sth->fetchColumn();
|
|
/** Generate OTP */
|
|
function generateOTP($sercet_key, $time_step = 180, $length = 6){
|
|
$counter = floor($_SESSION["otpTime"] / $time_step);
|
|
$data = pack("NN", 0, $counter);
|
|
$hash = hash_hmac('sha1', $data, $sercet_key, true);
|
|
$offset = ord(substr($hash, -1)) & 0x0F;
|
|
$value = unpack("N", substr($hash, $offset, 4));
|
|
$otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);
|
|
|
|
return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
|
|
}
|
|
$otp = generateOTP($password);
|
|
|
|
if( $_SESSION["otp"]!=$otp ){
|
|
$answer["message"] = "Your password has been reset, Please logout and login again.";
|
|
exit(json_encode($answer));
|
|
}
|
|
|
|
// check company accessibily
|
|
$sql = "SELECT * FROM company_map_user WHERE company_id = :login_company_id and user_id = :login_user_id";
|
|
$sth = $pdo1->prepare($sql);
|
|
$sth->execute([
|
|
":login_company_id" => $_SESSION["login_company_id"],
|
|
":login_user_id" => $_SESSION["login_user_id"]
|
|
]);
|
|
db_check($sth, $answer);
|
|
$map = $sth->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
if( count($map)==0 ){
|
|
$answer["message"] = "Your accessibility to this company has been removed.";
|
|
exit(json_encode($answer));
|
|
}
|
|
|
|
}
|
|
|
|
// set up ANSWER
|
|
$answer = array("success"=>0, "message"=>"");
|
|
|
|
if (isset($_POST['json'])) {
|
|
// Old Method: Data is wrapped in a JSON string
|
|
$data = json_decode($_POST['json'], true);
|
|
} else if (isset($_POST['otp'])) {
|
|
// New Method: Data is sent directly (FormData)
|
|
// We check for 'otp' because every request should have one
|
|
$data = $_POST;
|
|
} else {
|
|
// Truly no data received
|
|
$answer["message"] = "Request denied: No valid JSON payload or Form Data detected.";
|
|
exit(json_encode($answer));
|
|
}
|
|
|
|
// incase logging in
|
|
if(!empty($_SESSION["login_company_id"])){
|
|
|
|
$company_id = (int)$_SESSION["login_company_id"];
|
|
$user_id = (int)$_SESSION["login_user_id"];
|
|
|
|
// create json for table logging
|
|
$logging = array(
|
|
"user_id" => $user_id,
|
|
"data" => json_encode($data),
|
|
"dt" => date('Y-m-d H:i:s'),
|
|
"login" => date('Y-m-d H:i:s', $_SESSION["otpTime"])
|
|
);
|
|
|
|
}
|
|
?>
|