a8936e55a2
- Implemented organization creation, editing, and activity management in orgs.php. - Added safe path segment function to sanitize input. - Included file upload handling for activity photos. - Created a new logo image for the application.
202 lines
8.0 KiB
PHP
Executable File
202 lines
8.0 KiB
PHP
Executable File
<?php
|
|
require_once "_incl/tools.session.php";
|
|
require_once "_incl/tools.security.php";
|
|
require_once "_incl/db.php";
|
|
if (!isset($AuthConfig)) {
|
|
$AuthConfig = db_get_all_config();
|
|
}
|
|
$DOMAIN = $_SERVER["HTTP_X_FORWARDED_HOST"] ?? $_SERVER["HTTP_HOST"];
|
|
|
|
// safe_redir() is provided by _incl/tools.security.php.
|
|
|
|
if (($_GET["reload_user"] ?? "") === "1") {
|
|
$row = db_get_user($_SESSION["auth_user"] ?? "");
|
|
if (!$row) {
|
|
header("Location: /");
|
|
die();
|
|
}
|
|
$_SESSION['auth_data'] = db_build_auth_data($row);
|
|
init_active_org($_SESSION['auth_data']);
|
|
$redir = safe_redir($_GET["redir"] ?? "/");
|
|
header("Location: $redir");
|
|
die();
|
|
}
|
|
if (($_GET["google_callback"] ?? "") === "1") {
|
|
if (!isset($AuthConfig["google_client_id"]) || !isset($AuthConfig["google_client_secret"])) {
|
|
die("Error: La autenticación de Google no está configurada.");
|
|
}
|
|
if (!isset($_GET["code"])) {
|
|
die("Error: No se recibió el código de autorización de Google.");
|
|
}
|
|
|
|
// Validate CSRF nonce from state parameter
|
|
$state_raw = $_GET["state"] ?? "";
|
|
$state = json_decode(base64_decode($state_raw), true);
|
|
$state_nonce = $state["nonce"] ?? "";
|
|
if (!$state_nonce || !isset($_SESSION["oauth_nonce"]) || !hash_equals($_SESSION["oauth_nonce"], $state_nonce)) {
|
|
die("Error: Estado OAuth inválido. Por favor, inténtalo de nuevo.");
|
|
}
|
|
unset($_SESSION["oauth_nonce"]);
|
|
|
|
$code = $_GET["code"];
|
|
|
|
// Intercambiar el código de autorización por un token de acceso
|
|
$token_response = file_get_contents("https://oauth2.googleapis.com/token", false, stream_context_create([
|
|
"http" => [
|
|
"method" => "POST",
|
|
"header" => "Content-Type: application/x-www-form-urlencoded",
|
|
"content" => http_build_query([
|
|
"code" => $code,
|
|
"client_id" => $AuthConfig["google_client_id"],
|
|
"client_secret" => $AuthConfig["google_client_secret"],
|
|
"redirect_uri" => "https://$DOMAIN/_login.php?google_callback=1",
|
|
"grant_type" => "authorization_code"
|
|
])
|
|
]
|
|
]));
|
|
|
|
$token_data = json_decode($token_response, true);
|
|
|
|
if (!isset($token_data["access_token"])) {
|
|
die("Error: No se pudo obtener el token de acceso de Google.");
|
|
}
|
|
|
|
$access_token = $token_data["access_token"];
|
|
|
|
// Obtener la información del usuario con el token de acceso
|
|
$user_info_response = file_get_contents("https://www.googleapis.com/oauth2/v1/userinfo?alt=json&access_token=$access_token");
|
|
$user_info = json_decode($user_info_response, true);
|
|
|
|
if (!isset($user_info["email"])) {
|
|
die("Error: No se pudo obtener la información del usuario de Google.");
|
|
}
|
|
|
|
$email = $user_info["email"];
|
|
$name = $user_info["name"] ?? explode("@", $email)[0];
|
|
$username = strtolower($email);
|
|
if ($username === "") {
|
|
die("Error: Dirección de correo inválida.");
|
|
}
|
|
$password = bin2hex(random_bytes(16));
|
|
$existing = db_get_user($username);
|
|
if ($existing) {
|
|
$user_row = $existing;
|
|
} else {
|
|
db_upsert_user([
|
|
'username' => $username,
|
|
'display_name' => $name,
|
|
'email' => $email,
|
|
'permissions' => ['public'],
|
|
'password_hash' => password_hash($password, PASSWORD_DEFAULT),
|
|
'google_auth' => true,
|
|
'#' => 'Este usuario fue creado automáticamente al iniciar sesión con Google por primera vez.',
|
|
]);
|
|
$user_row = db_get_user($username);
|
|
}
|
|
|
|
session_regenerate_id(true);
|
|
$_SESSION['auth_user'] = $username;
|
|
$_SESSION['auth_data'] = db_build_auth_data($user_row);
|
|
$_SESSION['auth_ok'] = true;
|
|
init_active_org($_SESSION['auth_data']);
|
|
$cookie_options = ["expires" => time() + (86400 * 30), "path" => "/", "httponly" => true, "secure" => true, "samesite" => "Lax"];
|
|
setcookie("auth_user", $username, $cookie_options);
|
|
setcookie("auth_pass_b64", base64_encode($password), $cookie_options);
|
|
|
|
$redir = safe_redir($state["redir"] ?? "/");
|
|
|
|
header("Location: $redir");
|
|
die();
|
|
}
|
|
if (($_GET["google"] ?? "") === "1") {
|
|
if (!isset($AuthConfig["google_client_id"]) || !isset($AuthConfig["google_client_secret"])) {
|
|
die("Error: La autenticación de Google no está configurada.");
|
|
}
|
|
$url = "https://accounts.google.com/o/oauth2/auth";
|
|
|
|
// Generate a CSRF nonce and store it in the session
|
|
$oauth_nonce = bin2hex(random_bytes(16));
|
|
$_SESSION["oauth_nonce"] = $oauth_nonce;
|
|
|
|
// build the HTTP GET query
|
|
$params = array(
|
|
"response_type" => "code",
|
|
"client_id" => $AuthConfig["google_client_id"],
|
|
"redirect_uri" => "https://$DOMAIN/_login.php?google_callback=1",
|
|
"scope" => "email openid profile",
|
|
"state" => base64_encode(json_encode([
|
|
"redir" => safe_redir($_GET["redir"] ?? "/"),
|
|
"nonce" => $oauth_nonce
|
|
]))
|
|
);
|
|
|
|
$request_to = $url . '?' . http_build_query($params);
|
|
|
|
// forward the user to the login access page on the OAuth 2 server
|
|
header("Location: " . $request_to);
|
|
die();
|
|
}
|
|
if (($_GET["logout"] ?? "") === "1") {
|
|
$redir = safe_redir($_GET["redir"] ?? "/");
|
|
$cookie_options_expired = ["expires" => time() - 3600, "path" => "/", "httponly" => true, "secure" => true, "samesite" => "Lax"];
|
|
setcookie("auth_user", "", $cookie_options_expired);
|
|
setcookie("auth_pass_b64", "", $cookie_options_expired);
|
|
session_destroy();
|
|
header("Location: $redir");
|
|
die();
|
|
}
|
|
if (($_GET["clear_session"] ?? "") === "1") {
|
|
session_destroy();
|
|
$redir = safe_redir($_GET["redir"] ?? "/");
|
|
header("Location: $redir");
|
|
die();
|
|
}
|
|
if (isset($_POST["user"])) {
|
|
$user = trim(strtolower($_POST["user"]));
|
|
$password = $_POST["password"];
|
|
$row = db_get_user($user);
|
|
if (!$row || !isset($row["password_hash"])) {
|
|
$_GET["_result"] = "El usuario no existe.";
|
|
} elseif (password_verify($password, $row["password_hash"])) {
|
|
session_regenerate_id(true);
|
|
$_SESSION['auth_user'] = $user;
|
|
$_SESSION['auth_data'] = db_build_auth_data($row);
|
|
$_SESSION['auth_ok'] = true;
|
|
init_active_org($_SESSION['auth_data']);
|
|
$cookie_options = ["expires" => time() + (86400 * 30), "path" => "/", "httponly" => true, "secure" => true, "samesite" => "Lax"];
|
|
setcookie("auth_user", $user, $cookie_options);
|
|
setcookie("auth_pass_b64", base64_encode($password), $cookie_options);
|
|
$redir = safe_redir($_GET["redir"] ?? "/");
|
|
header("Location: $redir");
|
|
die();
|
|
} else {
|
|
$_GET["_result"] = "La contraseña no es correcta.";
|
|
}
|
|
}
|
|
if (db_get_config('installed') !== '1') {
|
|
header("Location: /_install.php");
|
|
die();
|
|
}
|
|
require_once "_incl/pre-body.php";
|
|
?>
|
|
|
|
<form method="post" action="?redir=<?= urlencode($_GET["redir"] ?? "/") ?>">
|
|
<div class="card pad" style="max-width: 500px;">
|
|
<h1 style="text-align: center;">Iniciar sesión en Axia4</h1>
|
|
<div>
|
|
<div class="mb-3">
|
|
<label for="user" class="form-label"><b>Usuario o correo electrónico:</b></label>
|
|
<input required type="text" id="user" name="user" class="form-control" placeholder="Ej: pepeflores o pepeflo@gmail.arpa">
|
|
</div>
|
|
<div class="mb-3">
|
|
<label for="password" class="form-label"><b>Contraseña:</b></label>
|
|
<input required type="password" id="password" name="password" class="form-control" placeholder="Ej: PerroPiano482">
|
|
</div>
|
|
<button type="submit" class="btn btn-primary">Iniciar sesión</button>
|
|
<?php if ($AuthConfig["google_client_id"] ?? false && $AuthConfig["google_client_secret"] ?? false): ?>
|
|
<a href="/_login.php?google=1&redir=<?= urlencode($_GET["redir"] ?? "/") ?>" class="btn btn-outline-danger">Google</a>
|
|
<?php endif; ?>
|
|
</div>
|
|
</div>
|
|
</form>
|
|
<?php require_once "_incl/post-body.php"; ?>
|