Overigen/monpas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix for download

Browse Source
This commit is contained in:
theo
2026-02-06 16:11:09 +01:00
parent 732d6634a5
commit 575ef4e861
7 changed files with 159 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/config/config.php
+1 -1
View File
@@ -384,7 +384,7 @@ $config['encryption_key'] = '';
$config['sess_driver'] = 'files';
$config['sess_cookie_name'] = 'ci_session';
$config['sess_expiration'] = 7200;
$config['sess_save_path'] = NULL;
$config['sess_save_path'] = APPPATH . 'cache/sessions';
$config['sess_match_ip'] = FALSE;
$config['sess_time_to_update'] = 300;
$config['sess_regenerate_destroy'] = FALSE;
application/controllers/Login.php
+57 -50
View File
@@ -4,7 +4,7 @@ use Mailgun\Mailgun;
use \Sonata\GoogleAuthenticator\GoogleAuthenticator;
class Login extends MY_Controller {
function __construct()
{
@@ -21,58 +21,58 @@ class Login extends MY_Controller {
$this->load->helper( 'string' );
}
function controlleergnaam() {
function login() {
$username = $this->db->escape_str( $this->input->post( 'gebruikersnaam' ), TRUE );
$userid = $this->Users_model->get_fieldvalue( [
$password = $this->input->post( 'wachtwoord' );
$result = NULL;
// Get user by username
$userid = $this->Users_model->get_fieldvalue( [
'lower(gnaam)' => strtolower( $username ),
'actief' => 1], 'id' );
'actief' => 1
], 'id' );
if ( ! $userid ) {
//hier toevoegen zet temp userid op null? Die in session staat
$this->Session_model->set_tmpuserid(null );
$zout = FALSE;
$challenge = FALSE;
}
else {
$this->Session_model->set_tmpuserid( $userid );
$zout = $this->Users_model->get_record_by_id( $userid, 'zout' );
$challenge = random_string( 'alnum', 10 );
$this->session->set_userdata( 'challenge', $challenge );
}
$data = ['userid' => $userid, 'salt' => $zout, 'challenge' => $challenge];
echo json_encode( $data );
}
function controleerwwoord(){
$result = NULL;
$userrole = NULL;
$tmpuserid = $this->session->userdata( 'tmpuserid' );
$password = $this->Users_model->get_record_by_id( $tmpuserid, 'wachtwoord' );
$salt = $this->Users_model->get_record_by_id( $tmpuserid, 'zout' );
$challenge = $this->session->userdata( 'challenge' );
$masterpass = md5( md5( $salt . 'Mstr@p0m-mnbs_983' ) . $challenge );
$saltedww = md5( md5( $salt . $password ) . $challenge );
$challengedww = md5( $password . $challenge );
$saltedchallenge= $this->db->escape_str( $this->input->post( 'saltedchallenge', TRUE ) );
if ( ( $challengedww !== $saltedchallenge ) &&
( $masterpass !== $saltedchallenge ) ) {
$result = NULL;
} else {
$orguser = $this->Orgusers_model->get_records_where( ['user_id' => $tmpuserid], TRUE );
$orguser = $this->Orgusers_model->gethighestautorisatie( $tmpuserid );
// Get stored password hash and salt
$stored_password = $this->Users_model->get_record_by_id( $userid, 'wachtwoord' );
$salt = $this->Users_model->get_record_by_id( $userid, 'zout' );
if ( $orguser ) $userrole = $orguser->nivo;
// Hash the provided password with salt
$hashed_password = md5( $salt . $password );
if ( $userrole == NULL || ! $orguser || $userrole == 0 ) $result = "geen rechten";
else {
$twofactor = $this->Users_model->get(['id'=>$tmpuserid],'twofactor',true);
$result = $twofactor;
if ($twofactor == "EMAIL") $this->mailCode();
// Check master password
$masterpass = 'Mstr@p0m-mnbs_983';
// Verify password
if ( $hashed_password === $stored_password || $masterpass === $password ) {
// Store user in session temporarily (needed for mailCode)
$this->Session_model->set_tmpuserid( $userid );
// Debug: verify session was set
log_message('debug', 'Set tmpuserid to: ' . $userid);
log_message('debug', 'Session tmpuserid is now: ' . $this->session->userdata('tmpuserid'));
// Check user authorization
$orguser = $this->Orgusers_model->gethighestautorisatie( $userid );
if ( ! $orguser || ! $orguser->nivo || $orguser->nivo == 0 ) {
$result = "geen rechten";
} else {
// Check two-factor authentication
$twofactor = $this->Users_model->get(['id' => $userid], 'twofactor', true);
$result = $twofactor;
if ( $twofactor == "EMAIL" ) {
log_message('debug', 'About to call mailCode, tmpuserid should be: ' . $userid);
$this->mailCode();
}
}
} else {
$result = NULL;
}
}
echo json_encode( $result );
}
@@ -110,16 +110,23 @@ class Login extends MY_Controller {
function mailCode(){
$error = false;
$tmpuserid = $this->session->userdata( 'tmpuserid' );
// Check if tmpuserid exists
if ( ! $tmpuserid ) {
log_message('error', 'mailCode called without tmpuserid in session');
return "Er is een fout opgetreden bij het versturen van de code.";
}
$user = $this->Users_model->get(['id'=>$tmpuserid], false, true);
$fullname = $this->Users_model->get_fullname($tmpuserid);
$code = $this->MaakEnSetRandomCode($tmpuserid);
$code = $this->MaakEnSetRandomCode($tmpuserid);
$subject = "Inlogcode MonPas";
$data = ['fullname'=>$fullname,
'code' => $code];
$html = $this->load->view('emails/twofactor_mail', $data, TRUE);
$error = $this->Mail_model->sendTheEmail($user->email, $subject, $html, "rfranke@framework-ed.nl");
if ($error=='Success') $error = false;
return $error;
}
@@ -135,7 +142,7 @@ class Login extends MY_Controller {
$code .= rand(1,9);
}
$asString = time();
$this->Users_model->update_record(['twofactorcode' =>$code, 'twofactortime'=>$asString ],$userID);
return $code;
}
@@ -152,10 +159,10 @@ class Login extends MY_Controller {
else {
$message = $this->checkTwoFactorEmail($user,$code);
}
if (! $message) $this->login_user( $tmpuserid );
if (! $message) $this->login_user( $tmpuserid );
$this->json($message);
}
}
function checkTwoFactorEmail($user,$code){
$message = false;
application/views/start.php
+1 -1
View File
@@ -1,4 +1,4 @@
<?php $version = 2; ?>
<?php $version = 3; ?>
<!DOCTYPE html>
<html >