M_Viper/deskhub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Upload via GUI (360 Dateien)

Browse Source
This commit is contained in:
M_Viper
2026-10-30 21:50:25 +00:00
parent b322e13aef
commit 515db6b5e2
4 changed files with 50 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DeskHub-Webseite/api/staff/v1/login.php
+5 -1
View File
@@ -13,7 +13,8 @@ if (!filter_var($email, FILTER_VALIDATE_EMAIL) || $password === '') {
api_error(422, 'CREDENTIALS_REQUIRED', 'E-Mail-Adresse und Passwort sind erforderlich.');
}
if (!rate_limit_check('mobile_staff_login_ip', client_ip(), 10, 15)
|| !rate_limit_check('mobile_staff_login_email', strtolower($email), 5, 15)) {
|| !rate_limit_check('mobile_staff_login_email', strtolower($email), login_guard_max_attempts(), login_guard_lock_minutes())) {
login_guard_locked($email, 'app');
api_error(429, 'RATE_LIMITED', 'Zu viele Anmeldeversuche. Bitte versuchen Sie es später erneut.');
}
@@ -22,6 +23,7 @@ $stmt = $pdo->prepare('SELECT * FROM staff WHERE LOWER(email) = LOWER(?) AND is_
$stmt->execute([$email]);
$staff = $stmt->fetch();
if (!$staff || !password_verify($password, $staff['password_hash'])) {
login_guard_failed($staff ?: null, $email, 'app', $staff ? 'Falsches Passwort' : 'Unbekannte E-Mail-Adresse');
api_error(401, 'INVALID_CREDENTIALS', 'E-Mail-Adresse oder Passwort ist falsch.');
}
if (!empty($staff['totp_enabled'])) {
@@ -29,6 +31,7 @@ if (!empty($staff['totp_enabled'])) {
api_json(['requiresTotp' => true], 202);
}
if (!preg_match('/^\d{6}$/', $totpCode) || !totp_verify($staff['totp_secret'], $totpCode)) {
login_guard_failed($staff, $email, 'app', 'Falscher 2FA-Code');
api_error(401, 'INVALID_TOTP', 'Der Authenticator-Code ist ungültig.');
}
}
@@ -37,6 +40,7 @@ rate_limit_reset('mobile_staff_login_email', strtolower($email));
rate_limit_reset('mobile_staff_login_ip', client_ip());
$issued = api_issue_token($pdo, (int) $staff['id'], isset($body['deviceName']) ? (string) $body['deviceName'] : null);
audit_log((int) $staff['id'], 'Mobile App: Anmeldung');
login_guard_success($staff, 'app', isset($body['deviceName']) ? (string) $body['deviceName'] : null);
api_json([
'token' => $issued['token'],
'expiresAt' => $issued['expires_at'],