58 lines
2.2 KiB
PHP
58 lines
2.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/includes/bootstrap.php';
|
|
|
|
$errors = [];
|
|
$prefillNumber = $_GET['n'] ?? '';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
verify_csrf();
|
|
if (!rate_limit_check('ticket_lookup', client_ip(), 10, 5)) {
|
|
$errors[] = 'Zu viele Versuche. Bitte warten Sie einige Minuten.';
|
|
}
|
|
$number = trim($_POST['ticket_number'] ?? '');
|
|
$email = trim($_POST['email'] ?? '');
|
|
|
|
// Bei überschrittenem Limit wird gar nicht erst geprüft (sonst ließe sich die Begrenzung beim Raten umgehen)
|
|
if (!$errors) {
|
|
$stmt = get_db()->prepare('SELECT * FROM tickets WHERE ticket_number = ?');
|
|
$stmt->execute([$number]);
|
|
$ticket = $stmt->fetch();
|
|
|
|
if ($ticket && hash_equals(strtolower($ticket['requester_email']), strtolower($email))) {
|
|
session_regenerate_id(true);
|
|
$_SESSION['guest_ticket_access'][$ticket['ticket_number']] = true;
|
|
redirect('/ticket_view.php?n=' . urlencode($ticket['ticket_number']));
|
|
}
|
|
$errors[] = 'Ticketnummer und E-Mail-Adresse passen nicht zusammen. Bitte prüfen Sie Ihre Eingabe.';
|
|
}
|
|
}
|
|
|
|
$pageTitle = 'Ticket ansehen';
|
|
$activePage = 'lookup';
|
|
require __DIR__ . '/includes/header_customer.php';
|
|
?>
|
|
|
|
<?php $__banner = get_setting('banner_path'); ?>
|
|
<div class="auth-wrap<?= $__banner ? ' has-image' : '' ?>"<?= $__banner ? ' style="background-image:url(' . e($__banner) . ')"' : '' ?>>
|
|
<div class="auth-card">
|
|
<?php require __DIR__ . '/includes/brand_block.php'; ?>
|
|
<h1>Ticket ansehen</h1>
|
|
<div class="sub">Ohne Konto: Geben Sie Ihre Ticketnummer und E-Mail-Adresse ein.</div>
|
|
<?php foreach ($errors as $err): ?>
|
|
<div class="flash error"><?= e($err) ?></div>
|
|
<?php endforeach; ?>
|
|
<form method="post">
|
|
<?= csrf_field() ?>
|
|
<label for="ticket_number">Ticketnummer</label>
|
|
<input type="text" id="ticket_number" name="ticket_number" value="<?= e($prefillNumber) ?>" placeholder="z.B. 260620-0001" required>
|
|
<label for="email">E-Mail-Adresse</label>
|
|
<input type="email" id="email" name="email" required>
|
|
<div class="btn-row">
|
|
<button type="submit" class="btn">Ticket ansehen</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
|
|
<?php require __DIR__ . '/includes/footer_customer.php'; ?>
|