Harwinder Sekhon
17a401c313
- Session cookies are HttpOnly + SameSite=Lax (Secure on HTTPS), with strict session-ID mode; the CSRF token from GET api/auth.php must now accompany every state-changing request (X-CSRF-Token header, or a csrf body field for the sendBeacon progress save), rotated at login. - Failed sign-ins are throttled per username and IP via login_attempts (created lazily, so existing installs need no migration): 5 failures a username / 20 an IP inside 15 minutes answer 429 with Retry-After. - A video's sibling .srt now appears as a CC button in the player; captions.php converts it to WebVTT (comma timestamps, legacy encodings, and the already-VTT files with out-of-spec 6-digit fractions). - Plyr and Inter ship in assets/vendor/ instead of coming from CDNs, and anime.js is gone along with all scripted animations and the motion setting — the app now runs with no internet access at all. - .htaccess denies direct access to videos/, includes/, config.php and schema.sql, so video URLs cannot bypass login on Apache. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SePf61iazhCLJBefdRLBDm
78 lines
2.4 KiB
PHP
78 lines
2.4 KiB
PHP
<?php
|
|
// GET api/auth.php -> {logged_in, username}
|
|
// POST api/auth.php {action, username?, password?}
|
|
// action: login | register | logout
|
|
require_once __DIR__ . '/../includes/auth.php';
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
|
|
echo json_encode([
|
|
'logged_in' => currentUserId() !== null,
|
|
'username' => currentUsername(),
|
|
'allow_registration' => ALLOW_REGISTRATION,
|
|
'csrf' => csrfToken(),
|
|
]);
|
|
exit;
|
|
}
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
http_response_code(405);
|
|
echo json_encode(['error' => 'Method not allowed']);
|
|
exit;
|
|
}
|
|
|
|
$data = json_decode(file_get_contents('php://input'), true) ?: [];
|
|
verifyCsrfApi($data);
|
|
$action = $data['action'] ?? '';
|
|
$username = trim($data['username'] ?? '');
|
|
$password = $data['password'] ?? '';
|
|
$ip = $_SERVER['REMOTE_ADDR'] ?? '';
|
|
|
|
switch ($action) {
|
|
case 'login':
|
|
$wait = loginRetryAfter($username, $ip);
|
|
if ($wait > 0) {
|
|
http_response_code(429);
|
|
header('Retry-After: ' . $wait);
|
|
echo json_encode(['error' => 'Too many failed sign-in attempts. '
|
|
. 'Try again in ' . max(1, (int)ceil($wait / 60)) . ' min.']);
|
|
break;
|
|
}
|
|
if (attemptLogin($username, $password)) {
|
|
clearLoginFailures($username);
|
|
echo json_encode(['ok' => true, 'username' => currentUsername(), 'csrf' => csrfToken()]);
|
|
} else {
|
|
recordLoginFailure($username, $ip);
|
|
http_response_code(401);
|
|
echo json_encode(['error' => 'Invalid username or password.']);
|
|
}
|
|
break;
|
|
|
|
case 'register':
|
|
if (!ALLOW_REGISTRATION) {
|
|
http_response_code(403);
|
|
echo json_encode(['error' => 'Registration is disabled.']);
|
|
break;
|
|
}
|
|
$result = registerUser($username, $password);
|
|
if ($result === true) {
|
|
attemptLogin($username, $password);
|
|
echo json_encode(['ok' => true, 'username' => currentUsername(), 'csrf' => csrfToken()]);
|
|
} else {
|
|
http_response_code(422);
|
|
echo json_encode(['error' => $result]);
|
|
}
|
|
break;
|
|
|
|
case 'logout':
|
|
$_SESSION = [];
|
|
session_destroy();
|
|
echo json_encode(['ok' => true]);
|
|
break;
|
|
|
|
default:
|
|
http_response_code(400);
|
|
echo json_encode(['error' => 'Unknown action']);
|
|
}
|