71 lines
2.6 KiB
PHP
71 lines
2.6 KiB
PHP
<?php
|
|
/**
|
|
* admin/login.php —— 后台登录页
|
|
*/
|
|
$P = '../';
|
|
require_once dirname(__DIR__) . '/includes/auth.php';
|
|
require_once dirname(__DIR__) . '/includes/layout.php';
|
|
|
|
$err = '';
|
|
$loggedOut = isset($_GET['out']);
|
|
$curIp = client_ip();
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$username = trim((string) ($_POST['username'] ?? ''));
|
|
$password = (string) ($_POST['password'] ?? '');
|
|
if ($username === '' || $password === '') {
|
|
$err = '请输入用户名和密码。';
|
|
} elseif (hp_login($username, $password, (string) ($_POST['dev'] ?? ''))) {
|
|
// 正常登录成功：清零本 IP 风控计数（避免携带历史失败次数，防止管理员自误封）
|
|
risk_clear_for_ip($curIp);
|
|
// 初始密码未修改：强制进入改密页
|
|
if (hp_password_needs_change($username)) {
|
|
header('Location: force_password.php');
|
|
} else {
|
|
header('Location: nav.php');
|
|
}
|
|
exit;
|
|
} else {
|
|
// 轻量防爆破延时（命中黑名单的 IP 在访问本页前即被 access_boot 拦截）
|
|
usleep(500000);
|
|
$risk = risk_login_fail($curIp);
|
|
if ($risk[1]) {
|
|
$err = '用户名或密码错误。';
|
|
// $err = '登录失败次数过多（本次累计 ' . $risk[0] . ' 次，达到阈值 ' . $risk[2] . ' 次），当前 IP 已被风控自动封禁，全站（含后台登录）访问均被拒绝。请稍后从未被封禁的网络进入后台「风控管理 → IP 黑名单」移除该规则解除，或联系站长处理。';
|
|
} else {
|
|
$err = '用户名或密码错误。';
|
|
}
|
|
}
|
|
}
|
|
|
|
$site = setting_get('site_name', 'SecHome');
|
|
layout_head('后台登录');
|
|
?>
|
|
<main class="login-page">
|
|
<div class="login-card">
|
|
<div class="login-logo"><?php layout_logo_img('', $site); ?></div>
|
|
<h1>后台管理登录</h1>
|
|
<p class="lc-sub"><?= he($site) ?></p>
|
|
<?php if ($err !== ''): ?>
|
|
<div class="err-msg"><?= he($err) ?></div>
|
|
<?php endif; ?>
|
|
<?php if ($loggedOut): ?>
|
|
<div class="ok-msg">已安全退出登录。</div>
|
|
<?php endif; ?>
|
|
<form method="post" action="login.php" autocomplete="off">
|
|
<label class="fl" for="username">用户名</label>
|
|
<input type="text" id="username" name="username" required autofocus>
|
|
<label class="fl" for="password">密码</label>
|
|
<input type="password" id="password" name="password" required>
|
|
<input type="hidden" name="dev" id="devField" value="">
|
|
<div style="margin-top:16px">
|
|
<button type="submit" class="btn btn-primary" style="width:100%">登录</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</main>
|
|
<?php layout_theme_fab(); ?>
|
|
<script src="../assets/js/common.js"></script>
|
|
</body>
|
|
|
|
</html>
|