From 2980be21864cc183d9b4a3fad0417685265cbf0d Mon Sep 17 00:00:00 2001
From: Sam White <webmaster@ycra.org.uk>
Date: Sun, 24 Oct 2021 15:32:38 +0000
Subject: [PATCH] Add simple login system.

---
 public_html/includes/database.php |  6 ++++
 public_html/includes/fields.php   |  4 +++
 public_html/login.php             | 58 +++++++++++++++++++++++++++++++
 3 files changed, 68 insertions(+)
 create mode 100644 public_html/login.php

diff --git a/public_html/includes/database.php b/public_html/includes/database.php
index 4aa870f..e3a63d6 100644
--- a/public_html/includes/database.php
+++ b/public_html/includes/database.php
@@ -56,3 +56,9 @@ function insert_array($table, $fields) {
        . 'VALUES (' . implode(',', $values) . ')';
   return run_sql($sql);
 }
+
+function fetch_record($table, $select, $where) {
+  $sql = "SELECT $select FROM $table WHERE $where";
+  $result = run_sql($sql);
+  return mysqli_fetch_assoc($result);
+}
diff --git a/public_html/includes/fields.php b/public_html/includes/fields.php
index 2419528..fe85168 100644
--- a/public_html/includes/fields.php
+++ b/public_html/includes/fields.php
@@ -43,6 +43,10 @@ function email_field($values, $name, $label, $attrs=[]) {
   general_field('email', $values, $name, $label, $attrs);
 }
 
+function password_field($values, $name, $label, $attrs=[]) {
+  general_field('password', $values, $name, $label, $attrs);
+}
+
 function hidden_field($name, $value) {
   general_bare_field('hidden', [$name=>$value], $name);
 }
diff --git a/public_html/login.php b/public_html/login.php
new file mode 100644
index 0000000..022ddeb
--- /dev/null
+++ b/public_html/login.php
@@ -0,0 +1,58 @@
+<?php
+require_once('includes/utils.php');
+require_once('includes/html-templating.php');
+require_once('includes/fields.php');
+require_once('includes/form-validation.php');
+require_once('includes/database.php');
+
+function validate_login(&$errors, $data) {
+  require_fields($errors, $data, ['email_address', 'password']);
+  if (!empty($errors)) return false;
+
+  $record = fetch_record('users', 'id,password',
+                         simple_where('email_address', $data['email_address']));
+
+  // Still compare against a dummy hash when user not found to try and mitigate
+  // against simple timing attacks for existance of users.
+  $hash = password_hash('TestPassword', PASSWORD_DEFAULT);
+  if (!empty($record)) $hash = $record['password'];
+
+  $verified = password_verify($data['password'], $hash);
+
+  if (empty($record) || !$verified) $errors[] = 'Invalid email/password.';
+
+  return empty($errors) ? $record['id'] : false;
+}
+
+function page_title() {
+  return 'Login';
+}
+
+function additional_stylesheets() {
+  stylesheet('fields');
+}
+
+function content() {
+  $params = $errors = [];
+  if (array_key_exists('login', $_POST)) {
+    $uid = validate_login($errors, $_POST);
+    if ($uid) {
+      esc('Login successful!.');
+      die();
+    }
+    $params['email_address'] = $_POST['email_address'];
+  }?>
+
+  <h1>Login</h1>
+
+  <?php show_error_list($errors);?>
+
+  <form method="post" action=""><?php
+    email_field($params, 'email_address', 'Email address', ['required'=>'']);
+    password_field($params, 'password', 'Password', ['required'=>'']);?>
+    <input type="submit" name="login" value="Login" />
+  </form><?php
+}
+
+require_once('includes/template.php');
+?>
-- 
2.25.1