bjorneandClaude Fable 5.1
25b481e2ae
Stripped from the internal repo: per-box deploy trees, Go services (nodelist/astmeta/proxy/svxdr), deploy/sync scripts and all secrets. Config templates for nginx, PHP-FPM, Redis and tmpfiles live in install/ with CHANGEME placeholders. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
54 lines
2.0 KiB
PHP
54 lines
2.0 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
require __DIR__ . '/lib.php';
|
|
|
|
start_session();
|
|
$uuid = $_SESSION['uid'] ?? null;
|
|
if (is_string($uuid) && $uuid !== '') {
|
|
// Logged in (profile page)
|
|
csrf_check();
|
|
rate_limit("resendverify:$uuid", 3, 600);
|
|
} else {
|
|
// From the sign-in form: unverified users cannot log in, so they prove
|
|
// ownership with the same credentials they just typed.
|
|
$in = json_in();
|
|
$user = trim((string)($in['user'] ?? ''));
|
|
$pass = (string)($in['pass'] ?? '');
|
|
if ($user === '' || $pass === '') json_out(['ok'=>false,'error'=>'not_logged_in'], 401);
|
|
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
|
|
rate_limit("resendverify:ip:{$ip}", 3, 600);
|
|
$uuid = find_acct_by_login($user);
|
|
$acct = $uuid ? acct_get($uuid) : [];
|
|
$hash = (string)($acct['password_hash'] ?? '');
|
|
if ($hash === '' || !password_verify($pass, $hash)) json_out(['ok'=>false,'error'=>'invalid_login'], 401);
|
|
rate_limit("resendverify:$uuid", 3, 600);
|
|
}
|
|
|
|
$me = acct_get($uuid);
|
|
if (!$me) json_out(['ok' => false, 'error' => 'not_found'], 404);
|
|
if (($me['email_verified'] ?? '0') === '1') json_out(['ok' => true, 'already' => true]);
|
|
|
|
$email = (string)($me['email'] ?? '');
|
|
if ($email === '') json_out(['ok' => false, 'error' => 'no_email'], 400);
|
|
|
|
$r = redis();
|
|
$tid = token_id();
|
|
$secret = token_secret();
|
|
$hash = token_hash($secret);
|
|
$k = rkey("token:verify:$tid");
|
|
$r->hMSet($k, ['uid' => $uuid, 'hash' => $hash]);
|
|
$r->expire($k, 60 * 60 * 24);
|
|
|
|
$base = rtrim(cfg()['base_url'], '/');
|
|
$link = $base . '/auth/verify.php?tid=' . urlencode($tid) . '&token=' . urlencode($secret);
|
|
$first = (string)($me['firstname'] ?? '');
|
|
$call = (string)($me['callsign'] ?? '');
|
|
$body = "Hello {$first},\n\n";
|
|
$body .= "Here is a new email verification link for your SvxPortal account ({$call}):\n\n";
|
|
$body .= "{$link}\n\n";
|
|
$body .= "This link is valid for 24 hours.\n\n";
|
|
$body .= "73,\nSvxPortal";
|
|
$sent = mail_send($email, "Verify your email - SvxPortal", $body);
|
|
|
|
json_out(['ok' => true, 'email_sent' => $sent]);
|