bookmarkly2/login.php

<?php
require_once 'include/init.php';

$error = '';

// Redirect if already logged in
if (isset($_SESSION['user_id'])) {
    header('Location: index.php');
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';
    $remember_me = isset($_POST['remember_me']);
    $honeypot = $_POST['website'] ?? '';

    // Honeypot check: if the hidden field is filled, it's a bot.
    if (!empty($honeypot)) {
        // Treat it like a normal failed login to not give away the trick.
        $error = translate('error_invalid_credentials');
    } elseif (empty($username) || empty($password)) {
        $error = translate('error_fill_fields');
    } else {
        $stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
        $stmt->execute([$username]);
        $user = $stmt->fetch();

        if ($user && password_verify($password, $user['password'])) {
            // Regenerate session ID to prevent session fixation
            session_regenerate_id(true);
            
            // Clear any old session data (like guest_tab_id)
            $_SESSION = [];

            $_SESSION['user_id'] = $user['id'];
            $_SESSION['username'] = $user['username'];
            $_SESSION['role'] = $user['role'];
            
            // Handle "Remember Me" functionality
            if ($remember_me) {
                // Get remember me duration from settings
                $stmt = $pdo->prepare("SELECT value FROM settings WHERE key = 'remember_me_duration'");
                $stmt->execute();
                $duration = $stmt->fetchColumn() ?: '2 weeks';
                
                // Convert duration to seconds
                $seconds = 0;
                switch ($duration) {
                    case '1 day':
                        $seconds = 24 * 60 * 60;
                        break;
                    case '2 weeks':
                        $seconds = 14 * 24 * 60 * 60;
                        break;
                    case '1 month':
                        $seconds = 30 * 24 * 60 * 60;
                        break;
                    case '3 months':
                        $seconds = 90 * 24 * 60 * 60;
                        break;
                    case '1 year':
                        $seconds = 365 * 24 * 60 * 60;
                        break;
                    default:
                        $seconds = 14 * 24 * 60 * 60; // Default to 2 weeks
                }
                
                // Update session cookie with extended lifetime
                $params = session_get_cookie_params();
                setcookie(session_name(), session_id(), time() + $seconds, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
            } else {
                // For normal login, set cookie to expire at end of browser session
                $params = session_get_cookie_params();
                setcookie(session_name(), session_id(), 0, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
            }
            
            header('Location: index.php');
            exit;
        } else {
            $error = translate('error_invalid_credentials');
        }
    }
}

// Add login-page class to body for CSS targeting
$GLOBALS['body_class'] = 'login-page';
require_once 'include/header.php';
?>

<div class="container">
    <div class="row justify-content-center align-items-center" style="min-height: 80vh;">
        <div class="col-md-5">
            <div class="category-column">
                <div class="text-center mb-4">
                    <?php
                        $logo_path = $settings['site_logo'] ?? '';
                        $site_title = htmlspecialchars($settings['site_title'] ?? 'Bookmarkly');
                        $display_title = ($settings['display_site_title'] ?? '1') === '1';
                    ?>
                    
                    <?php if (!empty($logo_path)): ?>
                        <img src="<?php echo htmlspecialchars($logo_path); ?>" alt="<?php echo $site_title; ?> Logo" style="max-height: <?php echo htmlspecialchars($settings['logo_height'] ?? '50'); ?>px;" class="d-inline-block align-middle me-2">
                    <?php endif; ?>

                    <?php if ($display_title || empty($logo_path)): ?>
                        <h3 class="card-title d-inline-block align-middle mb-0"><?php echo $site_title; ?> - login</h3>
                    <?php endif; ?>
                </div>

                <?php if ($error): ?>
                    <div class="alert alert-danger"><?php echo htmlspecialchars($error); ?></div>
                <?php endif; ?>

                <form action="login.php" method="post">
                    <div class="mb-3">
                        <label for="username" class="form-label"><?php echo translate('username'); ?></label>
                        <input type="text" class="form-control" id="username" name="username" required autofocus>
                    </div>
                    <div class="mb-3">
                        <label for="password" class="form-label"><?php echo translate('password'); ?></label>
                        <input type="password" class="form-control" id="password" name="password" required>
                    </div>
                    <div class="mb-3 form-check">
                        <input class="form-check-input" type="checkbox" id="remember_me" name="remember_me" value="1">
                        <label class="form-check-label" for="remember_me">
                            <?php echo translate('remember_me'); ?>
                        </label>
                    </div>
                    <div class="mb-3 website-field" style="display: none !important;">
                        <label for="website" class="form-label">Website</label>
                        <input type="text" class="form-control" id="website" name="website" autocomplete="off">
                    </div>
                    <button type="submit" class="btn btn-primary w-100"><?php echo translate('login_button'); ?></button>
                </form>
            </div>
        </div>
    </div>
</div>

<?php require_once 'include/footer.php'; ?>