From 374a60ee50a4839ccd2528a5731360054100e04b Mon Sep 17 00:00:00 2001
From: Bofh <bofh@nogafam.es>
Date: Sat, 10 Dec 2022 15:49:02 +0100
Subject: [PATCH] Implement user/password solid system (loaded from
 configuration)

---
 config/users.php.example | 16 ++++++++++++++++
 login.php                | 14 +++++++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)
 create mode 100644 config/users.php.example

diff --git a/config/users.php.example b/config/users.php.example
new file mode 100644
index 0000000..21b67c1
--- /dev/null
+++ b/config/users.php.example
@@ -0,0 +1,16 @@
+<?php
+
+$GLOBALS['appconf']['users_hash_secret'] = 'change me to a stronger secret here'; 
+$GLOBALS['appconf']['users'] = [];
+$users = explode("\n", <<<EOSU
+#start_users
+admin 7b838b6df1976f81ba93ecd33b65d0c3ff676cb431d55d6251240d04e81bc783 # pass: 1234
+#end_users
+EOSU);
+foreach ($users as $user) {
+	$user = trim($user);
+	if ($user[0] === '#' || $user === '')
+		continue;
+	$ps = explode(' ', $user);
+	$GLOBALS['appconf']['users'][$ps[0]] = $ps[1];
+}
diff --git a/login.php b/login.php
index fd430b7..e9dc930 100644
--- a/login.php
+++ b/login.php
@@ -1,10 +1,18 @@
 <?php
 
-if (isset($_POST['username']) && isset($_POST['password'])) {
+if (isset($_POST['username']) && isset($_POST['password']))
+{
+	require 'config/application.php';
 	$username = trim($_POST['username']);
 	$password = trim($_POST['password']);
-	// TODO: implement a way to check user passwords
-	$session = $username.'.'.sha1(strval(microtime(true)));
+
+	if (!isset($GLOBALS['appconf']['users'][$username]))
+		die('Incorrect user or password');
+	$pass_hash = hash_hmac('sha256', $password, $GLOBALS['appconf']['users_hash_secret']);
+	if ($pass_hash !== $GLOBALS['appconf']['users'][$username])
+		die('Incorrect user or password');
+
+	$session = $username.'.'.sha1(strval(microtime(true).$pass_hash));
 	setcookie('_session', $session);
 	file_put_contents('/tmp/apcontrol-sessions', $session."\n", FILE_APPEND);
 	header('Location: ..');