JezK

Edit File: loginApp.php

<?php

ini_set('session.cookie_secure', '1');         // Only over HTTPS
ini_set('session.cookie_httponly', '1');       // JS can't access cookie
ini_set('session.cookie_samesite', 'Strict');

// Security Headers
header("X-XSS-Protection: 1; mode=block");

session_start();
include("main.php");
$email = $_POST["email"];
$password = $_POST["password"];
$captcha = $_POST['g-recaptcha-response'];

$verifyStatus = $bdc->verify_recaptcha($captcha);

if (!$verifyStatus) {
	$_SESSION['loginFailed'] = 1; // custom message
	echo "<script>alert('Captcha verification failed. Please try again.');location.replace('../index.php');</script>";
	exit;
}

// RATE LIMIT CHECK
$ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
$attempts = $bdc->loginAttempt($ip);
if ($attempts >= 5) {
	http_response_code(429); // Too many requests
	$_SESSION['loginFailed'] = 1; // custom message
	echo "<script>alert('Too many login attempts. Try again after 10 minutes.');location.replace('../index.php');</script>";
	exit;
}

// Validate Email
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
	http_response_code(400);
    echo "<script>location.replace('../index.php');</script>";
    exit;
}

// $passRegex = "/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_]).{12,}$/";

// if (!preg_match($passRegex, $password)) {
// 	http_response_code(400);
//    $_SESSION['loginFailed'] = 1;
// 	echo "<script>location.replace('../index.php');</script>";
// }

$result = $bdc->login($email,$password);
if($result == 0)
{

// Insert failed attempt
	$bdc->insertLoginAttempt($ip);

http_response_code(400);
	$_SESSION['loginFailed'] = 1;
	echo "<script>location.replace('../index.php');</script>";
}
else if($result == -1)
{
	http_response_code(400);
	$_SESSION['userDeactivated'] = 1;
	echo "<script>location.replace('../index.php');</script>";
}
else
{

// Clear attempts on successful login
	$bdc->clearLoginAttempts($ip);

session_regenerate_id(true);

$_SESSION['bdcUserID'] = $result['id'];
	$_SESSION['bdcCode'] = $result['code'];
	$_SESSION['bdcName'] = $result['name'];
	$_SESSION['bdcUserPassword'] = $result['password'];

$_SESSION['USER_IP'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
	$_SESSION['USER_AGENT'] = $_SERVER['HTTP_USER_AGENT'];

$session_token = bin2hex(random_bytes(32)); // Generate secure session token
	$_SESSION['session_token'] = $session_token;

$updateStatus = $bdc->updateSession($session_token, $result['id']);

echo "<script>location.replace('../dashboard.php');</script>";
}
?>

https://satyadevaresidency.com/wp-sitemap-posts-post-1.xmlhttps://satyadevaresidency.com/wp-sitemap-posts-page-1.xmlhttps://satyadevaresidency.com/wp-sitemap-posts-gallery-1.xmlhttps://satyadevaresidency.com/wp-sitemap-posts-testimonial-1.xmlhttps://satyadevaresidency.com/wp-sitemap-taxonomies-category-1.xmlhttps://satyadevaresidency.com/wp-sitemap-taxonomies-post_tag-1.xmlhttps://satyadevaresidency.com/wp-sitemap-taxonomies-gallery_cat-1.xml