francesco/pilates-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add user confirmation

Browse Source
This commit is contained in:
Francesco Picone
2025-12-09 17:50:01 +01:00
parent 10f709a970
commit 402826b7ef
10 changed files with 611 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
login.php
View File

@@ -39,39 +39,45 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$user = get_user_by_email($email);
if ($user && verify_password($password, $user['password'])) {
// Password corretta - effettua il login
// Password corretta - verifica se email è confermata
// Aggiorna data ultimo accesso
$pdo = get_db_connection();
$stmt = $pdo->prepare("UPDATE users SET last_login = NOW() WHERE id = ?");
$stmt->execute([$user['id']]);
// Log attività
$stmt = $pdo->prepare("
INSERT INTO activity_log (user_id, action, description, ip_address, user_agent, created_at)
VALUES (?, 'login', 'Utente ha effettuato il login', ?, ?, NOW())
");
$stmt->execute([
$user['id'],
$_SERVER['REMOTE_ADDR'] ?? null,
$_SERVER['HTTP_USER_AGENT'] ?? null
]);
// Imposta la sessione
login_user($user['id'], $user['is_admin']);
// Reindirizza alla pagina appropriata
if (isset($_SESSION['redirect_after_login'])) {
$redirect = $_SESSION['redirect_after_login'];
unset($_SESSION['redirect_after_login']);
header("Location: $redirect");
} elseif ($user['is_admin']) {
header('Location: admin/dashboard.php');
// Admin possono sempre accedere
if (!$user['is_admin'] && !$user['email_verified']) {
$error = 'Devi verificare la tua email prima di accedere. <a href="resend_verification.php?email=' . urlencode($email) . '" style="color: #667eea; font-weight: bold;">Invia nuovo link</a>';
} elseif (!$user['is_active']) {
$error = 'Il tuo account è stato disattivato. Contatta l\'amministratore.';
} else {
header('Location: user/dashboard.php');
// Aggiorna data ultimo accesso
$pdo = get_db_connection();
$stmt = $pdo->prepare("UPDATE users SET last_login = NOW() WHERE id = ?");
$stmt->execute([$user['id']]);
// Log attività
$stmt = $pdo->prepare("
INSERT INTO activity_log (user_id, action, description, ip_address, user_agent, created_at)
VALUES (?, 'login', 'Utente ha effettuato il login', ?, ?, NOW())
");
$stmt->execute([
$user['id'],
$_SERVER['REMOTE_ADDR'] ?? null,
$_SERVER['HTTP_USER_AGENT'] ?? null
]);
// Imposta la sessione
login_user($user['id'], $user['is_admin']);
// Reindirizza alla pagina appropriata
if (isset($_SESSION['redirect_after_login'])) {
$redirect = $_SESSION['redirect_after_login'];
unset($_SESSION['redirect_after_login']);
header("Location: $redirect");
} elseif ($user['is_admin']) {
header('Location: admin/dashboard.php');
} else {
header('Location: user/dashboard.php');
}
exit;
}
exit;
} else {
$error = 'Email o password non corretti';
}
@@ -103,7 +109,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
<?php if ($error): ?>
<div class="alert alert-error">
<?php echo htmlspecialchars($error); ?>
<?php echo $error; // Contiene HTML sicuro per link ?>
</div>
<?php endif; ?>