?php declare(strict_types=1); /* |-------------------------------------------------------------------------- | AK FASHION BOUTIQUE | CUSTOMER LOGIN |-------------------------------------------------------------------------- | File: | /public_html/customer/login.php |-------------------------------------------------------------------------- */ if (session_status() !== PHP_SESSION_ACTIVE) { session_start(); } /* |-------------------------------------------------------------------------- | IF ALREADY LOGGED IN |-------------------------------------------------------------------------- */ if ( isset($_SESSION['customer_id']) && (int) $_SESSION['customer_id'] > 0 ) { header('Location: /customer/'); exit; } /* |-------------------------------------------------------------------------- | DATABASE CONNECTION |-------------------------------------------------------------------------- */ $dbCandidates = [ __DIR__ . '/../includes/db.php', __DIR__ . '/../config/database.php', __DIR__ . '/../config/db.php', ]; $dbLoaded = false; foreach ($dbCandidates as $dbFile) { if (is_file($dbFile)) { require_once $dbFile; $dbLoaded = true; break; } } if ( !$dbLoaded || !isset($pdo) || !($pdo instanceof PDO) ) { http_response_code(500); exit('Database connection could not be established.'); } /* |-------------------------------------------------------------------------- | SETTINGS |-------------------------------------------------------------------------- */ $pageTitle = 'Customer Login - AK Fashion Boutique'; $currentPage = 'customer-login'; $siteName = 'AK Fashion Boutique'; /* |-------------------------------------------------------------------------- | REDIRECT URL |-------------------------------------------------------------------------- */ $redirect = trim( (string)($_GET['redirect'] ?? '/customer/') ); /* |-------------------------------------------------------------------------- | ALLOW ONLY LOCAL REDIRECTS |-------------------------------------------------------------------------- */ if ( $redirect === '' || !str_starts_with($redirect, '/') || str_starts_with($redirect, '//') ) { $redirect = '/customer/'; } /* |-------------------------------------------------------------------------- | CSRF TOKEN |-------------------------------------------------------------------------- */ if ( !isset($_SESSION['customer_login_csrf']) || !is_string($_SESSION['customer_login_csrf']) ) { $_SESSION['customer_login_csrf'] = bin2hex(random_bytes(32)); } $csrfToken = $_SESSION['customer_login_csrf']; /* |-------------------------------------------------------------------------- | FORM VARIABLES |-------------------------------------------------------------------------- */ $mobile = ''; $error = ''; $success = ''; /* |-------------------------------------------------------------------------- | LOGIN |-------------------------------------------------------------------------- */ if ($_SERVER['REQUEST_METHOD'] === 'POST') { $postedToken = (string)($_POST['csrf_token'] ?? ''); $mobile = trim( (string)($_POST['mobile'] ?? '') ); $password = (string)($_POST['password'] ?? ''); $postedRedirect = trim( (string)($_POST['redirect'] ?? '/customer/') ); /* |-------------------------------------------------------------------------- | VALIDATE REDIRECT |-------------------------------------------------------------------------- */ if ( $postedRedirect !== '' && str_starts_with($postedRedirect, '/') && !str_starts_with($postedRedirect, '//') ) { $redirect = $postedRedirect; } /* |-------------------------------------------------------------------------- | CSRF |-------------------------------------------------------------------------- */ if ( !hash_equals( $csrfToken, $postedToken ) ) { $error = 'Your session has expired. Please refresh the page and try again.'; } /* |-------------------------------------------------------------------------- | VALIDATE MOBILE |-------------------------------------------------------------------------- */ if ($error === '' && $mobile === '') { $error = 'Please enter your mobile number.'; } /* |-------------------------------------------------------------------------- | VALIDATE MOBILE FORMAT |-------------------------------------------------------------------------- */ if ($error === '' && !preg_match('/^[0-9+\-\s]{7,20}$/', $mobile)) { $error = 'Please enter a valid mobile number.'; } /* |-------------------------------------------------------------------------- | VALIDATE PASSWORD |-------------------------------------------------------------------------- */ if ($error === '' && $password === '') { $error = 'Please enter your password.'; } /* |-------------------------------------------------------------------------- | FIND CUSTOMER |-------------------------------------------------------------------------- */ if ($error === '') { try { $stmt = $pdo->prepare(" SELECT id, name, mobile, email, password_hash, status FROM customers WHERE mobile = ? LIMIT 1 "); $stmt->execute([ $mobile ]); $customer = $stmt->fetch(PDO::FETCH_ASSOC); /* |-------------------------------------------------------------------------- | CUSTOMER NOT FOUND |-------------------------------------------------------------------------- */ if (!$customer) { $error = 'Invalid mobile number or password.'; } /* |-------------------------------------------------------------------------- | ACCOUNT STATUS |-------------------------------------------------------------------------- */ elseif ( (string)$customer['status'] !== 'active' ) { $error = 'Your account is currently not active. Please contact AK Fashion Boutique.'; } /* |-------------------------------------------------------------------------- | PASSWORD VERIFY |-------------------------------------------------------------------------- */ elseif ( !password_verify( $password, (string)$customer['password_hash'] ) ) { $error = 'Invalid mobile number or password.'; } /* |-------------------------------------------------------------------------- | LOGIN SUCCESS |-------------------------------------------------------------------------- */ else { session_regenerate_id(true); $_SESSION['customer_id'] = (int)$customer['id']; $_SESSION['customer_name'] = (string)$customer['name']; $_SESSION['customer_mobile'] = (string)$customer['mobile']; $_SESSION['customer_email'] = (string)($customer['email'] ?? ''); $_SESSION['customer_logged_in'] = true; /* |-------------------------------------------------------------------------- | NEW CSRF TOKEN |-------------------------------------------------------------------------- */ unset( $_SESSION['customer_login_csrf'] ); /* |-------------------------------------------------------------------------- | REDIRECT |-------------------------------------------------------------------------- */ header( 'Location: ' . $redirect ); exit; } } catch (Throwable $e) { error_log( 'AK Fashion Customer Login Error: ' . $e->getMessage() ); $error = 'Something went wrong while signing you in. Please try again.'; } } } /* |-------------------------------------------------------------------------- | HEADER |-------------------------------------------------------------------------- */ require_once __DIR__ . '/../includes/header.php'; ?>