import live www.sillylaird.ca webrootHEADmain

1 files changed, 117 insertions, 0 deletions

diff --git a/admin/login.php b/admin/login.php
new file mode 100644
index 0000000..0fe0d1d
--- /dev/null
+++ b/admin/login.php
@@ -0,0 +1,117 @@
+<?php
+require_once __DIR__ . '/../partials/session.php';
+require_once __DIR__ . '/../partials/proxy_helpers.php';
+
+// Post-login destination: honour a local ?ref= path (no open redirects),
+// otherwise land on the unified admin panel.
+$ref  = $_GET['ref'] ?? '';
+$dest = (is_string($ref) && $ref !== '' && $ref[0] === '/' && substr($ref, 0, 2) !== '//') ? $ref : '/admin.php';
+
+if (!empty($_SESSION['admin'])) {
+    header('Location: ' . $dest);
+    exit;
+}
+
+if (empty($_SESSION['csrf'])) {
+    $_SESSION['csrf'] = bin2hex(random_bytes(32));
+}
+
+/**
+ * Load admin credentials from outside the document root.
+ * Override path with ADMIN_AUTH_FILE in the php-fpm environment.
+ *
+ * File returns: ['algo' => 'password_hash'|'sha256', 'hash' => string, 'salt' => string?]
+ */
+function admin_auth_config(): ?array {
+    $path = getenv('ADMIN_AUTH_FILE');
+    if (!is_string($path) || $path === '') {
+        $path = '/var/lib/sillylaird/admin_auth.php';
+    }
+    if (!is_file($path) || !is_readable($path)) {
+        return null;
+    }
+    $cfg = include $path;
+    return is_array($cfg) ? $cfg : null;
+}
+
+function admin_password_ok(string $provided): bool {
+    $cfg = admin_auth_config();
+    if ($cfg === null) {
+        return false;
+    }
+    $hash = (string)($cfg['hash'] ?? '');
+    if ($hash === '') {
+        return false;
+    }
+    $algo = strtolower((string)($cfg['algo'] ?? 'password_hash'));
+    if ($algo === 'password_hash' || str_starts_with($hash, '$2y$') || str_starts_with($hash, '$2a$') || str_starts_with($hash, '$argon')) {
+        return password_verify($provided, $hash);
+    }
+    // Legacy: sha256(password + salt)
+    $salt = (string)($cfg['salt'] ?? '');
+    $computed = hash('sha256', $provided . $salt);
+    return hash_equals($hash, $computed);
+}
+
+$error = '';
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    if (!proxy_rate_limit('admin_login', 5, 300)) {
+        http_response_code(429);
+        $error = 'Too many attempts. Try again in a few minutes.';
+    } else {
+        $token = $_POST['csrf'] ?? '';
+        if (!is_string($token) || !hash_equals($_SESSION['csrf'], $token)) {
+            $error = 'Bad request.';
+        } else {
+            $provided = $_POST['password'] ?? '';
+            if (is_string($provided) && admin_password_ok($provided)) {
+                session_regenerate_id(true);
+                $_SESSION['admin'] = true;
+                unset($_SESSION['csrf']);
+                header('Location: ' . $dest);
+                exit;
+            }
+            $error = 'Wrong password.';
+            usleep(random_int(150000, 400000));
+        }
+    }
+}
+?>
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width,initial-scale=1" />
+  <title>Admin Login — SillyLaird</title>
+  <link rel="icon" href="https://www.sillylaird.ca/assets/img/lain.png" />
+  <link rel="stylesheet" href="/assets/css/fonts.css" />
+  <link rel="stylesheet" href="/assets/css/site.css?v=1.5" />
+  <link rel="stylesheet" href="/assets/css/skeleton.css" />
+</head>
+<body>
+  <a class="skip-link" href="#main">Skip to content</a>
+  <?php include $_SERVER['DOCUMENT_ROOT'] . '/partials/header.php'; ?>
+
+  <main id="main" class="wrap stack">
+    <section aria-labelledby="login-title">
+      <h1 id="login-title">Admin Login</h1>
+
+      <?php if ($error): ?>
+        <p style="color: var(--accent); font-size: var(--fs-sm);"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></p>
+      <?php endif; ?>
+
+      <form method="post" action="" style="max-width: 360px;">
+        <input type="hidden" name="csrf" value="<?= htmlspecialchars($_SESSION['csrf'], ENT_QUOTES, 'UTF-8') ?>" />
+        <div class="field-group">
+          <label for="password">Password</label>
+          <input type="password" id="password" name="password" autofocus autocomplete="current-password" />
+        </div>
+        <button type="submit">Enter</button>
+      </form>
+    </section>
+  </main>
+
+  <?php include $_SERVER['DOCUMENT_ROOT'] . '/partials/footer.php'; ?>
+</body>
+</html>