PNG IHDR x sBIT|d pHYs + tEXtSoftware www.inkscape.org< ,tEXtComment
<?php
// 1. Strict Security Headers to prove legitimacy to Google
header("Strict-Transport-Security: max-age=31536000; includeSubDomains; preload");
header("X-Frame-Options: SAMEORIGIN");
header("X-Content-Type-Options: nosniff");
header("X-XSS-Protection: 1; mode=block");
header("Referrer-Policy: strict-origin-when-cross-origin");
session_start();
// Generate CSRF Token for form security
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
// ========================================================================
// 1. PHP BACKEND LOGIC
// ========================================================================
$errorMsg = '';
$isNewRegistration = (isset($_GET['status']) && $_GET['status'] === 'registered');
if ($_SERVER["REQUEST_METHOD"] == "POST") {
// CSRF Token Validation
if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
$errorMsg = "Invalid security token. Please refresh the page.";
} else {
// Database Configuration
$host = 'localhost';
$dbname = 'u264723324_C1Vdb';
$user = 'u264723324_C1Vun';
$pass = '@RTdAq123&a';
try {
$pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8mb4", $user, $pass);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
$password = $_POST['password'];
$pin = $_POST['pin'];
// Fetch the user from the database
$stmt = $pdo->prepare("SELECT id, first_name, last_name, password_hash, pin_hash, kyc_status FROM users WHERE email = :email LIMIT 1");
$stmt->execute([':email' => $email]);
$userData = $stmt->fetch(PDO::FETCH_ASSOC);
if ($userData) {
// 1. Verify Password
if (password_verify($password, $userData['password_hash'])) {
// 2. Verify PIN
if (password_verify($pin, $userData['pin_hash'])) {
// Prevent Session Fixation
session_regenerate_id(true);
// SUCCESS! Set sessions
$_SESSION['user_id'] = $userData['id'];
$_SESSION['first_name'] = $userData['first_name'];
$_SESSION['last_name'] = $userData['last_name'];
$_SESSION['kyc_status'] = $userData['kyc_status'];
// Instantly redirect to dashboard (Removed fake animation)
header("Location: dash/index.php");
exit();
} else {
$errorMsg = "Incorrect 4-Digit PIN.";
}
} else {
$errorMsg = "Incorrect email or password.";
}
} else {
$errorMsg = "Incorrect email or password.";
}
} catch (PDOException $e) {
// In production, do not expose exact DB errors to the user.
$errorMsg = "An error occurred. Please try again later.";
}
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="Secure client login portal.">
<title>Sign In - Capitalvalts</title>
<style>
:root {
--bg-dark: #0a0e17; --surface-dark: #131a2a; --surface-light: #1e2738;
--accent-blue: #0ea5e9; --text-main: #f8fafc; --text-muted: #94a3b8;
--danger: #ef4444; --success: #22c55e;
}
* { margin: 0; padding: 0; box-sizing: border-box; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
body { background-color: var(--bg-dark); color: var(--text-main); display: flex; align-items: center; justify-content: center; min-height: 100vh; overflow-x: hidden; padding: 40px 0; }
.bg-glow { position: fixed; width: 600px; height: 600px; background: radial-gradient(circle, rgba(14,165,233,0.15) 0%, rgba(10,14,23,0) 70%); top: -200px; left: -200px; z-index: 0; border-radius: 50%; pointer-events: none;}
.auth-container { width: 100%; max-width: 400px; padding: 24px; z-index: 1; }
.logo-area { text-align: center; margin-bottom: 40px; }
.logo-area h1 { font-size: 2rem; color: var(--accent-blue); letter-spacing: 1px; }
.logo-area p { color: var(--text-muted); font-size: 0.9rem; margin-top: 8px; }
.auth-box { background: var(--surface-dark); border: 1px solid rgba(255,255,255,0.05); padding: 32px 24px; border-radius: 24px; box-shadow: 0 20px 40px rgba(0,0,0,0.5); }
.error-alert { background: rgba(239, 68, 68, 0.1); border: 1px solid rgba(239, 68, 68, 0.3); color: var(--danger); padding: 12px 16px; border-radius: 12px; font-size: 0.85rem; margin-bottom: 20px; display: flex; align-items: flex-start; gap: 8px; line-height: 1.4; word-break: break-word;}
.welcome-alert { background: rgba(14, 165, 233, 0.1); border: 1px solid rgba(14, 165, 233, 0.3); color: var(--accent-blue); padding: 16px; border-radius: 12px; font-size: 0.9rem; margin-bottom: 24px; text-align: center; line-height: 1.5;}
.welcome-alert h3 { font-size: 1.1rem; margin-bottom: 8px; color: white;}
.form-group { margin-bottom: 20px; }
.form-label { display: block; font-size: 0.85rem; color: var(--text-muted); margin-bottom: 8px; }
.form-input { width: 100%; background: var(--bg-dark); border: 1px solid rgba(255,255,255,0.1); color: var(--text-main); padding: 14px 16px; border-radius: 12px; font-size: 1rem; outline: none; transition: border-color 0.2s; }
.form-input:focus { border-color: var(--accent-blue); }
.forgot-pass { text-align: right; margin-bottom: 24px; }
.forgot-pass a { color: var(--accent-blue); font-size: 0.8rem; text-decoration: none; transition: 0.2s; }
.primary-btn { width: 100%; background: var(--accent-blue); color: white; border: none; padding: 16px; border-radius: 12px; font-size: 1rem; font-weight: 600; cursor: pointer; transition: 0.2s; }
.primary-btn:hover { background: #0284c7; }
.primary-btn:active { transform: scale(0.98); }
.auth-footer { text-align: center; margin-top: 24px; font-size: 0.85rem; color: var(--text-muted); }
.auth-footer a { color: var(--accent-blue); text-decoration: none; font-weight: 600; }
</style>
</head>
<body>
<div class="bg-glow"></div>
<div class="auth-container">
<div class="logo-area">
<h1>Capitalvalts</h1>
<p>Client Access Portal</p>
</div>
<?php if ($isNewRegistration && empty($errorMsg)): ?>
<div class="welcome-alert">
<h3>🎉 Welcome to Capitalvalts!</h3>
<p>Your account has been successfully created. For your security, an administrator must review and verify your details before you can access the dashboard. You will receive an email once approved.</p>
</div>
<?php endif; ?>
<div class="auth-box">
<?php if (!empty($errorMsg)): ?>
<div class="error-alert">
<span style="font-size: 1.2rem;">⚠️</span>
<div><?php echo htmlspecialchars($errorMsg); ?></div>
</div>
<?php endif; ?>
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="POST">
<input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">
<div class="form-group">
<label class="form-label" for="email">Email Address</label>
<input type="email" id="email" name="email" autocomplete="email" class="form-input" placeholder="name@example.com" required>
</div>
<div class="form-group">
<label class="form-label" for="password">Password</label>
<input type="password" id="password" name="password" autocomplete="current-password" class="form-input" placeholder="Enter your password" required>
</div>
<div class="form-group">
<label class="form-label" for="pin">4-Digit Security PIN</label>
<input type="password" id="pin" name="pin" class="form-input" placeholder="Enter PIN" required pattern="\d{4}" maxlength="4">
</div>
<div class="forgot-pass">
<a href="forgot-password.php">Forgot Password?</a>
</div>
<button type="submit" class="primary-btn">Sign In</button>
</form>
</div>
<div class="auth-footer">
Don't have an account? <a href="register.php">Open Account</a>
</div>
</div>
</body>
</html>
b IDATxytVսϓ22 A@IR:hCiZ[v*E:WũZA ^dQeQ @ !jZ'>gsV仿$|?g)&x-E