PNG IHDR x sBIT|d pHYs + tEXtSoftware www.inkscape.org< ,tEXtComment
<?php
session_start();
// Database Configuration
$host = 'localhost';
$dbname = 'u264723324_NuDb';
$user = 'u264723324_NuUu';
$pass = '@WdsdsdAq1231';
$errorMsg = '';
$isLocked = false;
$lockoutTimeRemaining = 0;
if ($_SERVER["REQUEST_METHOD"] == "POST") {
try {
$pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8mb4", $user, $pass);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
$password = $_POST['password'];
// 1. Fetch Admin Record
$stmt = $pdo->prepare("SELECT * FROM admins WHERE username = :username LIMIT 1");
$stmt->execute([':username' => $username]);
$adminData = $stmt->fetch(PDO::FETCH_ASSOC);
if ($adminData) {
$currentTime = time();
// 2. CHECK BRUTE FORCE LOCKOUT FIRST
if ($adminData['lockout_time'] > $currentTime) {
$isLocked = true;
$lockoutTimeRemaining = $adminData['lockout_time'] - $currentTime;
$errorMsg = "SECURITY LOCK: Too many failed attempts. Try again in " . $lockoutTimeRemaining . " seconds.";
} else {
// 3. Verify Password
if (password_verify($password, $adminData['password_hash'])) {
// SUCCESS: Reset failed attempts and lockout
$pdo->prepare("UPDATE admins SET failed_attempts = 0, lockout_time = 0 WHERE id = ?")->execute([$adminData['id']]);
// Set Highly Secure Admin Session
session_regenerate_id(true); // Prevent Session Fixation attacks
$_SESSION['admin_id'] = $adminData['id'];
$_SESSION['admin_username'] = $adminData['username'];
$_SESSION['is_admin'] = true;
header("Location: admin-dashboard.php");
exit();
} else {
// FAILED ATTEMPT LOGIC
$attempts = $adminData['failed_attempts'] + 1;
if ($attempts >= 4) {
// Strike 4: Lock account for 30 seconds
$lockTime = $currentTime + 30;
$pdo->prepare("UPDATE admins SET failed_attempts = ?, lockout_time = ? WHERE id = ?")
->execute([$attempts, $lockTime, $adminData['id']]);
$isLocked = true;
$errorMsg = "SYSTEM LOCKED: 4 failed attempts. You are locked out for 30 seconds.";
} else {
// Strike 1-3: Increment counter
$pdo->prepare("UPDATE admins SET failed_attempts = ? WHERE id = ?")
->execute([$attempts, $adminData['id']]);
$attemptsLeft = 4 - $attempts;
$errorMsg = "Access Denied. Invalid credentials. Warning: $attemptsLeft attempts remaining before lockdown.";
}
}
}
} else {
// Do not reveal if username exists or not (Security Best Practice)
$errorMsg = "Access Denied. Invalid credentials.";
}
} catch (PDOException $e) {
$errorMsg = "DATABASE ERROR: " . $e->getMessage();
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>SECURE PORTAL - City Prime Admin</title>
<style>
:root {
--bg-deep: #050505;
--surface-dark: #0f0f0f;
--border-red: #7f1d1d;
--danger-glow: rgba(220, 38, 38, 0.15);
--text-main: #f8fafc;
--text-muted: #64748b;
}
* { margin: 0; padding: 0; box-sizing: border-box; font-family: "Courier New", Courier, monospace; }
body { background-color: var(--bg-deep); color: var(--text-main); display: flex; align-items: center; justify-content: center; min-height: 100vh; overflow: hidden; user-select: none; }
.grid-bg { position: absolute; width: 100vw; height: 100vh; background-image: linear-gradient(rgba(255,255,255,0.02) 1px, transparent 1px), linear-gradient(90deg, rgba(255,255,255,0.02) 1px, transparent 1px); background-size: 30px 30px; z-index: 0;}
.auth-container { position: relative; z-index: 1; width: 100%; max-width: 420px; padding: 24px; }
.logo-area { text-align: center; margin-bottom: 40px; }
.logo-area h1 { font-size: 1.8rem; color: #ef4444; letter-spacing: 4px; text-transform: uppercase; text-shadow: 0 0 10px rgba(239,68,68,0.5);}
.logo-area p { color: var(--text-muted); font-size: 0.8rem; margin-top: 8px; letter-spacing: 2px;}
.auth-box { background: var(--surface-dark); border: 1px solid var(--border-red); padding: 40px 32px; box-shadow: 0 0 40px var(--danger-glow); position: relative;}
.auth-box::before { content: ''; position: absolute; top: 0; left: 0; width: 100%; height: 2px; background: #ef4444;}
.error-alert { background: rgba(239, 68, 68, 0.1); border-left: 4px solid #ef4444; color: #ef4444; padding: 16px; font-size: 0.85rem; margin-bottom: 24px; line-height: 1.5; font-weight: bold; word-break: break-all;}
.form-group { margin-bottom: 24px; }
.form-label { display: block; font-size: 0.8rem; color: var(--text-muted); margin-bottom: 8px; text-transform: uppercase; letter-spacing: 1px;}
.form-input { width: 100%; background: var(--bg-deep); border: 1px solid rgba(255,255,255,0.1); color: var(--text-main); padding: 14px 16px; font-size: 1rem; outline: none; transition: 0.2s; font-family: monospace; letter-spacing: 1px;}
.form-input:focus { border-color: #ef4444; box-shadow: inset 0 0 10px rgba(239,68,68,0.2);}
.form-input.locked { background: #1a0505; cursor: not-allowed; border-color: var(--border-red); opacity: 0.5;}
.forgot-pass { text-align: right; margin-bottom: 32px; }
.forgot-pass a { color: var(--text-muted); font-size: 0.8rem; text-decoration: none; transition: 0.2s; border-bottom: 1px solid transparent;}
.forgot-pass a:hover { color: #ef4444; border-color: #ef4444; }
.primary-btn { width: 100%; background: transparent; color: #ef4444; border: 1px solid #ef4444; padding: 16px; font-size: 1rem; font-weight: bold; cursor: pointer; transition: 0.2s; text-transform: uppercase; letter-spacing: 2px;}
.primary-btn:hover:not(:disabled) { background: #ef4444; color: white; box-shadow: 0 0 15px rgba(239,68,68,0.4);}
.primary-btn:disabled { border-color: #555; color: #555; cursor: not-allowed;}
</style>
</head>
<body oncontextmenu="return false;">
<div class="grid-bg"></div>
<div class="auth-container">
<div class="logo-area">
<h1>Admin System</h1>
<p>RESTRICTED ACCESS ONLY</p>
</div>
<div class="auth-box">
<?php if (!empty($errorMsg)): ?>
<div class="error-alert">
> <?php echo htmlspecialchars($errorMsg); ?>
</div>
<?php endif; ?>
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="POST" autocomplete="off">
<div class="form-group">
<label class="form-label">Admin ID</label>
<input type="text" name="username" value="" class="form-input <?php echo $isLocked ? 'locked' : ''; ?>" required autocomplete="off" onpaste="return false;" oncopy="return false;" <?php echo $isLocked ? 'disabled' : ''; ?>>
</div>
<div class="form-group">
<label class="form-label">Authentication Key</label>
<input type="text" name="password" value="" class="form-input <?php echo $isLocked ? 'locked' : ''; ?>" required autocomplete="new-password" onpaste="return false;" oncopy="return false;" <?php echo $isLocked ? 'disabled' : ''; ?>>
</div>
<div class="forgot-pass">
<a href="admin-forgot.php">INITIATE RECOVERY PROTOCOL</a>
</div>
<button type="submit" class="primary-btn" id="loginBtn" <?php echo $isLocked ? 'disabled' : ''; ?>>
<?php echo $isLocked ? 'SYSTEM LOCKED' : 'AUTHORIZE'; ?>
</button>
</form>
</div>
</div>
<?php if ($isLocked): ?>
<script>
let timeLeft = <?php echo $lockoutTimeRemaining; ?>;
const btn = document.getElementById('loginBtn');
const timer = setInterval(() => {
timeLeft--;
if (timeLeft <= 0) {
clearInterval(timer);
window.location.reload();
} else {
btn.innerText = "LOCKED (" + timeLeft + "s)";
}
}, 1000);
</script>
<?php endif; ?>
</body>
</html>
b IDATxytVսϓ22 A@IR:hCiZ[v*E:WũZA ^dQeQ @ !jZ'>gsV仿$|?g)&x-E