clemensandClaude Sonnet 5
54217d2acb
Erste drei Bausteine der Haertung: - Security-Headers (X-Content-Type-Options, X-Frame-Options, Referrer- Policy, Permissions-Policy, HSTS bei HTTPS) laufen automatisch ueber app_send_security_headers() am Ende von app/bootstrap.php fuer jede dynamische Seite; landing.php war als einzige Seite ganz ohne PHP und bekam einen minimalen Bootstrap-Aufruf. Bewusst kein CSP, da die bestehenden Templates durchgaengig auf Inline-style-Attribute setzen. - DB-gestuetzte Rate-Limits (neue Tabelle rate_limit_attempts) fuer Login (10/15min je E-Mail, 20/15min je IP), Registrierung (5/h je IP) und Passwort-Reset-Anfrage (5/h je E-Mail, 10/h je IP); bei ausgereiztem Reset-Limit erscheint dieselbe generische Meldung wie im Erfolgsfall, um kein Konto-Enumeration-Signal zu geben. - Zentrales Audit-Log (neue Tabelle audit_log) fuer Mitgliederverwaltung, Zugangsvergabe/-entzug, Storno, Mandant-Einstellungen, Hinweise, CSV-Import, Jahresbonus-Verteilung und Live-Mailversand; sichtbar fuer Owner/Admin auf mandant-einstellungen.php. Live getestet: Rate-Limit greift nach 10 Fehlversuchen, Audit-Log-Eintrag mit korrekten Metadaten und Nutzernamen ueber einen isolierten Test- Mandanten geprueft. Alle Regressionstests weiterhin gruen (26/26 Smoke, 104 Golden-Master-Assertions). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
130 lines
6.1 KiB
PHP
130 lines
6.1 KiB
PHP
<?php
|
|
|
|
require_once __DIR__ . '/functions.php';
|
|
require_once __DIR__ . '/app/saas-mail.php';
|
|
require_once __DIR__ . '/app/rate-limit.php';
|
|
|
|
$pdo = app_db_pdo();
|
|
$errors = [];
|
|
$values = [
|
|
'tenant_name' => trim((string)($_POST['tenant_name'] ?? '')),
|
|
'tenant_slug' => trim((string)($_POST['tenant_slug'] ?? '')),
|
|
'display_name' => trim((string)($_POST['display_name'] ?? '')),
|
|
'email' => trim((string)($_POST['email'] ?? '')),
|
|
];
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
app_require_csrf();
|
|
|
|
if (!app_rate_limit_check($pdo, 'register_ip:' . app_client_ip(), 5, 3600)) {
|
|
$errors = ['Zu viele Registrierungsversuche. Bitte versuche es später erneut.'];
|
|
} else {
|
|
$result = saas_register_tenant_owner($pdo, [
|
|
'tenant_name' => $values['tenant_name'],
|
|
'tenant_slug' => $values['tenant_slug'],
|
|
'display_name' => $values['display_name'],
|
|
'email' => $values['email'],
|
|
'password' => (string)($_POST['password'] ?? ''),
|
|
'password_confirm' => (string)($_POST['password_confirm'] ?? ''),
|
|
]);
|
|
|
|
if ($result['ok']) {
|
|
if (!empty($result['email_verification_token'])) {
|
|
saas_send_email_verification_mail($values['email'], (string)$result['email_verification_token']);
|
|
}
|
|
saas_session_login($result['identity']);
|
|
if (saas_should_show_auth_links() && !empty($result['email_verification_token'])) {
|
|
$_SESSION['saas_dev_email_verification_token'] = (string)$result['email_verification_token'];
|
|
}
|
|
header('Location: konto.php?registered=1');
|
|
exit;
|
|
}
|
|
|
|
$errors = $result['errors'];
|
|
}
|
|
}
|
|
|
|
?>
|
|
|
|
<!DOCTYPE HTML>
|
|
<html lang="de">
|
|
<head>
|
|
<title>Kaffeeliste Registrierung</title>
|
|
<meta charset="utf-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no" />
|
|
<link rel="stylesheet" href="assets/css/main.css" />
|
|
<link rel="stylesheet" href="assets/css/public.css" />
|
|
</head>
|
|
<body class="is-preload public-page">
|
|
<div class="public-shell">
|
|
<section class="public-auth">
|
|
<nav class="public-nav" aria-label="Hauptnavigation">
|
|
<strong><a href="landing.php">Kaffeeliste</a></strong>
|
|
<ul class="actions">
|
|
<li><a href="login.php" class="button">Login</a></li>
|
|
</ul>
|
|
</nav>
|
|
|
|
<div class="public-auth-grid">
|
|
<div class="public-auth-copy">
|
|
<h1>Registrierung</h1>
|
|
<p>Lege einen neuen Kundenbereich an. Danach bist du als Owner angemeldet und kannst die Kaffeeliste für dein Team einrichten.</p>
|
|
</div>
|
|
|
|
<div class="public-panel">
|
|
<h2>Kundenkonto anlegen</h2>
|
|
|
|
<?php if ($errors !== []): ?>
|
|
<div class="hint-box error">
|
|
<?php foreach ($errors as $error): ?>
|
|
<p><?php echo saas_html($error); ?></p>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<form method="post" action="register.php">
|
|
<?php echo app_csrf_field(); ?>
|
|
<div class="row">
|
|
<div class="col-6 col-12-small">
|
|
<label for="tenant_name">Kundenname</label>
|
|
<input type="text" name="tenant_name" id="tenant_name" value="<?php echo saas_html($values['tenant_name']); ?>" required>
|
|
</div>
|
|
<div class="col-6 col-12-small">
|
|
<label for="tenant_slug">Kundenkürzel</label>
|
|
<input type="text" name="tenant_slug" id="tenant_slug" value="<?php echo saas_html($values['tenant_slug']); ?>" placeholder="kaffeeliste-team" required>
|
|
</div>
|
|
<div class="col-6 col-12-small">
|
|
<label for="display_name">Dein Name</label>
|
|
<input type="text" name="display_name" id="display_name" value="<?php echo saas_html($values['display_name']); ?>" required>
|
|
</div>
|
|
<div class="col-6 col-12-small">
|
|
<label for="email">E-Mail</label>
|
|
<input type="email" name="email" id="email" value="<?php echo saas_html($values['email']); ?>" required>
|
|
</div>
|
|
<div class="col-6 col-12-small">
|
|
<label for="password">Passwort</label>
|
|
<input type="password" name="password" id="password" minlength="8" required>
|
|
</div>
|
|
<div class="col-6 col-12-small">
|
|
<label for="password_confirm">Passwort wiederholen</label>
|
|
<input type="password" name="password_confirm" id="password_confirm" minlength="8" required>
|
|
</div>
|
|
</div>
|
|
<ul class="actions">
|
|
<li><button type="submit" class="primary">Kundenkonto anlegen</button></li>
|
|
<li><a href="login.php" class="button">Zum Login</a></li>
|
|
</ul>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</section>
|
|
</div>
|
|
|
|
<script src="assets/js/jquery.min.js"></script>
|
|
<script src="assets/js/browser.min.js"></script>
|
|
<script src="assets/js/breakpoints.min.js"></script>
|
|
<script src="assets/js/util.js"></script>
|
|
<script src="assets/js/main.js"></script>
|
|
</body>
|
|
</html>
|