SWDB/application/action/login.php

<?php

    /**
     * File for the login action.
     *
     * Implements an action function to be called from the {@see Controller}.
     * 
     * @category Action
     */

    /**
     * Logs the user in.
     *
     * Reads the POST parameters looking for the following KEYS:
     *  uname
     *  password
     * If there is a match, it sets cookies and session variables, and
     * redirects to the user homepage.
     *
     * @return int 0 on success, negative values on error.
     * @category Action
     */
    function action(){

        if (!isset($_POST['uname'], $_POST['password'])){
            header("Location: " . URL::BASE);
            exit();
        }
        $uname = SQLite3::escapeString($_POST['uname']);
        if (strlen($uname) == 0){
            header("Location: " . URL::BASE);
            exit();
        }
        $password = SQLite3::escapeString($_POST['password']);
        if (strlen($password) == 0){
            header("Location: " . URL::BASE);
            exit();
        }
        $password = hash('sha256', $password);
        $statement = get_context()->get_db()->prepare("
          SELECT
            id,
            name
          FROM user
          WHERE
            (
              upper(name) = upper(:name) OR
              upper(mail) = upper(:mail)
            ) AND
            password = :password;
        ");
        $statement->bindValue(":name", $uname, SQLITE3_TEXT);
        $statement->bindValue(":mail", $uname, SQLITE3_TEXT);
        $statement->bindValue(":password", $password, SQLITE3_TEXT);
        $statement->execute();
        $r = $statement->execute()->fetchArray(SQLITE3_ASSOC);
        if (!$r){
            header("Location: " . URL::BASE);
            exit();
            die();
            return 401;
        }
        $user = $r["id"];

        // Generate token
        //$_COOKIE["user_token"]) && isset($COOKIE["user_id"])
        $token = bin2hex(random_bytes(32));
        $expiry = time() + 5 * 24 * 60 * 60; // 5 days
        $statement = get_context()->get_db()->prepare("
          INSERT INTO token (user, token, expiry) VALUES
          (:user, :token, :expiry);
        ");
        $statement->bindValue(":user", $user, SQLITE3_INTEGER);
        $statement->bindValue(":token", hash('sha256', $token), SQLITE3_TEXT);
        $statement->bindValue(":expiry", $expiry, SQLITE3_INTEGER);
        $statement->execute();

        setcookie("user_id", $user, $expiry, "/");
        setcookie("user_token", $token, $expiry, "/");
        session_regenerate_id();
        $_SESSION['session'] = true;
        $_SESSION['user_id'] = $user;
        //header("Location: " . URL::BASE . "/$user/");
        // TODO: Get player ID here?
        header("Location: " . URL::BASE);
        exit();
        die();
        return 0;
    }
?>