Felix KemmlerandClaude Sonnet 5
598dfcd38a
Docker-Images bauen und veröffentlichen / build (, omsorgCore/Dockerfile, omsorgcore) (push) Successful in 3s
Docker-Images bauen und veröffentlichen / build (, omsorgWeb/Dockerfile, omsorgweb) (push) Failing after 4s
Docker-Images bauen und veröffentlichen / build (VITE_OMSORG_CORE_URL=${{ vars.OMSORG_CORE_PUBLIC_URL }}, omsorgapp/Dockerfile, omsorgapp) (push) Successful in 3s
- omsorgapp: drop Electron, run as a plain Vite/React browser app; refresh token moves to an HttpOnly cookie (omsorgCore), CORS added for the new browser origin, document download/preview switched to Blob-based browser APIs. - Add Dockerfiles for omsorgCore, omsorgapp, and omsorgWeb, a docker-compose.yml wiring Postgres/MySQL/all three apps together, and a Gitea Actions workflow that builds and pushes images to the repo's container registry on push to main and on version tags. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
144 lines
5.7 KiB
PHP
144 lines
5.7 KiB
PHP
<?php
|
||
require_once __DIR__ . '/../lib/auth.php';
|
||
|
||
if (is_logged_in()) {
|
||
header('Location: dashboard.php');
|
||
exit;
|
||
}
|
||
|
||
$policy = omsorgcore_password_policy(_omsorgcore_config());
|
||
$minLength = $policy['ok'] ? (int) $policy['data']['minLength'] : 8;
|
||
|
||
$step = $_POST['step'] ?? 'request';
|
||
$error = '';
|
||
|
||
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
||
verify_csrf();
|
||
|
||
if ($step === 'request') {
|
||
$username = trim($_POST['username'] ?? '');
|
||
if ($username === '') {
|
||
$error = 'Bitte Benutzername eingeben.';
|
||
} else {
|
||
$result = omsorgcore_forgot_password_request(_omsorgcore_config(), $username);
|
||
$status = $result['ok'] ? ($result['data']['status'] ?? null) : null;
|
||
|
||
if ($status === 'email_unavailable') {
|
||
// Einzige Ausnahme vom "immer weiter"-Prinzip unten: der Code wurde zwar angelegt,
|
||
// aber die E-Mail kam nachweislich nicht raus (z.B. SMTP down) - kein Sinn, den Nutzer
|
||
// auf eine Code-Eingabe warten zu lassen, die nie ankommt. Kein zusätzliches
|
||
// Enumeration-Risiko: "sent" vs. "cannot_reset" unterscheidet bereits, ob der Username
|
||
// existiert (siehe AuthController.ForgotPasswordRequest in omsorgCore).
|
||
$error = 'Der E-Mail-Versand ist gerade nicht verfügbar. Bitte später erneut versuchen oder einen Administrator kontaktieren.';
|
||
} else {
|
||
// Bewusst immer weiter zu Schritt 2, unabhängig vom Ergebnis - kein Rückschluss darauf,
|
||
// ob der Username existiert (siehe PasswordResetService.RequestResetAsync in omsorgCore).
|
||
$step = 'verify';
|
||
}
|
||
}
|
||
} elseif ($step === 'verify') {
|
||
$username = trim($_POST['username'] ?? '');
|
||
$pin = trim($_POST['pin'] ?? '');
|
||
$result = omsorgcore_forgot_password_verify(_omsorgcore_config(), $username, $pin);
|
||
|
||
if ($result['ok']) {
|
||
$resetToken = $result['data']['resetToken'];
|
||
$step = 'reset';
|
||
} else {
|
||
$error = 'Code ungültig oder abgelaufen.';
|
||
}
|
||
} elseif ($step === 'reset') {
|
||
$resetToken = $_POST['reset_token'] ?? '';
|
||
$new = $_POST['new_password'] ?? '';
|
||
$repeat = $_POST['new_password_repeat'] ?? '';
|
||
|
||
if (strlen($new) < $minLength) {
|
||
$error = "Das neue Passwort muss mindestens {$minLength} Zeichen lang sein.";
|
||
} elseif ($new !== $repeat) {
|
||
$error = 'Die Passwörter stimmen nicht überein.';
|
||
} else {
|
||
$result = omsorgcore_forgot_password_reset(_omsorgcore_config(), $resetToken, $new);
|
||
if ($result['ok']) {
|
||
header('Location: ../index.php?pwchanged=1');
|
||
exit;
|
||
}
|
||
$error = $result['status'] === 400 && is_string($result['data'] ?? null)
|
||
? $result['data']
|
||
: 'Zurücksetzen fehlgeschlagen. Bitte Vorgang erneut starten.';
|
||
if ($result['status'] !== 400) {
|
||
$step = 'request';
|
||
}
|
||
}
|
||
}
|
||
}
|
||
?>
|
||
<!DOCTYPE html>
|
||
<html lang="de">
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||
<title>OMSORG Mitarbeiter-App – Passwort vergessen</title>
|
||
<link rel="stylesheet" href="../app.css">
|
||
</head>
|
||
<body>
|
||
|
||
<div class="login-page">
|
||
<div class="login-card glass">
|
||
<h2 style="font-family:'KindelSerif',Georgia,serif;font-size:1.5rem;margin:0 0 6px">Passwort vergessen</h2>
|
||
|
||
<?php if ($error): ?>
|
||
<div class="error" style="margin-bottom:16px"><?= e($error) ?></div>
|
||
<?php endif; ?>
|
||
|
||
<?php if ($step === 'request'): ?>
|
||
<p class="hint" style="margin:0 0 22px">Gib deinen Benutzernamen ein, wir senden dir einen Code per E-Mail.</p>
|
||
<form method="post">
|
||
<?= csrf_field() ?>
|
||
<input type="hidden" name="step" value="request">
|
||
<label>
|
||
Benutzername
|
||
<input type="text" name="username" autocomplete="username" required autofocus>
|
||
</label>
|
||
<button type="submit" class="btn" style="width:100%;margin-top:6px">Code anfordern</button>
|
||
</form>
|
||
|
||
<?php elseif ($step === 'verify'): ?>
|
||
<p class="hint" style="margin:0 0 22px">Gib den Code ein, den wir dir per E-Mail geschickt haben.</p>
|
||
<form method="post">
|
||
<?= csrf_field() ?>
|
||
<input type="hidden" name="step" value="verify">
|
||
<input type="hidden" name="username" value="<?= e($username ?? '') ?>">
|
||
<label>
|
||
Code
|
||
<input type="text" name="pin" inputmode="numeric" pattern="[0-9]*" maxlength="6" required autofocus>
|
||
</label>
|
||
<button type="submit" class="btn" style="width:100%;margin-top:6px">Code bestätigen</button>
|
||
</form>
|
||
|
||
<?php elseif ($step === 'reset'): ?>
|
||
<p class="hint" style="margin:0 0 22px">Lege dein neues Passwort fest.</p>
|
||
<form method="post">
|
||
<?= csrf_field() ?>
|
||
<input type="hidden" name="step" value="reset">
|
||
<input type="hidden" name="reset_token" value="<?= e($resetToken ?? '') ?>">
|
||
<label>
|
||
Neues Passwort
|
||
<input type="password" name="new_password" autocomplete="new-password" required minlength="<?= (int) $minLength ?>" autofocus>
|
||
</label>
|
||
<label>
|
||
Neues Passwort wiederholen
|
||
<input type="password" name="new_password_repeat" autocomplete="new-password" required minlength="<?= (int) $minLength ?>">
|
||
</label>
|
||
<button type="submit" class="btn" style="width:100%;margin-top:6px">Passwort setzen</button>
|
||
</form>
|
||
<?php endif; ?>
|
||
|
||
<p class="hint" style="text-align:center;margin-top:14px">
|
||
<a href="../index.php">Zurück zum Login</a>
|
||
</p>
|
||
</div>
|
||
</div>
|
||
|
||
</body>
|
||
</html>
|