70 lines
2.4 KiB
PHP
70 lines
2.4 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../core/Controller.php';
|
|
|
|
class ForgotPasswordController extends Controller {
|
|
public function index() {
|
|
if (isset($_SESSION['user_email'])) {
|
|
header('Location: ' . Config::get('BASE_URL', '/'));
|
|
exit;
|
|
}
|
|
|
|
$this->view('forgot_password', [
|
|
'title' => 'Passwort vergessen',
|
|
'submitted' => false
|
|
]);
|
|
}
|
|
|
|
public function submit() {
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
header('Location: ' . Config::get('BASE_URL', '/') . 'forgot-password');
|
|
exit;
|
|
}
|
|
|
|
try {
|
|
Security::checkCsrf($_POST['csrf_token'] ?? '');
|
|
|
|
// Simple rate limiting in session
|
|
$now = time();
|
|
$recentAttempts = $_SESSION['pwd_reset_attempts'] ?? [];
|
|
$recentAttempts = array_filter($recentAttempts, function($ts) use ($now) {
|
|
return ($now - $ts) < 600; // 10 minutes window
|
|
});
|
|
|
|
if (count($recentAttempts) >= 5) {
|
|
throw new Exception('Zu viele Anfragen in kurzer Zeit. Bitte warte einige Minuten, bevor du es erneut versuchst.');
|
|
}
|
|
|
|
$recentAttempts[] = $now;
|
|
$_SESSION['pwd_reset_attempts'] = $recentAttempts;
|
|
|
|
$email = trim(strtolower($_POST['email'] ?? ''));
|
|
|
|
if (!empty($email) && filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
|
$userModel = $this->model('User');
|
|
$user = $userModel->findByEmail($email);
|
|
|
|
if ($user && strtolower($user['status']) === 'active') {
|
|
require_once __DIR__ . '/../models/PasswordReset.php';
|
|
require_once __DIR__ . '/../services/MailService.php';
|
|
|
|
$pwdResetModel = new PasswordReset();
|
|
$token = $pwdResetModel->createToken($email, 1); // 1 hour validity
|
|
|
|
MailService::sendPasswordReset($email, $token);
|
|
}
|
|
}
|
|
|
|
$this->view('forgot_password', [
|
|
'title' => 'Anfrage gesendet',
|
|
'submitted' => true,
|
|
'email' => $email
|
|
]);
|
|
} catch (Exception $e) {
|
|
Flash::set($e->getMessage(), 'error');
|
|
$this->view('forgot_password', [
|
|
'title' => 'Passwort vergessen',
|
|
'submitted' => false
|
|
]);
|
|
}
|
|
}
|
|
}
|