true,
'samesite' => 'Lax',
'secure' => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off',
]);
session_start();
if (!empty($_SESSION['uid'])) {
header('Location: index.php');
exit;
}
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
$rateFile = sys_get_temp_dir() . '/mail_login_' . md5($ip);
$attempts = file_exists($rateFile) ? (int)file_get_contents($rateFile) : 0;
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if ($attempts >= 5) {
$error = '尝试次数过多，请 15 分钟后再试';
} else {
$username = trim($_POST['username'] ?? '');
$password = $_POST['password'] ?? '';
$db = new PDO('sqlite:' . __DIR__ . '/data/users.db');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $db->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user && password_verify($password, $user['password_hash'])) {
@unlink($rateFile);
session_regenerate_id(true);
$_SESSION['uid'] = $user['id'];
$_SESSION['username'] = $user['username'];
$_SESSION['last'] = time();
header('Location: index.php');
exit;
} else {
file_put_contents($rateFile, $attempts + 1);
$error = '用户名或密码错误';
}
}
}
?>
登录 - 邮件管理