Add documentation and database connection test script
Co-authored-by: iaretechnician <2749183+iaretechnician@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
parent
a7bb9d5b31
commit
068bcdfcc4
2 changed files with 260 additions and 0 deletions
109
_website/README_LOGIN.md
Normal file
109
_website/README_LOGIN.md
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
# Website Login Implementation
|
||||
|
||||
## Overview
|
||||
This implementation adds login functionality to the website that authenticates users against the panel's database (ogp_users table) while maintaining separate sessions for the website and panel.
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
### 1. `_website/login.php` (NEW)
|
||||
- Full-featured login page with modern UI
|
||||
- Authenticates against panel DB using MD5 password hashing (panel-compatible)
|
||||
- Creates separate website session using `gameservers_website` session name
|
||||
- Logs all login attempts via logger() function
|
||||
- Session variables set:
|
||||
- `$_SESSION['website_user_id']` - User ID from ogp_users
|
||||
- `$_SESSION['website_username']` - Username
|
||||
- `$_SESSION['website_user_role']` - User role (admin, user, etc.)
|
||||
- `$_SESSION['website_user_email']` - User email
|
||||
- `$_SESSION['website_login_time']` - Timestamp of login
|
||||
|
||||
### 2. `_website/logout.php` (NEW)
|
||||
- Cleanly destroys website session
|
||||
- Logs logout events
|
||||
- Redirects to homepage after logout
|
||||
- Properly clears session cookies
|
||||
|
||||
### 3. `_website/index.php` (MODIFIED)
|
||||
- Added session management at the top
|
||||
- Added header with Login/Logout button and user greeting
|
||||
- Shows "Welcome, [username]!" when logged in
|
||||
- Maintains same visual design with added header
|
||||
|
||||
## Session Management
|
||||
|
||||
### Separate Sessions
|
||||
- **Website Session**: `gameservers_website` (this implementation)
|
||||
- **Panel Session**: `opengamepanel_web` (existing panel)
|
||||
|
||||
These sessions are completely separate - users can be logged into one without being logged into the other.
|
||||
|
||||
## Security Features
|
||||
|
||||
1. **SQL Injection Prevention**: Uses `mysqli_real_escape_string()` for input sanitization
|
||||
2. **Password Hashing**: Compatible with panel's MD5 hashing (legacy but matches panel)
|
||||
3. **Session Isolation**: Separate session name prevents conflicts with panel
|
||||
4. **XSS Prevention**: Uses `htmlspecialchars()` for output escaping
|
||||
5. **Logging**: All login/logout events are logged via logger() function
|
||||
|
||||
## Database Requirements
|
||||
|
||||
Requires connection to panel database with access to:
|
||||
- `ogp_users` table (fields: user_id, users_login, users_passwd, users_role, users_email)
|
||||
- Connection configured in `db.php`
|
||||
|
||||
## Usage
|
||||
|
||||
### For Users:
|
||||
1. Visit `_website/login.php` to login
|
||||
2. Enter panel credentials (username/password)
|
||||
3. After successful login, redirected to homepage with session active
|
||||
4. Click "Logout" button to end session
|
||||
|
||||
### For Developers:
|
||||
Check if user is logged in:
|
||||
```php
|
||||
session_name("gameservers_website");
|
||||
session_start();
|
||||
|
||||
if (isset($_SESSION['website_user_id']) && !empty($_SESSION['website_user_id'])) {
|
||||
// User is logged in
|
||||
$username = $_SESSION['website_username'];
|
||||
$user_id = $_SESSION['website_user_id'];
|
||||
$user_role = $_SESSION['website_user_role'];
|
||||
}
|
||||
```
|
||||
|
||||
## Future Enhancements (Optional)
|
||||
|
||||
1. **Password Hashing Upgrade**: Implement modern bcrypt/argon2 with transparent upgrade on login
|
||||
2. **CSRF Protection**: Add CSRF tokens to login form
|
||||
3. **Rate Limiting**: Add IP-based login attempt limiting (similar to panel's ban_list)
|
||||
4. **Remember Me**: Add persistent login cookie option
|
||||
5. **Password Reset**: Integrate with panel's password reset flow
|
||||
6. **Two-Factor Auth**: Optional 2FA for enhanced security
|
||||
|
||||
## Testing
|
||||
|
||||
All files pass PHP syntax validation:
|
||||
```bash
|
||||
php -l _website/index.php
|
||||
php -l _website/login.php
|
||||
php -l _website/logout.php
|
||||
```
|
||||
|
||||
## Alignment with Copilot Instructions
|
||||
|
||||
This implementation follows the no-code planning guidelines from `.github/copilot-instructions.md`:
|
||||
|
||||
✅ Website uses panel DB for authentication
|
||||
✅ Sessions remain separate (website ≠ panel)
|
||||
✅ Auth compatibility maintained (MD5 hash for panel users)
|
||||
✅ Minimal changes to existing code
|
||||
✅ Repository-first approach (reused existing db.php, logger function)
|
||||
✅ Security considerations (SQL injection prevention, session isolation)
|
||||
|
||||
## Notes
|
||||
|
||||
- Login credentials are the same as panel login (same user table)
|
||||
- Website session does not grant access to panel - separate login required
|
||||
- Logger function from db.php creates logfile.txt for audit trail
|
||||
151
_website/test_db_connection.php
Normal file
151
_website/test_db_connection.php
Normal file
|
|
@ -0,0 +1,151 @@
|
|||
<?php
|
||||
/**
|
||||
* Database Connection Test Script
|
||||
*
|
||||
* This script tests the database connection and queries the ogp_users table
|
||||
* to verify the login functionality will work correctly.
|
||||
*
|
||||
* ⚠️ SECURITY WARNING: Delete this file after testing!
|
||||
* This file exposes sensitive database information and should not be
|
||||
* accessible in production.
|
||||
*/
|
||||
|
||||
// Include database connection
|
||||
require_once('db.php');
|
||||
|
||||
echo "<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Database Connection Test</title>
|
||||
<style>
|
||||
body { font-family: monospace; padding: 20px; background: #f5f5f5; }
|
||||
.success { color: green; font-weight: bold; }
|
||||
.error { color: red; font-weight: bold; }
|
||||
.info { color: blue; }
|
||||
.section { background: white; padding: 15px; margin: 10px 0; border-radius: 5px; }
|
||||
pre { background: #eee; padding: 10px; border-radius: 3px; overflow-x: auto; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Database Connection Test</h1>
|
||||
<p class='error'>⚠️ WARNING: Delete this file after testing!</p>
|
||||
";
|
||||
|
||||
// Test 1: Check database connection
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Test 1: Database Connection</h2>";
|
||||
if ($db && mysqli_ping($db)) {
|
||||
echo "<p class='success'>✓ Database connection successful!</p>";
|
||||
echo "<p class='info'>Connected to database</p>";
|
||||
} else {
|
||||
echo "<p class='error'>✗ Database connection failed!</p>";
|
||||
if ($db) {
|
||||
echo "<p class='error'>Error: " . mysqli_connect_error() . "</p>";
|
||||
}
|
||||
echo "</div></body></html>";
|
||||
exit();
|
||||
}
|
||||
echo "</div>";
|
||||
|
||||
// Test 2: Check if ogp_users table exists
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Test 2: Check ogp_users Table</h2>";
|
||||
$result = mysqli_query($db, "SHOW TABLES LIKE 'ogp_users'");
|
||||
if ($result && mysqli_num_rows($result) > 0) {
|
||||
echo "<p class='success'>✓ ogp_users table exists!</p>";
|
||||
} else {
|
||||
echo "<p class='error'>✗ ogp_users table not found!</p>";
|
||||
echo "</div></body></html>";
|
||||
exit();
|
||||
}
|
||||
echo "</div>";
|
||||
|
||||
// Test 3: Check table structure
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Test 3: Table Structure</h2>";
|
||||
$result = mysqli_query($db, "DESCRIBE ogp_users");
|
||||
if ($result) {
|
||||
echo "<p class='success'>✓ Table structure retrieved</p>";
|
||||
echo "<p>Columns:</p><pre>";
|
||||
while ($row = mysqli_fetch_assoc($result)) {
|
||||
echo $row['Field'] . " (" . $row['Type'] . ")\n";
|
||||
}
|
||||
echo "</pre>";
|
||||
} else {
|
||||
echo "<p class='error'>✗ Failed to retrieve table structure</p>";
|
||||
}
|
||||
echo "</div>";
|
||||
|
||||
// Test 4: Count users
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Test 4: User Count</h2>";
|
||||
$result = mysqli_query($db, "SELECT COUNT(*) as count FROM ogp_users");
|
||||
if ($result) {
|
||||
$row = mysqli_fetch_assoc($result);
|
||||
echo "<p class='success'>✓ Total users in database: " . $row['count'] . "</p>";
|
||||
} else {
|
||||
echo "<p class='error'>✗ Failed to count users</p>";
|
||||
}
|
||||
echo "</div>";
|
||||
|
||||
// Test 5: Check required columns
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Test 5: Required Columns Check</h2>";
|
||||
$required_columns = ['user_id', 'users_login', 'users_passwd', 'users_role', 'users_email'];
|
||||
$result = mysqli_query($db, "SHOW COLUMNS FROM ogp_users");
|
||||
$existing_columns = [];
|
||||
while ($row = mysqli_fetch_assoc($result)) {
|
||||
$existing_columns[] = $row['Field'];
|
||||
}
|
||||
|
||||
$all_present = true;
|
||||
foreach ($required_columns as $col) {
|
||||
if (in_array($col, $existing_columns)) {
|
||||
echo "<p class='success'>✓ Column '$col' exists</p>";
|
||||
} else {
|
||||
echo "<p class='error'>✗ Column '$col' missing!</p>";
|
||||
$all_present = false;
|
||||
}
|
||||
}
|
||||
|
||||
if ($all_present) {
|
||||
echo "<p class='success'><strong>All required columns present!</strong></p>";
|
||||
} else {
|
||||
echo "<p class='error'><strong>Some required columns are missing!</strong></p>";
|
||||
}
|
||||
echo "</div>";
|
||||
|
||||
// Test 6: Test MD5 hash function
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Test 6: Password Hashing Test</h2>";
|
||||
$test_password = "testpassword";
|
||||
$hashed = md5($test_password);
|
||||
echo "<p class='info'>Test password: '$test_password'</p>";
|
||||
echo "<p class='info'>MD5 hash: '$hashed'</p>";
|
||||
echo "<p class='success'>✓ MD5 hashing works correctly</p>";
|
||||
echo "</div>";
|
||||
|
||||
// Test 7: Test session functionality
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Test 7: Session Test</h2>";
|
||||
session_name("gameservers_website");
|
||||
session_start();
|
||||
$_SESSION['test_key'] = 'test_value';
|
||||
if (isset($_SESSION['test_key']) && $_SESSION['test_key'] === 'test_value') {
|
||||
echo "<p class='success'>✓ Sessions working correctly</p>";
|
||||
echo "<p class='info'>Session name: " . session_name() . "</p>";
|
||||
echo "<p class='info'>Session ID: " . session_id() . "</p>";
|
||||
unset($_SESSION['test_key']);
|
||||
} else {
|
||||
echo "<p class='error'>✗ Session test failed</p>";
|
||||
}
|
||||
echo "</div>";
|
||||
|
||||
echo "<div class='section'>";
|
||||
echo "<h2>Summary</h2>";
|
||||
echo "<p class='success'><strong>✓ All tests passed! Login functionality should work correctly.</strong></p>";
|
||||
echo "<p class='error'><strong>⚠️ Remember to delete this test file before deploying to production!</strong></p>";
|
||||
echo "</div>";
|
||||
|
||||
echo "</body></html>";
|
||||
?>
|
||||
Loading…
Add table
Add a link
Reference in a new issue