chore: version inicial del codigo fuente del LMS Estafeta

2026-10-02 20:33:12 -06:00
commit c8bb6b97b9
1572 changed files with 457520 additions and 0 deletions
@@ -0,0 +1,98 @@
+<?php
+require_once('../config.php');
+require_once ('mencrypt.php');
+session_name($CFG->sessionname);
+session_start();
+global $link;
+dbConnect();
+
+// Check connection
+if (!$link) {
+    die("Connection failed: " . mysqli_connect_error());
+}
+
+$numerodeempleado = isset($_POST['numempl']) ? trim($_POST['numempl']) : '';
+
+// Límite de intentos por IP (mitiga enumeración / fuerza bruta)
+function lms_rate_limit($key, $max = 60, $window = 600) {
+    $file = sys_get_temp_dir() . '/lms_rl_' . md5($key);
+    $now = time();
+    $data = array();
+    if (is_file($file)) {
+        $tmp = json_decode(@file_get_contents($file), true);
+        if (is_array($tmp)) { $data = $tmp; }
+    }
+    $data = array_values(array_filter($data, function ($t) use ($now, $window) {
+        return $t > $now - $window;
+    }));
+    if (count($data) >= $max) { return false; }
+    $data[] = $now;
+    @file_put_contents($file, json_encode($data), LOCK_EX);
+    return true;
+}
+
+$userip = getUserIP();
+if (!lms_rate_limit('login_' . $userip)) {
+    header("Location:".$CFG->wwwroot.'?errorcode=0');
+    exit;
+}
+
+// Buscar usuario (consulta preparada)
+$stmt = mysqli_prepare($link, "select * from user where numempl = ? and habilitado = 1 limit 1");
+mysqli_stmt_bind_param($stmt, 's', $numerodeempleado);
+mysqli_stmt_execute($stmt);
+$result = mysqli_stmt_get_result($stmt);
+$user = $result ? mysqli_fetch_array($result) : null;
+mysqli_stmt_close($stmt);
+
+if (!$user) {
+    header("Location:".$CFG->wwwroot.'?errorcode=0');
+    exit;
+}
+
+// Actualizar último acceso (consulta preparada)
+$stmt = mysqli_prepare($link, "update user set lastip = ?, lastlogin = NOW() where numempl = ?");
+mysqli_stmt_bind_param($stmt, 'ss', $userip, $numerodeempleado);
+mysqli_stmt_execute($stmt);
+mysqli_stmt_close($stmt);
+
+// Evitar fijación de sesión
+session_regenerate_id(true);
+
+$_SESSION['usersession'] = json_encode($user, JSON_UNESCAPED_UNICODE);
+$_SESSION['numerodeempleado'] = $numerodeempleado;
+
+$url_encriptado = $encriptar($numerodeempleado);
+if ($user['idrol'] == 1) {
+    $_SESSION['isadmin'] = false;
+    $vars = "../dashboard.php?uniq=".urlencode($url_encriptado);
+    header('Location: '.$vars);
+    exit;
+} else {
+    $_SESSION['isadmin'] = true;
+    header('Location: ../admin/');
+    exit;
+}
+
+function getUserIP() {
+    $ipaddress = '';
+    if (isset($_SERVER['HTTP_CLIENT_IP']))
+        $ipaddress = $_SERVER['HTTP_CLIENT_IP'];
+    else if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
+        $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR'];
+    else if(isset($_SERVER['HTTP_X_FORWARDED']))
+        $ipaddress = $_SERVER['HTTP_X_FORWARDED'];
+    else if(isset($_SERVER['HTTP_X_CLUSTER_CLIENT_IP']))
+        $ipaddress = $_SERVER['HTTP_X_CLUSTER_CLIENT_IP'];
+    else if(isset($_SERVER['HTTP_FORWARDED_FOR']))
+        $ipaddress = $_SERVER['HTTP_FORWARDED_FOR'];
+    else if(isset($_SERVER['HTTP_FORWARDED']))
+        $ipaddress = $_SERVER['HTTP_FORWARDED'];
+    else if(isset($_SERVER['REMOTE_ADDR']))
+        $ipaddress = $_SERVER['REMOTE_ADDR'];
+    else
+        $ipaddress = 'UNKNOWN';
+    return substr($ipaddress, 0, 100);
+}
+
+?>