|
Server : LiteSpeed System : Linux terra.hostitbro.com 5.14.0-611.54.3.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:31:24 EDT 2026 x86_64 User : outerorb ( 1091) PHP Version : 8.1.34 Disable Function : mail Directory : /home2/outerorb/emp.outerorbittech.in/ | |
|
Path: /home2/outerorb/emp.outerorbittech.in/index.php
Size: 8.74 KB
Permissions: 0666
<?php
require __DIR__ . '/includes/helpers.php';
// Already logged in? Redirect to appropriate dashboard.
if (is_admin()) {
header('Location: admin/dashboard.php');
exit;
}
if (is_employee()) {
header('Location: employee/dashboard.php');
exit;
}
$flash = flash();
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!isset($_POST['csrf_token']) || !verify_csrf($_POST['csrf_token'])) {
$error = 'Invalid session token. Please try again.';
} else {
$role = sanitize_text($_POST['role'] ?? '');
$phone = sanitize_text($_POST['phone'] ?? '');
$password = $_POST['password'] ?? '';
// Rate limiting: Check login attempts (5 per 5 minutes per IP/username)
$rateLimitKey = strtolower($phone) . '_' . $_SERVER['REMOTE_ADDR'];
if (!check_rate_limit($rateLimitKey, 5, 300)) {
$error = 'Too many login attempts. Please try again in 5 minutes.';
} elseif ($role === 'admin') {
// Admin login – phone/username field doubles as username
$admin = authenticate_admin($phone, $password);
if ($admin) {
clear_rate_limit($rateLimitKey);
// Check if 2FA is enabled
if ($admin['two_factor_enabled'] ?? false) {
$_SESSION['user_id_temp'] = $admin['id'];
$_SESSION['role_temp'] = 'admin';
$_SESSION['pending_session_data'] = $admin;
regenerate_session_id();
header('Location: 2fa-verify.php');
exit;
} else {
regenerate_session_id();
$_SESSION['admin_logged_in'] = true;
$_SESSION['admin'] = $admin;
header('Location: admin/dashboard.php');
exit;
}
}
$error = 'Invalid admin credentials.';
} elseif ($role === 'employee') {
ensure_employees_table();
$emp = authenticate_employee($phone, $password);
if ($emp) {
clear_rate_limit($rateLimitKey);
// Check if 2FA is enabled
if ($emp['two_factor_enabled'] ?? false) {
$_SESSION['user_id_temp'] = $emp['id'];
$_SESSION['role_temp'] = 'employee';
$_SESSION['pending_session_data'] = $emp;
regenerate_session_id();
header('Location: 2fa-verify.php');
exit;
} else {
regenerate_session_id();
$_SESSION['employee_logged_in'] = true;
$_SESSION['employee'] = $emp;
if ($emp['must_change_password']) {
redirect_with_message('employee/change_password.php', 'Please set a new password before continuing.', 'success');
}
header('Location: employee/dashboard.php');
exit;
}
}
$error = 'Invalid phone number or password. Make sure your account has been approved by HR.';
} else {
$error = 'Please select a login type.';
}
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Outer Orbit Technologies HRMS — Login</title>
<link rel="stylesheet" href="assets/css/style.css?v=<?php echo filemtime(__DIR__ . '/assets/css/style.css'); ?>" />
<link rel="stylesheet" href="assets/css/polish.css?v=<?php echo filemtime(__DIR__ . '/assets/css/polish.css'); ?>" />
<style>
.login-wrap { max-width: 440px; margin: 60px auto 0; }
.login-logo { text-align: center; margin-bottom: 28px; }
.login-logo h1 { font-size: 1.5rem; margin: 0 0 4px; color: #111827; }
.login-logo p { margin: 0; color: #6b7280; font-size: .875rem; }
.role-tabs { display: flex; gap: 0; margin-bottom: 24px; border: 1px solid #e5e7eb; border-radius: 8px; overflow: hidden; }
.role-tab { flex: 1; padding: 10px; text-align: center; cursor: pointer; background: #f9fafb; border: none; font-size: .9rem; font-weight: 600; color: #6b7280; transition: background .15s, color .15s; }
.role-tab.active { background: #1e3a5f; color: #fff; }
.login-footer { text-align: center; margin-top: 20px; font-size: .82rem; color: #6b7280; }
.login-footer a { color: #1e3a5f; text-decoration: none; }
.login-footer a:hover { text-decoration: underline; }
.input-label { display: block; font-size: .85rem; font-weight: 600; color: #374151; margin-bottom: 5px; }
</style>
</head>
<body style="background:#f3f4f6; min-height:100vh;">
<div class="login-wrap">
<div class="login-logo">
<img src="https://outerorbittech.com/assets/images/logo/logoforlightbg.png" alt="Outer Orbit Technologies" style="max-width:200px; height:auto; margin-bottom:8px;" />
<p>Human Resource Management System</p>
</div>
<div class="card">
<?php if ($flash): ?>
<div class="alert <?php echo $flash['type'] === 'error' ? 'alert-error' : 'alert-success'; ?>">
<?php echo htmlspecialchars($flash['message'], ENT_QUOTES, 'UTF-8'); ?>
</div>
<?php endif; ?>
<?php if ($error): ?>
<div class="alert alert-error"><?php echo htmlspecialchars($error, ENT_QUOTES, 'UTF-8'); ?></div>
<?php endif; ?>
<!-- Role tabs -->
<div class="role-tabs" id="role-tabs">
<button type="button" class="role-tab active" data-role="employee">Employee</button>
<button type="button" class="role-tab" data-role="admin">Admin</button>
</div>
<form method="post" action="index.php" novalidate>
<input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>" />
<input type="hidden" name="role" id="role-input" value="employee" />
<div style="display:flex; flex-direction:column; gap:16px;">
<div>
<label class="input-label" for="phone" id="phone-label">Phone Number</label>
<input id="phone" name="phone" type="text" required autocomplete="username"
placeholder="10-digit phone number"
style="width:100%; box-sizing:border-box;" />
</div>
<div>
<label class="input-label" for="password">Password</label>
<input id="password" name="password" type="password" required autocomplete="current-password"
style="width:100%; box-sizing:border-box;" />
<p id="employee-note" style="margin:8px 0 0; font-size:.8rem; color:#6b7280;">
<strong>Note:</strong> Employees can log in for the first time using their registered phone number as both the username and password.
</p>
</div>
<button type="submit" style="width:100%;" id="login-btn">Login as Employee</button>
</div>
</form>
</div>
<div class="login-footer">
New joiner? <a href="onboarding.php">Submit your onboarding form</a><br />
Have a document request code? <a href="upload_request.php">Upload documents</a>
</div>
</div>
<script>
(function () {
const tabs = document.querySelectorAll('.role-tab');
const roleInput = document.getElementById('role-input');
const phoneLabel = document.getElementById('phone-label');
const phoneInput = document.getElementById('phone');
const loginBtn = document.getElementById('login-btn');
const employeeNote = document.getElementById('employee-note');
tabs.forEach(function (tab) {
tab.addEventListener('click', function () {
tabs.forEach(function (t) { t.classList.remove('active'); });
tab.classList.add('active');
const role = tab.getAttribute('data-role');
roleInput.value = role;
if (role === 'admin') {
phoneLabel.textContent = 'Username';
phoneInput.placeholder = 'Admin username';
loginBtn.textContent = 'Login as Admin';
employeeNote.style.display = 'none';
} else {
phoneLabel.textContent = 'Phone Number';
phoneInput.placeholder = '10-digit phone number';
loginBtn.textContent = 'Login as Employee';
employeeNote.style.display = '';
}
});
});
})();
</script>
</body>
</html>