<?php
/**
 * 芋头CMS
 * ============================================================================
 * 版权所有 2016-2028 沅陵县乌托邦网络服务有限公司，并保留所有权利。
 * 网站地址: http://www.yutoucms.cn
 * ----------------------------------------------------------------------------
 * 如果商业用途务必到官方购买正版授权, 以免引起不必要的法律纠纷.
 * ============================================================================
 * Author: 芋头 <mxgsf@qq.com>
 * Date: 2026-5-20
 */


require_once dirname(__DIR__) . '/core/lib/session.php';
cmsStartSession();
require_once dirname(__FILE__) . '/../core/db/db.php';
require_once dirname(__FILE__) . '/../core/lib/common.php';
require_once dirname(__FILE__) . '/../core/lib/login_security.php';

$redirect = trim($_GET['redirect'] ?? ($_POST['redirect'] ?? ''));
if ($redirect === '' || strpos($redirect, 'http://') === 0 || strpos($redirect, 'https://') === 0 || strpos($redirect, '//') === 0) {
    $redirect = '/member/index.php';
}

// 如果已登录，跳转到会员中心
if (isset($_SESSION['member_id']) && !empty($_SESSION['member_id'])) {
    header('Location: ' . $redirect);
    exit;
}

$error = '';

// 处理登录提交
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = trim($_POST['password'] ?? '');
    $loginToken = (string) ($_POST['login_token'] ?? '');
    $clientIp = cmsLoginClientIp();
    $securityDir = dirname(__DIR__) . '/data/cache/member-login-security';
    $loginLock = cmsGetLoginLock($username, $clientIp, $securityDir);
    
    if (empty($_SESSION['member_login_token']) || !hash_equals($_SESSION['member_login_token'], $loginToken)) {
        $error = '登录页面已失效，请刷新后重试';
    } elseif ($loginLock['locked']) {
        $minutes = max(1, (int) ceil($loginLock['retry_after'] / 60));
        $error = '登录尝试过于频繁，请在 ' . $minutes . ' 分钟后重试';
    } elseif (empty($username) || empty($password)) {
        $error = '请输入用户名和密码';
    } else {
        try {
            $db = \Core\Db\DB::getInstance();
            cmsRecordLoginFailure($username, $clientIp, $securityDir);
            
            $member = $db->fetch(
                "SELECT * FROM {$db->table('member')} WHERE username = ? AND is_enabled = 1 LIMIT 1",
                [$username]
            );
            
            if ($member) {
                // 验证密码
                if (password_verify($password, $member['password']) || md5($password) === $member['password']) {
                    // 登录成功
                    cmsClearLoginFailures($username, $clientIp, $securityDir);
                    session_regenerate_id(true);
                    $_SESSION['member_id'] = $member['id'];
                    $_SESSION['member_name'] = $member['username'];
                    $_SESSION['member_nickname'] = $member['nickname'];
                    $_SESSION['member_group_id'] = $member['group_id'];
                    
                    // 更新最后登录信息
                    $db->update('member', [
                        'last_login_time' => time(),
                        'last_login_ip' => $clientIp
                    ], 'id = ?', [$member['id']]);
                    
                    header('Location: ' . $redirect);
                    exit;
                } else {
                    $error = '密码错误';
                }
            } else {
                $error = '用户不存在或已被禁用';
            }
        } catch (Exception $e) {
            $error = '系统错误，请稍后再试';
        }
    }
}

function getClientIp() {
    $ip = '0.0.0.0';
    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        $ip = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0];
    } elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
        $ip = $_SERVER['HTTP_CLIENT_IP'];
    } elseif (isset($_SERVER['REMOTE_ADDR'])) {
        $ip = $_SERVER['REMOTE_ADDR'];
    }
    return $ip;
}
$_SESSION['member_login_token'] = bin2hex(random_bytes(32));
?>
<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>会员登录 - 企业CMS</title>
    <link rel="stylesheet" href="/public/css/site.css">
    <style>
    body { background: linear-gradient(135deg, #0d3b66 0%, #1a5f8a 100%); }
    .member-login { min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px; }
    .login-box { background: #fff; border-radius: 12px; padding: 40px; width: 100%; max-width: 400px; box-shadow: 0 10px 40px rgba(0,0,0,0.2); }
    .login-header { text-align: center; margin-bottom: 30px; }
    .login-header h1 { font-size: 24px; color: #0d3b66; margin-bottom: 5px; }
    .login-header p { color: #888; font-size: 13px; }
    .login-form .form-group { margin-bottom: 20px; }
    .login-form label { display: block; margin-bottom: 8px; color: #333; font-weight: 500; }
    .login-form input { width: 100%; padding: 12px 15px; border: 1px solid #ddd; border-radius: 6px; font-size: 14px; }
    .login-form input:focus { outline: none; border-color: #00d2d3; }
    .error-message { background: #f8d7da; color: #721c24; padding: 12px 15px; border-radius: 6px; margin-bottom: 20px; font-size: 13px; }
    .btn-login { width: 100%; padding: 14px; background: linear-gradient(135deg, #00d2d3, #007991); color: #fff; border: none; border-radius: 6px; font-size: 16px; cursor: pointer; transition: background 0.3s; }
    .btn-login:hover { background: linear-gradient(135deg, #00b8b9, #006070); }
    .login-footer { margin-top: 20px; text-align: center; font-size: 13px; color: #999; }
    .login-footer a { color: #00d2d3; text-decoration: none; margin: 0 10px; }
    </style>
</head>
<body>
    <div class="member-login">
        <div class="login-box">
            <div class="login-header">
                <h1>会员登录</h1>
                <p>欢迎访问企业CMS会员中心</p>
            </div>
            
            <?php if ($error): ?>
            <div class="error-message"><?php echo htmlspecialchars($error); ?></div>
            <?php endif; ?>
            
            <form method="post" class="login-form">
                <input type="hidden" name="login_token" value="<?php echo htmlspecialchars($_SESSION['member_login_token']); ?>">
                <input type="hidden" name="redirect" value="<?php echo htmlspecialchars($redirect); ?>">
                <div class="form-group">
                    <label>用户名</label>
                    <input type="text" name="username" placeholder="请输入用户名" required>
                </div>
                
                <div class="form-group">
                    <label>密码</label>
                    <input type="password" name="password" placeholder="请输入密码" required>
                </div>
                
                <button type="submit" class="btn-login">登 录</button>
            </form>
            
            <div class="login-footer">
                <a href="/member/register.php">立即注册</a>
                <a href="/">返回首页</a>
            </div>
        </div>
    </div>
</body>
</html>
