100 lines
4.8 KiB
PHP
100 lines
4.8 KiB
PHP
<?php
|
||
declare(strict_types=1);
|
||
|
||
require_once __DIR__ . '/includes/bootstrap.php';
|
||
pnpaas_session_start();
|
||
|
||
$token = trim((string)($_GET['token'] ?? $_POST['token'] ?? ''));
|
||
$csrfToken = pnpaas_csrf_token();
|
||
$error = null;
|
||
$success = null;
|
||
$validToken = false;
|
||
|
||
if (!preg_match('/^[a-f0-9]{64}$/', $token)) {
|
||
$error = 'Dieser Aktivierungslink ist ungültig oder abgelaufen.';
|
||
} else {
|
||
try {
|
||
$check = pnpaas_db()->prepare(
|
||
'SELECT t.id, t.user_id
|
||
FROM account_activation_tokens t
|
||
JOIN users u ON u.id = t.user_id
|
||
WHERE t.token_hash = :token_hash AND t.used_at IS NULL
|
||
AND t.expires_at > NOW() AND u.status = "pending"
|
||
LIMIT 1'
|
||
);
|
||
$check->execute(['token_hash' => hash('sha256', $token)]);
|
||
$validToken = is_array($check->fetch());
|
||
if (!$validToken) $error = 'Dieser Aktivierungslink ist ungültig oder abgelaufen.';
|
||
} catch (Throwable $exception) {
|
||
error_log('PnPaaS activation validation error: ' . $exception->getMessage());
|
||
$error = 'Der Aktivierungslink ist derzeit nicht verfügbar.';
|
||
}
|
||
}
|
||
|
||
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $error === null) {
|
||
if (!pnpaas_valid_csrf((string)($_POST['csrf_token'] ?? ''))) {
|
||
$error = 'Die Sitzung ist abgelaufen. Bitte öffnen Sie den Aktivierungslink erneut.';
|
||
} else {
|
||
try {
|
||
$db = pnpaas_db();
|
||
$db->beginTransaction();
|
||
$find = $db->prepare(
|
||
'SELECT t.id, t.user_id
|
||
FROM account_activation_tokens t
|
||
JOIN users u ON u.id = t.user_id
|
||
WHERE t.token_hash = :token_hash AND t.used_at IS NULL
|
||
AND t.expires_at > NOW() AND u.status = "pending"
|
||
LIMIT 1 FOR UPDATE'
|
||
);
|
||
$find->execute(['token_hash' => hash('sha256', $token)]);
|
||
$activation = $find->fetch();
|
||
if (!is_array($activation)) {
|
||
$db->rollBack();
|
||
$validToken = false;
|
||
$error = 'Dieser Aktivierungslink ist ungültig oder abgelaufen.';
|
||
} else {
|
||
$updateUser = $db->prepare('UPDATE users SET status = "active" WHERE id = :user_id AND status = "pending"');
|
||
$updateUser->execute(['user_id' => (int)$activation['user_id']]);
|
||
$used = $db->prepare('UPDATE account_activation_tokens SET used_at = NOW() WHERE id = :id');
|
||
$used->execute(['id' => (int)$activation['id']]);
|
||
$db->commit();
|
||
$validToken = false;
|
||
$success = 'Ihr Konto wurde aktiviert. Sie können sich jetzt anmelden.';
|
||
}
|
||
} catch (Throwable $exception) {
|
||
if (isset($db) && $db->inTransaction()) $db->rollBack();
|
||
error_log('PnPaaS account activation error: ' . $exception->getMessage());
|
||
$error = 'Das Konto konnte nicht aktiviert werden. Bitte versuchen Sie es erneut.';
|
||
}
|
||
}
|
||
}
|
||
?>
|
||
<!doctype html>
|
||
<html lang="de">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
<title>PnPaaS – Konto aktivieren</title>
|
||
<link rel="preconnect" href="https://fonts.googleapis.com">
|
||
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
|
||
<link href="https://fonts.googleapis.com/css2?family=Montserrat:wght@500;600&family=Open+Sans:wght@400;600;700&display=swap" rel="stylesheet">
|
||
<link rel="stylesheet" href="assets/style.css">
|
||
</head>
|
||
<body class="auth-page">
|
||
<main class="auth-card" aria-labelledby="activation-title">
|
||
<div class="brand-mark" aria-hidden="true">✦</div>
|
||
<p class="eyebrow">PnPaaS</p>
|
||
<h1 id="activation-title">Konto aktivieren</h1>
|
||
<?php if ($error !== null): ?><div class="alert alert-error" role="alert"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div><?php endif; ?>
|
||
<?php if ($success !== null): ?><div class="alert alert-success" role="status"><?= htmlspecialchars($success, ENT_QUOTES, 'UTF-8') ?></div><p class="form-footer"><a href="index.php">Zur Anmeldung</a></p><?php elseif ($validToken): ?>
|
||
<p class="intro">Bestätigen Sie die Aktivierung Ihres PnPaaS-Kontos.</p>
|
||
<form method="post" action="activate-account.php?token=<?= htmlspecialchars($token, ENT_QUOTES, 'UTF-8') ?>" class="login-form">
|
||
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES, 'UTF-8') ?>">
|
||
<input type="hidden" name="token" value="<?= htmlspecialchars($token, ENT_QUOTES, 'UTF-8') ?>">
|
||
<button type="submit">Konto aktivieren</button>
|
||
</form>
|
||
<?php else: ?><p class="form-footer"><a href="register.php">Neu registrieren</a> · <a href="index.php">Zur Anmeldung</a></p><?php endif; ?>
|
||
</main>
|
||
</body>
|
||
</html>
|