locked out for 15 min. $clientIp = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'] ?? 'unknown'; $clientIp = trim(explode(',', $clientIp)[0]); $rl = null; try { $rl = new Redis(); $rl->connect('127.0.0.1', 6379, 1.5); } catch (Throwable $e) { $rl = null; } // fail open if Redis is down $rlKey = 'login_fail:' . $clientIp; $RL_MAX = 10; $RL_WINDOW = 900; if ($_SERVER['REQUEST_METHOD'] === 'POST') { $fails = ($rl && $rl->exists($rlKey)) ? (int)$rl->get($rlKey) : 0; if ($fails >= $RL_MAX) { $error = 'TOO MANY ATTEMPTS — LOCKED'; } else { $u = trim($_POST['username'] ?? ''); $p = $_POST['password'] ?? ''; if ($u && $p) { $pdo = new PDO('mysql:host=' . DB_HOST . ';dbname=' . DB_NAME . ';charset=utf8mb4', DB_USER, DB_PASS, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]); $row = $pdo->prepare('SELECT * FROM users WHERE username=? LIMIT 1'); $row->execute([$u]); $user = $row->fetch(PDO::FETCH_ASSOC); if ($user && password_verify($p, $user['password_hash'])) { if ($rl) $rl->del($rlKey); session_regenerate_id(true); $token = bin2hex(random_bytes(32)); $_SESSION['jarvis_token'] = $token; $_SESSION['jarvis_user_id'] = $user['id']; $_SESSION['jarvis_name'] = $user['display_name']; $pdo->prepare('UPDATE users SET last_seen=NOW() WHERE id=?')->execute([$user['id']]); header('Location: /'); exit; } if ($rl) { $rl->incr($rlKey); $rl->expire($rlKey, $RL_WINDOW); } $error = 'ACCESS DENIED'; } else { $error = 'ENTER CREDENTIALS'; } } } ?> JARVIS

JARVIS

Just A Rather Very Intelligent System