0, 'path' => '/', 'domain' => COOKIE_DOMAIN, 'secure' => ($_inpay_is_https ?? (($_SERVER['HTTPS'] ?? '') === 'on')), 'httponly' => true, 'samesite' => COOKIE_DOMAIN === '' ? 'Lax' : 'None', ]); if (session_status() === PHP_SESSION_NONE) { session_start(); } include_once($_SERVER["DOCUMENT_ROOT"] . '/includes/db.php'); // ── Already logged in check ─────────────────────────────────── if (isset($_SESSION['user_id']) && isset($_SESSION['session_token'])) { $stmt = $conn->prepare("SELECT COUNT(*) FROM user_sessions WHERE user_id=? AND session_token=?"); $stmt->bind_param("is", $_SESSION['user_id'], $_SESSION['session_token']); $stmt->execute(); $stmt->bind_result($active_session); $stmt->fetch(); $stmt->close(); if ($active_session > 0) { header('Location: ' . BUSINESS_URL . '/'); exit; } else { session_unset(); session_destroy(); } } if (DEBUG_MODE) { ini_set('display_errors', 1); ini_set('display_startup_errors', 1); error_reporting(E_ALL); } // ── OAuth providerlar (DB-backed: oauth_providers jadvali, /admin/oauth_providers.php) ──── require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/oauth_providers.php'; require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/passkey_helpers.php'; $_SESSION['oauth_state'] = bin2hex(random_bytes(16)); $oauth_enabled_providers = []; foreach (oauth_providers_all(true) as $_op_key => $_op) { // Passkey is not an OAuth flow — surface it as its own button below. if ($_op_key === 'neoid') continue; // ← QO'SHING if ($_op_key === 'passkey') continue; $_op_url = oauth_build_authorize_url($_op_key, $_SESSION['oauth_state']); if ($_op_url === null) continue; // sozlanmagan yoki client_id bo'sh — yashiramiz $oauth_enabled_providers[$_op_key] = $_op + ['authorize_url' => $_op_url]; } unset($_op_key, $_op, $_op_url); $passkey_enabled = inpay_passkey_enabled($conn); /* ───────── Login chap panel reklamalari (admin/login_ads.php boshqaradi) ───────── * Faqat enabled=1 va vaqt oynasi ichidagilarni olamiz. Weighted shuffle: * har bir reklama o'z og'irligi qadar takrorlanadi → random_shuffle. Bu MySQL * ORDER BY RAND()'dan ko'ra deterministik va o'qiladi. */ $login_ads = []; $_now = date('Y-m-d H:i:s'); $_ads_stmt = @$conn->prepare("SELECT id, title, subtitle, cta_text, cta_url, media_type, media_path, bg_accent, weight FROM login_ads WHERE enabled=1 AND (start_at IS NULL OR start_at <= ?) AND (end_at IS NULL OR end_at >= ?) ORDER BY sort_order ASC, id DESC"); if ($_ads_stmt) { $_ads_stmt->bind_param('ss', $_now, $_now); $_ads_stmt->execute(); $_ads_res = $_ads_stmt->get_result(); $_pool = []; while ($_a = $_ads_res->fetch_assoc()) { $_w = max(1, (int)$_a['weight']); for ($i = 0; $i < $_w; $i++) $_pool[] = $_a; } $_ads_stmt->close(); if ($_pool) { shuffle($_pool); $_seen = []; foreach ($_pool as $_a) { if (isset($_seen[$_a['id']])) continue; $_seen[$_a['id']] = true; $login_ads[] = $_a; } if ($login_ads) { $_ids = array_map(fn($a)=>(int)$a['id'], $login_ads); $_in = implode(',', $_ids); @$conn->query("UPDATE login_ads SET views=views+1 WHERE id IN ($_in)"); } } unset($_pool, $_seen); } unset($_now, $_ads_stmt, $_ads_res, $_a, $_w, $_i); // ── QR token ────────────────────────────────────────────────── $qr_token = bin2hex(random_bytes(16)); $stmt = $conn->prepare("INSERT INTO login_tokens (token, created_at) VALUES (?, NOW())"); $stmt->bind_param("s", $qr_token); $stmt->execute(); $stmt->close(); $qr_url = "https://api.qrserver.com/v1/create-qr-code/?size=500x500&&data=" . urlencode($qr_token); function detect_device($ua) { if (preg_match('/(iPhone|iPod|iPad|Android|BlackBerry|IEMobile|Opera Mini)/i', $ua)) return "Mobile Device"; elseif (preg_match('/(Macintosh|Windows|Linux)/i', $ua)) return "Desktop/Laptop"; return "Unknown Device"; } function save_user_session($conn, $user_id) { $ip = $_SERVER['REMOTE_ADDR'] ?? ''; $ua = $_SERVER['HTTP_USER_AGENT'] ?? 'Unknown'; $device = detect_device($ua); $session_token = bin2hex(random_bytes(32)); $stmt = $conn->prepare("INSERT INTO user_sessions (user_id,device,user_agent,last_login,ip_address,session_token) VALUES (?,?,?,NOW(),?,?)"); $stmt->bind_param("issss", $user_id, $device, $ua, $ip, $session_token); $stmt->execute(); $stmt->close(); $_SESSION['session_token'] = $session_token; $stmt = $conn->prepare("DELETE FROM user_sessions WHERE user_id=? AND id NOT IN (SELECT id FROM (SELECT id FROM user_sessions WHERE user_id=? ORDER BY id DESC LIMIT 3) t)"); $stmt->bind_param("ii", $user_id, $user_id); $stmt->execute(); $stmt->close(); // Persistent auth cookie — keeps user signed in across browser restarts. if (function_exists('inpay_set_auth_cookie')) inpay_set_auth_cookie($session_token); } // ── POST handler ────────────────────────────────────────────── $error = null; if ($_SERVER['REQUEST_METHOD'] == 'POST' && !isset($_POST['neo_id_login'])) { // reCAPTCHA — faqat production'da tekshiriladi $recaptcha_ok = true; if (RECAPTCHA_ENABLED) { $recaptcha_response = $_POST['g-recaptcha-response'] ?? ''; $ctx = stream_context_create(['http'=>['method'=>'POST','header'=>"Content-Type: application/x-www-form-urlencoded\r\n", 'content'=>http_build_query(['secret'=>RECAPTCHA_SECRET_KEY,'response'=>$recaptcha_response,'remoteip'=>$_SERVER['REMOTE_ADDR']])]]); $rr = file_get_contents('https://www.google.com/recaptcha/api/siteverify', false, $ctx); $rj = json_decode($rr); $recaptcha_ok = !empty($rj->success); if (!$recaptcha_ok) $error = "reCAPTCHA tasdiqlanmadi!"; } if ($recaptcha_ok) { $username = $_POST['username'] ?? ''; $password = $_POST['password'] ?? ''; $stmt = $conn->prepare("SELECT * FROM users WHERE username=?"); $stmt->bind_param("s", $username); $stmt->execute(); $user = $stmt->get_result()->fetch_assoc(); $stmt->close(); if ($user && password_verify($password, $user['password'])) { if (!empty($user['two_factor_enabled']) && $user['two_factor_enabled'] == 1) { $_SESSION['2fa_user_id'] = $user['id']; $_SESSION['2fa_remember'] = ['role' => $user['role']]; header('Location: ' . BUSINESS_URL . '/login/2fa/'); exit; } $_SESSION['user_id'] = $user['id']; $_SESSION['role'] = $user['role']; save_user_session($conn, $_SESSION['user_id']); header('Location: ' . BUSINESS_URL . '/'); exit; } else { $error = "Login yoki parol noto'g'ri!"; } } } ?> <?php echo BRAND_NAME; ?> Business — Kirish
$ad): $accent = !empty($ad['bg_accent']) ? $ad['bg_accent'] : ''; ?> 1): ?>
$_): ?>

E-commerce
platformasi

Biznesingizni raqamli darajaga ko'taring va to'lovlarni oson, tez va xavfsiz boshqaring.

Xavfsiz tranzaksiyalar
Bank darajasidagi shifrlash va himoya
Tezkor integratsiya
5 daqiqada to'lovlarni qabul qiling
24/7 Qo'llab-quvvatlash
Har doim sizning yoningizda
Texnik yordam
Bosh sahifa
Tizimga kirish
Business platformasi
yoki
<?= htmlspecialchars($_p['display_name']) ?>

Akkountingiz yo'qmi?

Ro'yxatdan o'tish