admin/login.php

这里只显示每个文件的开头 60 行。登录后可以解锁完整代码。

微信扫码关注公众号，代码整理好后第一时间通知你。

<?php
require_once __DIR__ . '/../core/Session.php';
require_once __DIR__ . '/../core/Security.php';
require_once __DIR__ . '/../core/Logger.php';
require_once __DIR__ . '/../app/models/User.php';

Session::start();

$error = '';
$success = Session::getFlash('success');

if (Session::isLoggedIn()) {
    header('Location: index.php');
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    $csrfToken = $_POST['csrf_token'] ?? '';
    
    if (!Security::verifyCSRFToken($csrfToken)) {
        $error = '安全验证失败，请刷新页面重试';
    } elseif (empty($username) || empty($password)) {
        $error = '请输入用户名和密码';
    } else {
        $userModel = new User();
        $user = $userModel->authenticate($username, $password);
        
        if ($user) {
            if ($user['role'] !== 'admin' && $user['role'] !== 'editor') {
                $error = '您没有后台管理权限';
            } else {
                Session::setUser($user);
                Logger::userAction('admin_login', "管理员 {$username} 登录后台");
                header('Location: index.php');
                exit;
            }
        } else {
            $error = '用户名或密码错误';
            Logger::warning("后台登录失败: {$username}");
        }
    }
}

$csrfToken = Security::generateCSRFToken();
?>
<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>后台登录 - PHP个人博客系统</title>
    <link rel="stylesheet" href="../assets/css/admin.css">
</head>
<body class="login-page">
    <div class="login-container">
        <div class="login-box">
            <div class="login-header">
                <h1>PHP个人博客系统</h1>