dasposchi-de/admin/login.php

<?php
require_once __DIR__ . '/../core/auth.php';
auth_start_session();

if (auth_is_logged_in()) {
    redirect('/admin/');
}

$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();

    if (!auth_check_rate_limit()) {
        $error = 'Zu viele Anmeldeversuche. Bitte warte einige Minuten.';
    } else {
        $username = trim($_POST['username'] ?? '');
        $password = $_POST['password'] ?? '';

        if ($username === '' || $password === '') {
            $error = 'Bitte Benutzername und Passwort eingeben.';
        } elseif (auth_login($username, $password)) {
            redirect('/admin/');
        } else {
            $error = 'Ungültiger Benutzername oder Passwort.';
        }
    }
}

$pageTitle = 'Anmelden';
ob_start();
?>
<form method="post" class="login-form">
    <?= csrf_field() ?>
    <?php if ($error): ?>
        <div class="flash flash-error"><?= e($error) ?></div>
    <?php endif; ?>
    <div class="form-group">
        <label for="username">Benutzername</label>
        <input type="text" id="username" name="username" required autofocus
               value="<?= e($_POST['username'] ?? '') ?>">
    </div>
    <div class="form-group">
        <label for="password">Passwort</label>
        <input type="password" id="password" name="password" required>
    </div>
    <button type="submit" class="btn btn-primary btn-block">Anmelden</button>
</form>
<?php
$content = ob_get_clean();
include __DIR__ . '/templates/login-layout.php';