Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/DanielRivera03/SistemaBancario/llms.txt

Use this file to discover all available pages before exploring further.

CashMan H.A. handles all user authentication through a single front controller, controlador/cIniciosSesionesUsuarios.php, which uses a ?cashmanha= query parameter to dispatch between login, session validation, and password-recovery routes. Credentials are verified against the database via the IniciarSesionUsuarios() stored procedure, and on success the controller populates PHP session variables and redirects each user to their role-specific dashboard.

Login Flow

1

Visit the login page

The user navigates to the application root (index.php) or directly to:
controlador/cIniciosSesionesUsuarios.php?cashmanha=iniciarsesion
Both resolve to the same login view. If no cashmanha parameter is present in the URL, the controller defaults to "iniciarsesion" automatically.
2

Submit credentials via POST

The login form POSTs the fields val-username and val-password (plus an optional recordar checkbox) to:
controlador/cIniciosSesionesUsuarios.php?cashmanha=validar-sesiones
3

Password hashing and credential lookup

The controller first computes a SHA1 digest of the submitted password, then passes that digest as both the data and the salt argument to crypt(). The escaped username and the resulting hash are passed to IniciarSesionUsuarios(). If the SHA1 digest is empty (i.e., no password was submitted), the request is immediately rejected and the user is redirected back to the login page.
4

Session population and role-based redirect

When IniciarSesionUsuarios() returns a matching row, the controller stores all user fields in $_SESSION and immediately redirects the user to their role-specific dashboard inside cGestionesCashman.php. See the Role-Based Redirect table below for the full mapping.
5

Failed login

If no matching row is returned, the user is sent to the error page:
controlador/cIniciosSesionesUsuarios.php?cashmanha=credenciales-incorrectas

Password Hashing

CashMan H.A. hashes passwords in two steps: it first computes a SHA1 digest of the raw password, then passes the connection-escaped raw password as the data and the SHA1 digest as the salt to PHP’s crypt() function. The same two-step process is used at registration and at every login attempt, so the stored hash and the computed hash always match.
$cifrado    = sha1($_POST['val-password']);
$Contrasenia = crypt($conectarsistema->real_escape_string($_POST['val-password']), $cifrado);
SHA1 + crypt() is the hashing scheme used throughout this codebase. SHA1 is no longer considered cryptographically secure, and the crypt() function is deprecated in modern PHP. For any new deployment that builds on this codebase, replace this pattern with PHP’s native password_hash() using the PASSWORD_BCRYPT or PASSWORD_ARGON2ID algorithm, and verify passwords with password_verify().
If the user checks the Remember Me checkbox (recordar) before submitting, the controller sets a persistent cookie named val-username that stores the submitted username for 30 days:
setcookie("val-username", $_POST['val-username'], time() + 60 * 60 * 24 * 30, "/");
The / path argument makes the cookie available across the entire application. On the next visit, the login form can read this cookie to pre-fill the username field.

Role-Based Redirect

After a successful login, the controller reads the idrol column from the returned row and redirects to the corresponding dashboard route in cGestionesCashman.php:
Role IDRoleRedirect Route
1Administrador?cashmanhagestion=inicioadministradores
2Presidencia?cashmanhagestion=iniciopresidencia
3Gerencia?cashmanhagestion=iniciogerencia
4Atención al Cliente?cashmanhagestion=inicioatencionclientes
5Clientes?cashmanhagestion=inicioclientes

Login Access Logging

Every successful authentication triggers a call to RegistrarAccesosUsuarios(), which inserts an audit record into the database. The record includes the authenticated user’s ID alongside two values derived from php_uname():
  • device_name — the network hostname of the server, obtained via php_uname('n')
  • operating_system — the OS name of the server, obtained via php_uname('s')
This creates a log of every login event for security auditing and compliance purposes.

Build docs developers (and LLMs) love