Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/DanielRivera03/SistemaBancario/llms.txt

Use this file to discover all available pages before exploring further.

CashMan H.A. provides a self-service password recovery mechanism that does not expose the existing password. Instead, when a user requests recovery, the system generates a one-time 5-digit numeric code and a 10-character hex token, delivers them to the user’s registered email address via PHPMailer, and then requires the user to prove possession of the email before allowing a password reset. The code is valid for 6 minutes, after which the session is expired and the user must restart the process.

​
Recovery Flow

1

Visit the Forgot Password page

The user clicks the “Forgot Password” link on the login screen, which navigates to:
controlador/cIniciosSesionesUsuarios.php?cashmanha=reestablecer-contrasena
This route renders the forgot-password form where the user enters their registered email address.
2

Submit email address

The form POSTs to ?cashmanha=recuperar-cuentas. The controller reads $_POST['val-email'] as the recovery destination.
3

Code and token generation

The controller generates two values automatically:
  • A 5-digit numeric code using rand(10000, 99999)
  • A 10-character hex token using bin2hex(random_bytes(5))
Both values are stored in session and in the recuperacion database table before the email is sent.
4

PHPMailer sends the recovery email

An HTML email is sent to the user’s address from sistemas@cashmanha.com. The email body contains:
  • The 5-digit code rendered in a prominently styled block
  • A “Change Password” button linking to:
?cashmanha=codigo-seguridad-recuperacion&token=<TOKEN>
The email also instructs the user that the code expires in 6 minutes and that the recovery process must be completed on the same device where it was initiated.
5

Session state is initialized

After a successful email dispatch, the following session variables are written:
KeyValue
$_SESSION['TokenUsuarios']The generated hex token
$_SESSION['CorreoUsuarios']The submitted email address
$_SESSION['CodigoUsuarios']The generated 5-digit code
$_SESSION['EstadoCodigos']"BloquearCodigoAcceso"
The BloquearCodigoAcceso state prevents a user from accessing the new-password form by navigating directly to the token URL without first entering the code.
6

User enters the security code

The user opens ?cashmanha=codigo-seguridad-recuperacion (or clicks the email button) and types their 5-digit code. On a correct match, the route ?cashmanha=cambio-estado-token is called, which upgrades the session state:
$_SESSION['EstadoCodigos'] = "ValidarCodigoAcceso";
Simultaneously, CambioEstadoCodigoSeguridad() marks the token record in the database as "Usado", preventing replay.
7

User submits a new password

With EstadoCodigos equal to "ValidarCodigoAcceso", the user can now access:
?cashmanha=cambio-contrasenia-usuarios
This renders the new-password form, which POSTs to ?cashmanha=cambiar-contrasenia-recuperacion.
8

New password is hashed and saved

The controller re-hashes the submitted password using the same SHA1 + crypt() scheme used at registration:
$cifrado    = sha1($conectarsistema->real_escape_string($_POST['val-password']));
$Contrasenia = crypt($conectarsistema->real_escape_string($_POST['val-password']), $cifrado);
The hash is then written to the database via CambioContraseniaRecuperacion(), scoped to the email address stored in $_SESSION['CorreoUsuarios'].
9

Confirmation email sent and session destroyed

A second HTML email is dispatched to the user confirming that their password has been successfully changed. Once the email is sent (or the attempt resolves), the controller calls session_unset() and session_destroy(), fully clearing all recovery session state. The user is then directed to the success confirmation page.

​
Recovery Route Reference

RouteMethodDescription
?cashmanha=reestablecer-contrasenaGETRender the forgot-password form
?cashmanha=recuperar-cuentasPOSTInitiate recovery: generate code/token, send email, seed session
?cashmanha=confirmacion-recuperacion-cuentasGETConfirmation page shown after email is sent
?cashmanha=codigo-seguridad-recuperacionGETCode entry page (also the link target in the email)
?cashmanha=cambio-estado-tokenGET/POSTValidate the entered code and upgrade session state to ValidarCodigoAcceso
?cashmanha=cambio-contrasenia-usuariosGETNew password form (only accessible when state is ValidarCodigoAcceso)
?cashmanha=cambiar-contrasenia-recuperacionPOSTSubmit and apply the new hashed password via CambioContraseniaRecuperacion()
?cashmanha=confirmacion-cambio-contraseniaGETSuccess page — destroys timer sessions and full session
?cashmanha=error-cambio-contraseniaGETError page — destroys timer sessions and full session
?cashmanha=token-codigo-invalidoGETShown when the token in the URL is invalid or already expired

​
Security Notes

  • 6-minute code window — the email body explicitly states the code expires after 6 minutes. The expiracion-cambio-contrasenia route handles timed-out sessions by unsetting expirar_sesion and tiempo_sesion, then destroying the full session.
  • Token state in the database — each token is stored in the recuperacion table with an initial state of Valido. When the code is validated, CambioEstadoCodigoSeguridad() marks it Usado, preventing the same code from being accepted a second time.
  • Direct URL access blocked — as long as $_SESSION['EstadoCodigos'] is "BloquearCodigoAcceso", the new-password form is inaccessible even if the attacker knows the token URL. Only a correct code entry flips the state to "ValidarCodigoAcceso".
The PHPMailer SMTP configuration in this codebase ships with an empty Host and Username, using port 2525 — the default for Papercut SMTP, a local test mail catcher. Email delivery will silently fail (and redirect to the login page) in any environment where Papercut is not running on port 2525. Before deploying to production, update the following fields in the recuperar-cuentas and cambiar-contrasenia-recuperacion cases with your real SMTP provider credentials:
$mail->Host     = 'smtp.your-provider.com';
$mail->Port     = 587; // or 465 for SSL
$mail->Username = 'your-smtp-username';
$mail->Password = 'your-smtp-password';
Refer to the PHPMailer documentation for additional settings required by production mail providers, such as SMTPSecure.

Build docs developers (and LLMs) love

Get started for freeTalk to us