Skip to content

Commit 3eeed9b

Browse files
author
bpssoft
committed
* Added bruteforge protection into login
* Cleanup some stuff into login/index.php like globals * Add errors to the lang files
1 parent 3fac987 commit 3eeed9b

File tree

6 files changed

+130
-70
lines changed

6 files changed

+130
-70
lines changed

‎CODING_NOTES.php.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,10 @@ Some guidelines for web development with php.
77
* error_reporting(E_ALL|E_STRICT) , yep php5
88
* Magic quotes is gone in php6, get used to it now. config = magic_quotes_gpc() Everything must be quoted
99

10-
please mark any section that nned review or work on with
10+
please mark any section that need review or work on with
1111
// TODO
12+
* Add documentation about access levels (public, private, protected).
13+
* Make function / var names on the following way, first word lower, next word(s) first letter upper like. getFirstResult();
1214

1315
Pear coding guiidelines
1416

‎install/sql/ispconfig3.sql‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -864,3 +864,13 @@ CREATE TABLE `web_domain` (
864864
--
865865
-- Daten für Tabelle `web_domain`
866866
--
867+
868+
--
869+
-- Table for attempts login
870+
--
871+
872+
CREATE TABLE `attempts_login` (
873+
`ip` varchar(12) NOT NULL,
874+
`times` tinyint(1) NOT NULL default '1',
875+
`login_time` timestamp NOT NULL default '0000-00-00 00:00:00'
876+
);

‎interface/lib/classes/datasources_enbion.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030

3131
class datasources_enbion {
3232

33-
function get_employees() {
33+
public function get_employees() {
3434
global $app, $conf;
3535

3636
$out = array();

‎interface/web/login/index.php‎

Lines changed: 98 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -32,80 +32,110 @@
3232

3333
class login_index {
3434

35-
public $status = '';
36-
private $target = '';
37-
38-
public function render() {
35+
public $status = '';
36+
private $target = '';
37+
private $app;
38+
private $conf;
3939

40-
if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
41-
die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
40+
public function __construct()
41+
{
42+
global $app, $conf;
43+
$this->app = $app;
44+
$this->conf = $conf;
4245
}
4346

44-
global $app, $conf;
45-
$app->uses('tpl');
46-
$app->tpl->newTemplate('form.tpl.htm');
47-
48-
$error = '';
49-
50-
51-
//* Login Form was send
52-
if(count($_POST) > 0) {
53-
54-
// iporting variables
55-
$username = $app->db->quote($_POST['username']);
56-
$passwort = $app->db->quote($_POST['passwort']);
57-
58-
if($username != '' and $passwort != '') {
59-
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
60-
$user = $app->db->queryOneRecord($sql);
61-
if($user) {
62-
if($user['active'] == 1) {
63-
$user = $app->db->toLower($user);
64-
$_SESSION = array();
65-
$_SESSION['s']['user'] = $user;
66-
$_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
67-
$_SESSION['s']['language'] = $user['language'];
68-
$_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
69-
70-
if(is_file($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
71-
include_once($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
72-
$_SESSION['s']['module'] = $module;
73-
}
74-
echo 'HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage'];
75-
76-
exit;
77-
} else {
78-
$error = $app->lng(1003);
79-
}
80-
} else {
81-
//* Incorrect login - Username and password incorrect
82-
$error = $app->lng(1002);
83-
if($app->db->errorMessage != '') $error .= '<br>'.$app->db->errorMessage != '';
84-
}
85-
} else {
86-
//* Username or password empty
87-
$error = $app->lng(1001);
88-
}
89-
}
90-
if($error != ''){
91-
$error = '<table class="error">
92-
<tr>
93-
<td><strong>Error:</strong><br>'.$error.'</td>
94-
</tr>
95-
</table>';
96-
}
97-
98-
99-
100-
$app->tpl->setVar('error', $error);
101-
$app->tpl->setInclude('content_tpl','login/templates/index.htm');
102-
$app->tpl_defaults();
47+
public function render() {
48+
49+
if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
50+
die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
51+
}
52+
53+
$this->app->uses('tpl');
54+
$this->app->tpl->newTemplate('form.tpl.htm');
55+
56+
$error = '';
57+
58+
59+
//* Login Form was send
60+
if(count($_POST) > 0) {
61+
62+
// iporting variables
63+
$ip = $this->app->db->quote(ip2long($_SERVER['REMOTE_ADDR']));
64+
$username = $this->app->db->quote($_POST['username']);
65+
$passwort = $this->app->db->quote($_POST['passwort']);
66+
67+
if($username != '' and $passwort != '') {
68+
//* Check if there already wrong logins
69+
$sql = "SELECT * FROM `attempts_login` WHERE `ip`= '{$ip}' AND `login_time` < NOW() + INTERVAL 15 MINUTE LIMIT 1";
70+
$alreadyfailed = $this->app->db->queryOneRecord($sql);
71+
//* login to much wrong
72+
if($alreadyfailed['times'] > 5) {
73+
$error = $this->app->lng(1004);
74+
} else {
75+
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
76+
$user = $this->app->db->queryOneRecord($sql);
77+
if($user) {
78+
if($user['active'] == 1) {
79+
// User login right, so attempts can be deleted
80+
$sql = "DELETE FROM `attempts_login` WHERE `ip`='{$ip}'";
81+
$this->app->db->query($sql);
82+
$user = $this->app->db->toLower($user);
83+
$_SESSION = array();
84+
$_SESSION['s']['user'] = $user;
85+
$_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
86+
$_SESSION['s']['language'] = $user['language'];
87+
$_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
88+
89+
if(is_file($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
90+
include_once($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
91+
$_SESSION['s']['module'] = $module;
92+
}
93+
echo 'HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage'];
94+
95+
exit;
96+
} else {
97+
$error = $this->app->lng(1003);
98+
}
99+
} else {
100+
if(!$alreadyfailed['times'] )
101+
{
102+
//* user login the first time wrong
103+
$sql = "INSERT INTO `attempts_login` (`ip`, `times`, `login_time`) VALUES ('{$ip}', 1, NOW())";
104+
$this->app->db->query($sql);
105+
} elseif($alreadyfailed['times'] >= 1) {
106+
//* update times wrong
107+
$sql = "UPDATE `attempts_login` SET `times`=`times`+1, `login_time`=NOW() WHERE `login_time` >= '{$time}' LIMIT 1";
108+
$this->app->db->query($sql);
109+
}
110+
//* Incorrect login - Username and password incorrect
111+
$error = $this->app->lng(1002);
112+
if($this->app->db->errorMessage != '') $error .= '<br />'.$this->app->db->errorMessage != '';
113+
}
114+
}
115+
} else {
116+
//* Username or password empty
117+
$error = $this->app->lng(1001);
118+
}
119+
}
120+
if($error != ''){
121+
$error = '<table class="error">
122+
<tr>
123+
<td><strong>Error:</strong><br>'.$error.'</td>
124+
</tr>
125+
</table>';
126+
}
103127

104-
$this->status = 'OK';
105128

106-
return $app->tpl->grab();
107129

108-
} // << end function
130+
$this->app->tpl->setVar('error', $error);
131+
$this->app->tpl->setInclude('content_tpl','login/templates/index.htm');
132+
$this->app->tpl_defaults();
133+
134+
$this->status = 'OK';
135+
136+
return $this->app->tpl->grab();
137+
138+
} // << end function
109139

110140
} // << end class
111141

‎interface/web/login/lib/lang/de.lng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
$wb[1001] = "Username or Password empty.";
44
$wb[1002] = "Username or Passwort wrong.";
55
$wb[1003] = "User is blocked.";
6+
$wb[1004] = "To many wrong login's, Please retry it after 15 minutes";
67

78

89

‎interface/web/login/lib/lang/en.lng‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?php
2+
3+
$wb[1001] = "Username or Password empty.";
4+
$wb[1002] = "Username or Password wrong.";
5+
$wb[1003] = "User is blocked.";
6+
$wb[1004] = "To many wrong login's, Please retry it after 15 minutes";
7+
8+
9+
10+
11+
12+
13+
14+
15+
16+
17+
?>

0 commit comments

Comments
 (0)