Notifiy user when suspended (hestiacp#2345)

* Notifiy user when suspended

Add error message when user tries to login

* Force users to use hostname instead any domain

Possible method for gaining access via clientdomain.com and changing DNS

Author: jaapmarcus

bin/v-get-user-salt

@@ -93,6 +93,10 @@ then
         echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
         exit 9
     fi
+elif [[ "$shadow" =~ ! ]]; then 
+    echo "Error: Account has been suspended"
+    echo "$date $time $user $ip has been suspended" >> $HESTIA/log/auth.log
+    exit 5
 else
     salt=${shadow:0:2}
     method='des'

web/login/index.php

@@ -105,7 +105,11 @@ function authenticate_user($user, $password, $twofa = '')
         $pam = json_decode(implode('', $output), true);
         if ($return_var > 0) {
             sleep(2);
-            $error = '<a class="error">' . _('Invalid username or password') . '</a>';
+            if($return_var == 5){
+                $error = '<a class="error">' . _('Account has been suspended') . '</a>';   
+            }else{
+                $error = '<a class="error">' . _('Invalid username or password') . '</a>';    
+            }
             return $error;
         } else {
             $salt = $pam[$user]['SALT'];

web/reset/index.php

@@ -52,7 +52,7 @@
                 } else {
                     $mailtext = _('GREETINGS');
                 }
-                if (in_array(str_replace(':'.$_SERVER['SERVER_PORT'], '.conf', $_SERVER['HTTP_HOST']), array_merge(scandir('/etc/nginx/conf.d'), scandir('/etc/nginx/conf.d/domains'), scandir('/etc/apache2/conf.d/domains'), scandir('/etc/apache2/conf.d')))) {
+                if ($hostname.":".$_SERVER['SERVER_PORT'] == $_SERVER['HTTP_HOST']) {
                     $mailtext .= sprintf(_('PASSWORD_RESET_REQUEST'), $_SERVER['HTTP_HOST'], $user, $rkey, $_SERVER['HTTP_HOST'], $user, $rkey);
                     if (!empty($rkey)) {
                         send_email($to, $subject, $mailtext, $from, $from_name, $data[$user]['NAME']);