Skip to content

Commit f3150f3

Browse files
jaapmarcusjaapmarcus
committed
Changed text / Improved password check
1 parent 068220a commit f3150f3

File tree

4 files changed

+44
-122
lines changed

4 files changed

+44
-122
lines changed

‎web/login/index.php‎

Lines changed: 26 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
define('NO_AUTH_REQUIRED',true);
44

5-
65
// Main include
76
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
87

@@ -13,6 +12,8 @@
1312
session_destroy();
1413
}
1514

15+
16+
1617
// Login as someone else
1718
if (isset($_SESSION['user'])) {
1819
if ($_SESSION['user'] == 'admin' && !empty($_GET['loginas'])) {
@@ -32,24 +33,25 @@
3233
exit;
3334
}
3435

35-
if (!empty($_POST['user']) && !empty($_POST['password']) && !empty($_POST['twofa'])){
36+
function authenticate_user(){
3637
if(isset($_SESSION['token']) && isset($_POST['token']) && $_POST['token'] == $_SESSION['token']) {
3738
$v_user = escapeshellarg($_POST['user']);
3839
$v_ip = escapeshellarg($_SERVER['REMOTE_ADDR']);
3940
if(isset($_SERVER['HTTP_CF_CONNECTING_IP'])){
4041
if(!empty($_SERVER['HTTP_CF_CONNECTING_IP'])){
4142
$v_ip = escapeshellarg($_SERVER['HTTP_CF_CONNECTING_IP']);
4243
}
43-
}
44-
45-
// Get user's salt
44+
}
45+
// Get user's salt
4646
$output = '';
4747
exec (HESTIA_CMD."v-get-user-salt ".$v_user." ".$v_ip." json" , $output, $return_var);
4848
$pam = json_decode(implode('', $output), true);
4949
if ( $return_var > 0 ) {
50-
sleep(5);
51-
unset($_POST['password'], $_POST['user']);
50+
sleep(2);
51+
unset($_POST['password']);
52+
unset($_POST['user']);
5253
$error = "<a class=\"error\">".__('Invalid username or password')."</a>";
54+
return $error;
5355
} else {
5456
$user = $_POST['user'];
5557
$password = $_POST['password'];
@@ -82,9 +84,10 @@
8284

8385
// Check API answer
8486
if ( $return_var > 0 ) {
85-
sleep(5);
87+
sleep(2);
8688
unset($_POST['password']);
87-
$ERROR = "<a class=\"error\">".__('Invalid username or password')."</a>";
89+
$error = "<a class=\"error\">".__('Invalid username or password')."</a>";
90+
return $error;
8891
} else {
8992

9093
// Make root admin user
@@ -96,13 +99,18 @@
9699

97100
// Check if 2FA is active
98101
if ($data[$_POST['user']]['TWOFA'] != '') {
99-
$v_twofa = $_POST['twofa'];
100-
exec(HESTIA_CMD ."v-check-user-2fa ".$v_user." ".$v_twofa, $output, $return_var);
102+
if (empty($_POST['twofa'])){
103+
return false;
104+
}else{
105+
$v_twofa = $_POST['twofa'];
106+
exec(HESTIA_CMD ."v-check-user-2fa ".$v_user." ".$v_twofa, $output, $return_var);
101107
unset($output);
102108
if ( $return_var > 0 ) {
103-
sleep(1);
104-
$ERROR = "<a class=\"error\">".__('Invalid or missing 2FA token')."</a>";
109+
sleep(2);
110+
$error = "<a class=\"error\">".__('Invalid or missing 2FA token')."</a>";
111+
return $error;
105112
}
113+
}
106114
}
107115
// Define session user
108116
$_SESSION['user'] = key($data);
@@ -136,109 +144,14 @@
136144
}
137145
}
138146
}
139-
}
140-
} else if (!empty($_POST['user']) && !empty($_POST['password'])) {
141-
if(isset($_SESSION['token']) && isset($_POST['token']) && $_POST['token'] == $_SESSION['token']) {
142-
$v_user = escapeshellarg($_POST['user']);
143-
$v_ip = escapeshellarg($_SERVER['REMOTE_ADDR']);
144-
if(isset($_SERVER['HTTP_CF_CONNECTING_IP'])){
145-
if(!empty($_SERVER['HTTP_CF_CONNECTING_IP'])){
146-
$v_ip = escapeshellarg($_SERVER['HTTP_CF_CONNECTING_IP']);
147-
}
148147
}
149-
150-
// Get user's salt
151-
$output = '';
152-
exec (HESTIA_CMD."v-get-user-salt ".$v_user." ".$v_ip." json" , $output, $return_var);
153-
$pam = json_decode(implode('', $output), true);
154-
if ( $return_var > 0 ) {
155-
sleep(5);
156-
unset($_POST['password'], $_POST['user']);
157-
$error = "<a class=\"error\">".__('Invalid username or password')."</a>";
158-
} else {
159-
$user = $_POST['user'];
160-
$password = $_POST['password'];
161-
$salt = $pam[$user]['SALT'];
162-
$method = $pam[$user]['METHOD'];
163-
164-
if ($method == 'md5' ) {
165-
$hash = crypt($password, '$1$'.$salt.'$');
166-
}
167-
if ($method == 'sha-512' ) {
168-
$hash = crypt($password, '$6$rounds=5000$'.$salt.'$');
169-
$hash = str_replace('$rounds=5000','',$hash);
170-
}
171-
if ($method == 'des' ) {
172-
$hash = crypt($password, $salt);
173-
}
174-
175-
// Send hash via tmp file
176-
$v_hash = exec('mktemp -p /tmp');
177-
$fp = fopen($v_hash, "w");
178-
fwrite($fp, $hash."\n");
179-
fclose($fp);
180-
181-
// Check user hash
182-
exec(HESTIA_CMD ."v-check-user-hash ".$v_user." ".$v_hash." ".$v_ip, $output, $return_var);
183-
unset($output);
184-
185-
// Remove tmp file
186-
unlink($v_hash);
187-
188-
// Check API answer
189-
if ( $return_var > 0 ) {
190-
sleep(5);
191-
unset($_POST['password']);
192-
$ERROR = "<a class=\"error\">".__('Invalid username or password')."</a>";
193-
} else {
194-
195-
// Make root admin user
196-
if ($_POST['user'] == 'root') $v_user = 'admin';
197-
198-
// Get user speciefic parameters
199-
exec (HESTIA_CMD . "v-list-user ".$v_user." json", $output, $return_var);
200-
$data = json_decode(implode('', $output), true);
201-
202-
// Check if 2FA is active
203-
if ($data[$_POST['user']]['TWOFA'] == '') {
204-
// Define session user
205-
$_SESSION['user'] = key($data);
206-
$v_user = $_SESSION['user'];
207-
208-
// Define language
209-
$output = '';
210-
exec (HESTIA_CMD."v-list-sys-languages json", $output, $return_var);
211-
$languages = json_decode(implode('', $output), true);
212-
if (in_array($data[$v_user]['LANGUAGE'], $languages)){
213-
$_SESSION['language'] = $data[$v_user]['LANGUAGE'];
214-
} else {
215-
$_SESSION['language'] = 'en';
216-
}
217-
218-
// Regenerate session id to prevent session fixation
219-
session_regenerate_id();
220-
221-
// Redirect request to control panel interface
222-
if (!empty($_SESSION['request_uri'])) {
223-
header("Location: ".$_SESSION['request_uri']);
224-
unset($_SESSION['request_uri']);
225-
exit;
226-
} else {
227-
if ($v_user == 'admin') {
228-
header("Location: /list/user/");
229-
} else {
230-
header("Location: /list/web/");
231-
}
232-
exit;
233-
}
234-
}
235-
}
236-
}
237-
}
238148
}
239149

240-
241-
150+
if (!empty($_POST['user']) && !empty($_POST['password']) && !empty($_POST['twofa'])){
151+
$error = authenticate_user();
152+
} else if (!empty($_POST['user']) && !empty($_POST['password'])) {
153+
$error = authenticate_user();
154+
}
242155
// Check system configuration
243156
load_hestia_config();
244157

@@ -262,7 +175,6 @@
262175

263176
// Generate CSRF token
264177
$_SESSION['token'] = md5(uniqid(mt_rand(), true));
265-
266178
require_once($_SERVER['DOCUMENT_ROOT'].'/inc/i18n/'.$_SESSION['language'].'.php');
267179
require_once('../templates/header.html');
268180
if (empty($_POST['user'])) {

‎web/templates/login.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
</tr>
1919
<tr>
2020
<td style="padding: 12px 0 5px 2px;">
21-
<?php print __('Please login with your username');?>
21+
<?php print __('Username');?>
2222
</td>
2323
</tr>
2424
<tr>
@@ -42,7 +42,7 @@
4242
<tr>
4343
<td colspan=2>
4444
<div class="login-bottom">
45-
<div style="height:20px"><?php if (isset($ERROR)) echo $ERROR ?></div>
45+
<div style="height:20px"><?php if (isset($error)) echo $error ?></div>
4646
</div>
4747
</td>
4848
</tr>
@@ -52,4 +52,4 @@
5252
</center>
5353

5454
</body>
55-
</html>
55+
</html>

‎web/templates/login_1.html‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,13 @@
1919
</td>
2020
</tr>
2121
<tr>
22-
<td style="padding: 12px 0 5px 2px;">
23-
<?php print __('Please enter your Password');?>
22+
<td style="padding: 12px 0 0 2px;">
23+
<?php print __('Password');?>
24+
<div style="padding:0 6px 0px 14px; float:right;">
25+
<a tabindex="5" class="vst-advanced" href="/reset/">
26+
<?php print __('forgot password');?>
27+
</a>
28+
</div>
2429
</td>
2530
</tr>
2631
<tr>

‎web/templates/login_2.html‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,14 @@
1818
<?php print __('Welcome to Hestia Control Panel');?>
1919
</td>
2020
</tr>
21-
<tr>
22-
<td style="padding: 12px 0 5px 2px;">
23-
<?php print __('Please enter your 2FA token');?>
21+
<tr class="twofa">
22+
<td style="padding-top: 12px; padding-left:2px;">
23+
<?php print __('2FA Token');?>
24+
<div style="padding:0 6px 0px 14px; float:right;">
25+
<a tabindex="5" class="vst-advanced" href="/reset2fa/">
26+
<?php print __('Forgot token');?>
27+
</a>
28+
</div>
2429
</td>
2530
</tr>
2631
<tr>

0 commit comments

Comments
 (0)