* Added bruteforge protection into login * Cleanup some stuff into login/in...

bpssoft

2007-11-09 3eeed9bdef1040d4f1f9343201cd8b30e21d273c

* Added bruteforge protection into login
* Cleanup some stuff into login/index.php like globals
* Add errors to the lang files

 CODING_NOTES.php.txt

@@ -7,8 +7,10 @@
* error_reporting(E_ALL|E_STRICT) , yep php5
* Magic quotes is gone in php6, get used to it now. config = magic_quotes_gpc() Everything must be quoted

please mark any section that nned review or work on with
please mark any section that need review or work on with
// TODO 
* Add documentation about access levels (public, private, protected).
* Make function / var names on the following way, first word lower, next word(s) first letter upper like. getFirstResult();

Pear coding guiidelines


 install/sql/ispconfig3.sql

@@ -864,3 +864,13 @@
-- 
-- Daten für Tabelle `web_domain`
-- 

--
-- Table for attempts login 
--

CREATE TABLE `attempts_login` (
  `ip` varchar(12) NOT NULL,
  `times` tinyint(1) NOT NULL default '1',
  `login_time` timestamp NOT NULL default '0000-00-00 00:00:00'
);

 interface/lib/classes/datasources_enbion.inc.php

@@ -30,7 +30,7 @@


class datasources_enbion {

    

    function get_employees() {

    public function get_employees() {

        global $app, $conf;

        

        $out = array();


 interface/web/login/index.php

@@ -32,80 +32,110 @@

class login_index {

public $status = '';
private $target = '';

public function render() {
    public $status = '';
    private $target = '';
    private $app;
    private $conf;
    
    if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
        die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
    public function __construct()
    {
        global $app, $conf;
        $this->app  = $app;
        $this->conf = $conf;
    }
    
    global $app, $conf;
    $app->uses('tpl');
    $app->tpl->newTemplate('form.tpl.htm');
    
    $error = '';    


    //* Login Form was send
    if(count($_POST) > 0) {

        // iporting variables
        $username = $app->db->quote($_POST['username']);
        $passwort = $app->db->quote($_POST['passwort']);

        if($username != '' and $passwort != '') {
                $sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
                $user = $app->db->queryOneRecord($sql);
                  if($user) {
                        if($user['active'] == 1) {
                                $user = $app->db->toLower($user);
                                $_SESSION = array();
                                $_SESSION['s']['user'] = $user;
                                $_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
                                $_SESSION['s']['language'] = $user['language'];
                                $_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
								
                                if(is_file($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
                                    include_once($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
                                    $_SESSION['s']['module'] = $module;
                                }
                                echo 'HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage'];
								
                                exit;
                        } else {
                                $error = $app->lng(1003);
                        }
                } else {
                        //* Incorrect login - Username and password incorrect
                        $error = $app->lng(1002);
                        if($app->db->errorMessage != '') $error .= '<br>'.$app->db->errorMessage != '';
                }
        } else {
                //* Username or password empty
                $error = $app->lng(1001);
        }
    }
    if($error != ''){
          $error = '<table class="error">
        <tr>
        <td><strong>Error:</strong><br>'.$error.'</td>
        </tr>
        </table>';
    }



    $app->tpl->setVar('error', $error);
    $app->tpl->setInclude('content_tpl','login/templates/index.htm');
    $app->tpl_defaults();
    public function render() {
		
        if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
            die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
        }
		
        $this->app->uses('tpl');
        $this->app->tpl->newTemplate('form.tpl.htm');
	    
        $error = '';    
    
    $this->status = 'OK';
    
    return $app->tpl->grab();
        //* Login Form was send
        if(count($_POST) > 0) {
    
} // << end function
            // iporting variables
            $ip       = $this->app->db->quote(ip2long($_SERVER['REMOTE_ADDR']));
            $username = $this->app->db->quote($_POST['username']);
            $passwort = $this->app->db->quote($_POST['passwort']); 
	
            if($username != '' and $passwort != '') {
                //* Check if there already wrong logins
                $sql = "SELECT * FROM `attempts_login` WHERE `ip`= '{$ip}' AND  `login_time` < NOW() + INTERVAL 15 MINUTE LIMIT 1";
                $alreadyfailed = $this->app->db->queryOneRecord($sql);
                //* login to much wrong
                if($alreadyfailed['times'] > 5) {
                    $error = $this->app->lng(1004);
                } else {
                    $sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
                    $user = $this->app->db->queryOneRecord($sql);
                    if($user) {
                        if($user['active'] == 1) {
                            // User login right, so attempts can be deleted
                            $sql = "DELETE FROM `attempts_login` WHERE `ip`='{$ip}'";
                            $this->app->db->query($sql);
                            $user = $this->app->db->toLower($user);
                            $_SESSION = array();
                            $_SESSION['s']['user'] = $user;
                            $_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
                            $_SESSION['s']['language'] = $user['language'];
                            $_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
										
                            if(is_file($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
                                include_once($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
                                $_SESSION['s']['module'] = $module;
                            }
                            echo 'HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage'];
										
                               exit;
                         } else {
                            $error = $this->app->lng(1003);
                        }
                    } else {
                        if(!$alreadyfailed['times'] )
                        {
                            //* user login the first time wrong
                            $sql = "INSERT INTO `attempts_login` (`ip`, `times`, `login_time`) VALUES ('{$ip}', 1, NOW())";
                            $this->app->db->query($sql);
                        } elseif($alreadyfailed['times'] >= 1) {
                            //* update times wrong
                            $sql = "UPDATE `attempts_login` SET `times`=`times`+1, `login_time`=NOW() WHERE `login_time` >= '{$time}' LIMIT 1";
                            $this->app->db->query($sql);
                        }
                        //* Incorrect login - Username and password incorrect
                        $error = $this->app->lng(1002);
                        if($this->app->db->errorMessage != '') $error .= '<br />'.$this->app->db->errorMessage != '';
                       }
                }
              } else {
                   //* Username or password empty
                $error = $this->app->lng(1001);
            }
        }
        if($error != ''){
              $error = '<table class="error">
            <tr>
            <td><strong>Error:</strong><br>'.$error.'</td>
            </tr>
            </table>';
        }
	
	
	
        $this->app->tpl->setVar('error', $error);
        $this->app->tpl->setInclude('content_tpl','login/templates/index.htm');
        $this->app->tpl_defaults();
		
        $this->status = 'OK';
		
        return $this->app->tpl->grab();
		
    } // << end function

} // << end class


 interface/web/login/lib/lang/de.lng

@@ -3,6 +3,7 @@
$wb[1001]    = "Username or Password empty.";
$wb[1002]    = "Username or Passwort wrong.";
$wb[1003]    = "User is blocked.";
$wb[1004]    = "To many wrong login's, Please retry it after 15 minutes";




 interface/web/login/lib/lang/en.lng

New file
@@ -0,0 +1,17 @@
<?php



$wb[1001]    = "Username or Password empty.";

$wb[1002]    = "Username or Password wrong.";

$wb[1003]    = "User is blocked.";

$wb[1004]    = "To many wrong login's, Please retry it after 15 minutes";





















?>