From 3eeed9bdef1040d4f1f9343201cd8b30e21d273c Mon Sep 17 00:00:00 2001
From: bpssoft <bpssoft@ispconfig3>
Date: Fri, 9 Nov 2007 11:02:50 +0000
Subject: [PATCH] * Added bruteforge protection into login * Cleanup some stuff
into login/index.php like globals * Add errors to the lang files
---
CODING_NOTES.php.txt | 4 +-
install/sql/ispconfig3.sql | 10 ++
.../lib/classes/datasources_enbion.inc.php | 2 +-
interface/web/login/index.php | 166 +++++++++++-------
interface/web/login/lib/lang/de.lng | 1 +
interface/web/login/lib/lang/en.lng | 17 ++
6 files changed, 130 insertions(+), 70 deletions(-)
create mode 100644 interface/web/login/lib/lang/en.lng
diff --git a/CODING_NOTES.php.txt b/CODING_NOTES.php.txt
index 0330fb6c7..5b762d690 100644
--- a/CODING_NOTES.php.txt
+++ b/CODING_NOTES.php.txt
@@ -7,8 +7,10 @@ Some guidelines for web development with php.
* error_reporting(E_ALL|E_STRICT) , yep php5
* Magic quotes is gone in php6, get used to it now. config = magic_quotes_gpc() Everything must be quoted
-please mark any section that nned review or work on with
+please mark any section that need review or work on with
// TODO
+* Add documentation about access levels (public, private, protected).
+* Make function / var names on the following way, first word lower, next word(s) first letter upper like. getFirstResult();
Pear coding guiidelines
diff --git a/install/sql/ispconfig3.sql b/install/sql/ispconfig3.sql
index 3da445f4f..0f7008c18 100644
--- a/install/sql/ispconfig3.sql
+++ b/install/sql/ispconfig3.sql
@@ -864,3 +864,13 @@ CREATE TABLE `web_domain` (
--
-- Daten für Tabelle `web_domain`
--
+
+--
+-- Table for attempts login
+--
+
+CREATE TABLE `attempts_login` (
+ `ip` varchar(12) NOT NULL,
+ `times` tinyint(1) NOT NULL default '1',
+ `login_time` timestamp NOT NULL default '0000-00-00 00:00:00'
+);
diff --git a/interface/lib/classes/datasources_enbion.inc.php b/interface/lib/classes/datasources_enbion.inc.php
index 11e035ce5..7c9335f48 100644
--- a/interface/lib/classes/datasources_enbion.inc.php
+++ b/interface/lib/classes/datasources_enbion.inc.php
@@ -30,7 +30,7 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
class datasources_enbion {
- function get_employees() {
+ public function get_employees() {
global $app, $conf;
$out = array();
diff --git a/interface/web/login/index.php b/interface/web/login/index.php
index 7e1efad3f..a63e6b9d2 100644
--- a/interface/web/login/index.php
+++ b/interface/web/login/index.php
@@ -32,80 +32,110 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
class login_index {
-public $status = '';
-private $target = '';
-
-public function render() {
+ public $status = '';
+ private $target = '';
+ private $app;
+ private $conf;
- if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
- die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
+ public function __construct()
+ {
+ global $app, $conf;
+ $this->app = $app;
+ $this->conf = $conf;
}
- global $app, $conf;
- $app->uses('tpl');
- $app->tpl->newTemplate('form.tpl.htm');
-
- $error = '';
-
-
- //* Login Form was send
- if(count($_POST) > 0) {
-
- // iporting variables
- $username = $app->db->quote($_POST['username']);
- $passwort = $app->db->quote($_POST['passwort']);
-
- if($username != '' and $passwort != '') {
- $sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
- $user = $app->db->queryOneRecord($sql);
- if($user) {
- if($user['active'] == 1) {
- $user = $app->db->toLower($user);
- $_SESSION = array();
- $_SESSION['s']['user'] = $user;
- $_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
- $_SESSION['s']['language'] = $user['language'];
- $_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
-
- if(is_file($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
- include_once($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
- $_SESSION['s']['module'] = $module;
- }
- echo 'HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage'];
-
- exit;
- } else {
- $error = $app->lng(1003);
- }
- } else {
- //* Incorrect login - Username and password incorrect
- $error = $app->lng(1002);
- if($app->db->errorMessage != '') $error .= '<br>'.$app->db->errorMessage != '';
- }
- } else {
- //* Username or password empty
- $error = $app->lng(1001);
- }
- }
- if($error != ''){
- $error = '<table class="error">
- <tr>
- <td><strong>Error:</strong><br>'.$error.'</td>
- </tr>
- </table>';
- }
-
-
-
- $app->tpl->setVar('error', $error);
- $app->tpl->setInclude('content_tpl','login/templates/index.htm');
- $app->tpl_defaults();
+ public function render() {
+
+ if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
+ die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
+ }
+
+ $this->app->uses('tpl');
+ $this->app->tpl->newTemplate('form.tpl.htm');
+
+ $error = '';
+
+
+ //* Login Form was send
+ if(count($_POST) > 0) {
+
+ // iporting variables
+ $ip = $this->app->db->quote(ip2long($_SERVER['REMOTE_ADDR']));
+ $username = $this->app->db->quote($_POST['username']);
+ $passwort = $this->app->db->quote($_POST['passwort']);
+
+ if($username != '' and $passwort != '') {
+ //* Check if there already wrong logins
+ $sql = "SELECT * FROM `attempts_login` WHERE `ip`= '{$ip}' AND `login_time` < NOW() + INTERVAL 15 MINUTE LIMIT 1";
+ $alreadyfailed = $this->app->db->queryOneRecord($sql);
+ //* login to much wrong
+ if($alreadyfailed['times'] > 5) {
+ $error = $this->app->lng(1004);
+ } else {
+ $sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
+ $user = $this->app->db->queryOneRecord($sql);
+ if($user) {
+ if($user['active'] == 1) {
+ // User login right, so attempts can be deleted
+ $sql = "DELETE FROM `attempts_login` WHERE `ip`='{$ip}'";
+ $this->app->db->query($sql);
+ $user = $this->app->db->toLower($user);
+ $_SESSION = array();
+ $_SESSION['s']['user'] = $user;
+ $_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
+ $_SESSION['s']['language'] = $user['language'];
+ $_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
+
+ if(is_file($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
+ include_once($_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
+ $_SESSION['s']['module'] = $module;
+ }
+ echo 'HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage'];
+
+ exit;
+ } else {
+ $error = $this->app->lng(1003);
+ }
+ } else {
+ if(!$alreadyfailed['times'] )
+ {
+ //* user login the first time wrong
+ $sql = "INSERT INTO `attempts_login` (`ip`, `times`, `login_time`) VALUES ('{$ip}', 1, NOW())";
+ $this->app->db->query($sql);
+ } elseif($alreadyfailed['times'] >= 1) {
+ //* update times wrong
+ $sql = "UPDATE `attempts_login` SET `times`=`times`+1, `login_time`=NOW() WHERE `login_time` >= '{$time}' LIMIT 1";
+ $this->app->db->query($sql);
+ }
+ //* Incorrect login - Username and password incorrect
+ $error = $this->app->lng(1002);
+ if($this->app->db->errorMessage != '') $error .= '<br />'.$this->app->db->errorMessage != '';
+ }
+ }
+ } else {
+ //* Username or password empty
+ $error = $this->app->lng(1001);
+ }
+ }
+ if($error != ''){
+ $error = '<table class="error">
+ <tr>
+ <td><strong>Error:</strong><br>'.$error.'</td>
+ </tr>
+ </table>';
+ }
- $this->status = 'OK';
- return $app->tpl->grab();
-} // << end function
+ $this->app->tpl->setVar('error', $error);
+ $this->app->tpl->setInclude('content_tpl','login/templates/index.htm');
+ $this->app->tpl_defaults();
+
+ $this->status = 'OK';
+
+ return $this->app->tpl->grab();
+
+ } // << end function
} // << end class
diff --git a/interface/web/login/lib/lang/de.lng b/interface/web/login/lib/lang/de.lng
index 85a669814..77b8c9fff 100644
--- a/interface/web/login/lib/lang/de.lng
+++ b/interface/web/login/lib/lang/de.lng
@@ -3,6 +3,7 @@
$wb[1001] = "Username or Password empty.";
$wb[1002] = "Username or Passwort wrong.";
$wb[1003] = "User is blocked.";
+$wb[1004] = "To many wrong login's, Please retry it after 15 minutes";
diff --git a/interface/web/login/lib/lang/en.lng b/interface/web/login/lib/lang/en.lng
new file mode 100644
index 000000000..9bdd5ca50
--- /dev/null
+++ b/interface/web/login/lib/lang/en.lng
@@ -0,0 +1,17 @@
+<?php
+
+$wb[1001] = "Username or Password empty.";
+$wb[1002] = "Username or Password wrong.";
+$wb[1003] = "User is blocked.";
+$wb[1004] = "To many wrong login's, Please retry it after 15 minutes";
+
+
+
+
+
+
+
+
+
+
+?>
\ No newline at end of file
--
GitLab