Changeset 30848

Timestamp:

Jan 4, 2015, 3:18:16 PM (9 years ago)

Author:

Eric

Message:

Next version is 2.7.5 :
Fixed - Admins and Webmaster accounts were not correctly excluded on login failure protection

Location:

extensions/Password_Policy

Files:

• changelog.txt.php (modified) (1 diff)
• include/functions.inc.php (modified) (4 diffs)

extensions/Password_Policy/changelog.txt.php

@@ -66 +66 @@
 
 --- 2.7.4 : Fix white page for german users (bug lexiglot)
+
+--- 2.7.5 : Fixed - Admin and Webmaster accounts were not correctly excluded on login failure protection
+             
 */
 ?>

extensions/Password_Policy/include/functions.inc.php

@@ -147 +147 @@
   $conf_PP = unserialize($conf['PasswordPolicy']);
 
-  if (
-        (isset($conf_PP['NBLOGFAIL']) and $conf_PP['NBLOGFAIL'] <> 0)
+  if ((isset($conf_PP['NBLOGFAIL']) and $conf_PP['NBLOGFAIL'] <> 0)
     and (isset($conf_PP['LOGFAILBLOCK']) and $conf_PP['LOGFAILBLOCK'] == 'true')
-    and !is_admin()
-    and !is_webmaster()
     )
   {
-    // If login failure then increments loginfailcount value in database
-    $query = '
+    $query ='
+SELECT ui.status
+FROM '.USER_INFOS_TABLE.' AS ui
+  LEFT JOIN '.USERS_TABLE.' AS u
+    ON u.id = ui.user_id 
+WHERE(u.username = "'.stripslashes($username).'")
+;';
+    $exclude = pwg_db_fetch_assoc(pwg_query($query));
+
+    // Exclude specific accounts
+    if ($exclude['status'] <> "webmaster" and $exclude['status'] <> "admin" and $exclude['status'] <> "generic")
+    {
+      // If login failure then increments loginfailcount value in database
+      $query = '
 UPDATE '.USERS_TABLE.'
 SET PP_loginfailcount = PP_loginfailcount+1
@@ -161 +170 @@
 LIMIT 1
 ;';
-    pwg_query($query);
-
-    $query = '
+      pwg_query($query);
+
+      $query = '
 SELECT PP_loginfailcount
 FROM '.USERS_TABLE.'
@@ -169 +178 @@
 ;';
 
-    $datas = pwg_db_fetch_assoc(pwg_query($query));
-
-    // If number of failed logon exeeds $conf_PP['NBLOGFAIL'], set the account as locked
-    if (isset($datas['PP_loginfailcount']) and $datas['PP_loginfailcount'] >= $conf_PP['NBLOGFAIL'])
-    {
-      $query = '
+      $datas = pwg_db_fetch_assoc(pwg_query($query));
+
+      // If number of failed logon exceeds $conf_PP['NBLOGFAIL'], set the account as locked
+      if (isset($datas['PP_loginfailcount']) and $datas['PP_loginfailcount'] >= $conf_PP['NBLOGFAIL'])
+      {
+        $query = '
 UPDATE '.USERS_TABLE.'
 SET PP_lock = "true"
@@ -180 +189 @@
 LIMIT 1
 ;';
-      pwg_query($query);
-
+        pwg_query($query);
+      }
     }
   }