mirror of
https://github.com/itflow-org/itflow
synced 2026-02-28 02:44:53 +00:00
Merge branch 'master' into code-tidy
This commit is contained in:
wrongecho
GitHub
315
login.php
315
login.php
@@ -5,13 +5,41 @@ if (!file_exists('config.php')) {
|
||||
exit;
|
||||
}
|
||||
|
||||
include("config.php");
|
||||
include("functions.php");
|
||||
require_once("config.php");
|
||||
require_once("functions.php");
|
||||
require_once("rfc6238.php");
|
||||
|
||||
// IP & User Agent for logging
|
||||
$ip = strip_tags(mysqli_real_escape_string($mysqli,get_ip()));
|
||||
$user_agent = strip_tags(mysqli_real_escape_string($mysqli,$_SERVER['HTTP_USER_AGENT']));
|
||||
|
||||
// Block brute force password attacks - check recent failed login attempts for this IP
|
||||
// Block access if more than 15 failed login attempts have happened in the last 10 minutes
|
||||
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT(log_id) AS failed_login_count FROM logs WHERE log_ip = '$ip' AND log_type = 'Login' AND log_action = 'Failed' AND log_created_at > (NOW() - INTERVAL 10 MINUTE)"));
|
||||
$failed_login_count = $row['failed_login_count'];
|
||||
|
||||
if ($failed_login_count >= 15) {
|
||||
|
||||
// Logging
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Blocked', log_description = '$ip was blocked access to login due to IP lockout', log_ip = '$ip', log_user_agent = '$user_agent'");
|
||||
|
||||
// Inform user & quit processing page
|
||||
exit("<h2>$config_app_name</h2>Your IP address has been blocked due to repeated failed login attempts. Please try again later. <br><br>This action has been logged.");
|
||||
}
|
||||
|
||||
// Query Settings for "default" company (as companies are being removed shortly)
|
||||
$sql_settings = mysqli_query($mysqli,"SELECT * FROM settings WHERE company_id = 1");
|
||||
$row = mysqli_fetch_array($sql_settings);
|
||||
|
||||
// Mail
|
||||
$config_smtp_host = $row['config_smtp_host'];
|
||||
$config_smtp_port = $row['config_smtp_port'];
|
||||
$config_smtp_encryption = $row['config_smtp_encryption'];
|
||||
$config_smtp_username = $row['config_smtp_username'];
|
||||
$config_smtp_password = $row['config_smtp_password'];
|
||||
$config_mail_from_email = $row['config_mail_from_email'];
|
||||
$config_mail_from_name = $row['config_mail_from_name'];
|
||||
|
||||
// HTTP-Only cookies
|
||||
ini_set("session.cookie_httponly", True);
|
||||
|
||||
@@ -26,45 +54,67 @@ if (isset($_POST['login'])) {
|
||||
// Sessions should start after the user has POSTed data
|
||||
session_start();
|
||||
|
||||
// Check recent failed login attempts for this IP (more than 10 failed logins in 5 mins)
|
||||
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT(log_id) AS failed_login_count FROM logs WHERE log_ip = '$ip' AND log_type = 'Login' AND log_action = 'Failed' AND log_created_at > (NOW() - INTERVAL 5 MINUTE)"));
|
||||
$failed_login_count = $row['failed_login_count'];
|
||||
// Passed login brute force check
|
||||
$email = strip_tags(mysqli_real_escape_string($mysqli, $_POST['email']));
|
||||
$password = $_POST['password'];
|
||||
|
||||
// Login brute force check
|
||||
if ($failed_login_count >= 10) {
|
||||
$current_code = 0; // Default value
|
||||
if (isset($_POST['current_code'])) {
|
||||
$current_code = strip_tags(mysqli_real_escape_string($mysqli, $_POST['current_code']));
|
||||
}
|
||||
|
||||
// Logging
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Failed', log_description = 'Failed login attempt due to IP lockout', log_ip = '$ip', log_user_agent = '$user_agent'");
|
||||
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN user_settings on users.user_id = user_settings.user_id WHERE user_email = '$email' AND user_archived_at IS NULL AND user_status = 1"));
|
||||
|
||||
// Send an alert only count hits 10 to reduce flooding alerts (using 1 as "default" company)
|
||||
if ($failed_login_count == 10) {
|
||||
mysqli_query($mysqli,"INSERT INTO notifications SET notification_type = 'Lockout', notification = '$ip was locked out for repeated failed login attempts.', notification_timestamp = NOW() company_id = '1'");
|
||||
}
|
||||
// Check password
|
||||
if ($row && password_verify($password, $row['user_password'])) {
|
||||
|
||||
// Inform user
|
||||
$response = '<div class=\'alert alert-danger\'>IP Lockout - Please try again later.<button class=\'close\' data-dismiss=\'alert\'>×</button></div>';
|
||||
// User password correct (partial login)
|
||||
|
||||
} else {
|
||||
// Passed login brute force check
|
||||
$email = strip_tags(mysqli_real_escape_string($mysqli, $_POST['email']));
|
||||
$password = $_POST['password'];
|
||||
if (isset($_POST['current_code'])) {
|
||||
$current_code = strip_tags(mysqli_real_escape_string($mysqli, $_POST['current_code']));
|
||||
}
|
||||
// Set temporary user variables
|
||||
$user_name = strip_tags(mysqli_real_escape_string($mysqli, $row['user_name']));
|
||||
$user_id = $row['user_id'];
|
||||
$user_email = $row['user_email'];
|
||||
$token = $row['user_token'];
|
||||
|
||||
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN user_settings on users.user_id = user_settings.user_id WHERE user_email = '$email' AND user_archived_at IS NULL AND user_status = 1"));
|
||||
if ($row && password_verify($password, $row['user_password'])) {
|
||||
// Checking for user 2FA
|
||||
if (empty($token) || TokenAuth6238::verify($token, $current_code)) {
|
||||
|
||||
// User variables
|
||||
$token = $row['user_token'];
|
||||
$user_name = strip_tags(mysqli_real_escape_string($mysqli, $row['user_name']));
|
||||
$user_id = $row['user_id'];
|
||||
// FULL LOGIN SUCCESS - 2FA not configured or was successful
|
||||
|
||||
// Check this login isn't suspicious
|
||||
$sql_ip_prev_logins = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS ip_previous_logins FROM logs WHERE log_type = 'Login' AND log_action = 'Success' AND log_ip = '$ip' AND log_user_id = '$user_id'"));
|
||||
$ip_previous_logins = $sql_ip_prev_logins['ip_previous_logins'];
|
||||
|
||||
$sql_ua_prev_logins = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(log_id) AS ua_previous_logins FROM logs WHERE log_type = 'Login' AND log_action = 'Success' AND log_user_agent = '$user_agent' AND log_user_id = '$user_id'"));
|
||||
$ua_prev_logins = $sql_ua_prev_logins['ua_previous_logins'];
|
||||
|
||||
// Notify if both the user agent and IP are different
|
||||
if (!empty($config_smtp_host) && $ip_previous_logins == 0 && $ua_prev_logins == 0) {
|
||||
$subject = "$config_app_name new login for $user_name";
|
||||
$body = "Hi $user_name, <br><br>A recent successful login to your $config_app_name account was considered a little unusual. If this was you, you can safely ignore this email!<br><br>IP Address: $ip<br> User Agent: $user_agent <br><br>If you did not perform this login, your credentials may be compromised. <br><br>Thanks, <br>ITFlow";
|
||||
|
||||
$mail = sendSingleEmail($config_smtp_host, $config_smtp_username, $config_smtp_password, $config_smtp_encryption, $config_smtp_port,
|
||||
$config_mail_from_email, $config_mail_from_name,
|
||||
$user_email, $user_name,
|
||||
$subject, $body);
|
||||
}
|
||||
|
||||
|
||||
// Determine whether 2FA was used (for logs)
|
||||
$extended_log = ''; // Default value
|
||||
if ($current_code !== 0 ) {
|
||||
$extended_log = 'with 2FA';
|
||||
}
|
||||
|
||||
// Logging successful login
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Success', log_description = '$user_name successfully logged in $extended_log', log_ip = '$ip', log_user_agent = '$user_agent', log_user_id = $user_id");
|
||||
|
||||
// Session info
|
||||
$_SESSION['user_id'] = $user_id;
|
||||
$_SESSION['user_name'] = $user_name;
|
||||
$_SESSION['user_role'] = $row['user_role'];
|
||||
$_SESSION['csrf_token'] = bin2hex(random_bytes(78));
|
||||
$_SESSION['logged'] = TRUE;
|
||||
|
||||
// Setup encryption session key
|
||||
if (isset($row['user_specific_encryption_ciphertext']) && $row['user_role'] > 1) {
|
||||
@@ -84,67 +134,66 @@ if (isset($_POST['login'])) {
|
||||
}
|
||||
}
|
||||
|
||||
if (empty($token)) {
|
||||
// Full Login successful
|
||||
|
||||
$_SESSION['logged'] = TRUE;
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Success', log_description = '$user_name successfully logged in', log_ip = '$ip', log_user_agent = '$user_agent', log_user_id = $user_id");
|
||||
|
||||
// Show start page/dashboard depending on role
|
||||
if ($row['user_role'] == 2) {
|
||||
header("Location: dashboard_technical.php");
|
||||
} else {
|
||||
header("Location: dashboard_financial.php");
|
||||
}
|
||||
|
||||
// Show start page/dashboard depending on role
|
||||
if ($row['user_role'] == 2) {
|
||||
header("Location: dashboard_technical.php");
|
||||
} else {
|
||||
// Prompt for MFA
|
||||
|
||||
$token_field = "<div class='input-group mb-3'>
|
||||
<input type='text' class='form-control' placeholder='Token' name='current_code' autofocus>
|
||||
<div class='input-group-append'>
|
||||
<div class='input-group-text'>
|
||||
<span class='fas fa-key'></span>
|
||||
</div>
|
||||
</div>
|
||||
</div>";
|
||||
|
||||
require_once("rfc6238.php");
|
||||
|
||||
if (TokenAuth6238::verify($token, $current_code)) {
|
||||
// Full login (with MFA) successful
|
||||
$_SESSION['logged'] = TRUE;
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login 2FA', log_action = 'Success', log_description = '$user_name successfully logged in using 2FA', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW(), log_user_id = $user_id");
|
||||
|
||||
// Show start page/dashboard depending on role
|
||||
if ($row['user_role'] == 2) {
|
||||
header("Location: dashboard_technical.php");
|
||||
} else {
|
||||
header("Location: dashboard_financial.php");
|
||||
}
|
||||
|
||||
} else {
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = '2FA Failed', log_description = '$user_name failed 2FA', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW(), log_user_id = $user_id");
|
||||
|
||||
$response = "
|
||||
<div class='alert alert-primary'>
|
||||
Please Enter 2FA Key!
|
||||
<button class='close' data-dismiss='alert'>×</button>
|
||||
</div>
|
||||
";
|
||||
}
|
||||
header("Location: dashboard_financial.php");
|
||||
}
|
||||
|
||||
} else {
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Failed', log_description = 'Failed login attempt using $email', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW()");
|
||||
|
||||
$response = "
|
||||
<div class='alert alert-danger'>
|
||||
Incorrect username or password.
|
||||
<button class='close' data-dismiss='alert'>×</button>
|
||||
</div>
|
||||
";
|
||||
} else {
|
||||
|
||||
// MFA is configured and needs to be confirmed, or was unsuccessful
|
||||
|
||||
// HTML code for the token input field
|
||||
$token_field = "
|
||||
<div class='input-group mb-3'>
|
||||
<input type='text' class='form-control' placeholder='2FA Token' name='current_code' required autofocus>
|
||||
<div class='input-group-append'>
|
||||
<div class='input-group-text'>
|
||||
<span class='fas fa-key'></span>
|
||||
</div>
|
||||
</div>
|
||||
</div>";
|
||||
|
||||
// Log/notify if MFA was unsuccessful
|
||||
if ($current_code !== 0) {
|
||||
|
||||
// Logging
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = '2FA Failed', log_description = '$user_name failed 2FA', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW(), log_user_id = $user_id");
|
||||
|
||||
// Email the tech to advise their credentials may be compromised
|
||||
if (!empty($config_smtp_host)) {
|
||||
$subject = "Important: $config_app_name failed 2FA login attempt for $user_name";
|
||||
$body = "Hi $user_name, <br><br>A recent login to your $config_app_name account was unsuccessful due to an incorrect 2FA code. If you did not attempt this login, your credentials may be compromised. <br><br>Thanks, <br>ITFlow";
|
||||
|
||||
$mail = sendSingleEmail($config_smtp_host, $config_smtp_username, $config_smtp_password, $config_smtp_encryption, $config_smtp_port,
|
||||
$config_mail_from_email, $config_mail_from_name,
|
||||
$user_email, $user_name,
|
||||
$subject, $body);
|
||||
}
|
||||
|
||||
// HTML feedback for incorrect 2FA code
|
||||
$response = "
|
||||
<div class='alert alert-warning'>
|
||||
Please Enter 2FA Key!
|
||||
<button class='close' data-dismiss='alert'>×</button>
|
||||
</div>";
|
||||
}
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
// Password incorrect or user doesn't exist - show generic error
|
||||
|
||||
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Failed', log_description = 'Failed login attempt using $email', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW()");
|
||||
|
||||
$response = "
|
||||
<div class='alert alert-danger'>
|
||||
Incorrect username or password.
|
||||
<button class='close' data-dismiss='alert'>×</button>
|
||||
</div>";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -153,60 +202,60 @@ if (isset($_POST['login'])) {
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
<title><?php echo $config_app_name; ?> | Login</title>
|
||||
<!-- Tell the browser to be responsive to screen width -->
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="robots" content="noindex">
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
<title><?php echo $config_app_name; ?> | Login</title>
|
||||
<!-- Tell the browser to be responsive to screen width -->
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="robots" content="noindex">
|
||||
|
||||
<!-- Font Awesome -->
|
||||
<link rel="stylesheet" href="plugins/fontawesome-free/css/all.min.css">
|
||||
<!-- Theme style -->
|
||||
<link rel="stylesheet" href="dist/css/adminlte.min.css">
|
||||
<!-- Google Font: Source Sans Pro -->
|
||||
<link href="https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,400i,700" rel="stylesheet">
|
||||
<!-- Font Awesome -->
|
||||
<link rel="stylesheet" href="plugins/fontawesome-free/css/all.min.css">
|
||||
<!-- Theme style -->
|
||||
<link rel="stylesheet" href="dist/css/adminlte.min.css">
|
||||
<!-- Google Font: Source Sans Pro -->
|
||||
<link href="https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,400i,700" rel="stylesheet">
|
||||
</head>
|
||||
<body class="hold-transition login-page">
|
||||
<div class="login-box">
|
||||
<div class="login-logo">
|
||||
<b>IT</b>Flow
|
||||
</div>
|
||||
|
||||
<!-- /.login-logo -->
|
||||
<div class="card">
|
||||
<div class="card-body login-card-body">
|
||||
<p class="login-box-msg"><?php if (isset($response)) { echo $response; } ?></p>
|
||||
<form method="post">
|
||||
<div class="input-group mb-3">
|
||||
<input type="text" class="form-control" placeholder="Agent Email" name="email" value="<?php if (!empty($token_field)) { echo $email; }?>" required <?php if (empty($token_field)) { echo "autofocus"; } ?> >
|
||||
<div class="input-group-append">
|
||||
<div class="input-group-text">
|
||||
<span class="fas fa-envelope"></span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="input-group mb-3">
|
||||
<input type="password" class="form-control" placeholder="Agent Password" name="password" value="<?php if (!empty($token_field)) { echo $password; } ?>" required>
|
||||
<div class="input-group-append">
|
||||
<div class="input-group-text">
|
||||
<span class="fas fa-lock"></span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<?php if (!empty($token_field)) { echo $token_field; } ?>
|
||||
|
||||
<button type="submit" class="btn btn-primary btn-block mb-3" name="login">Sign In</button>
|
||||
|
||||
<hr><br>
|
||||
|
||||
<h4>Looking for the <a href="portal">Client Portal?<a/></h4>
|
||||
|
||||
</form>
|
||||
|
||||
<div class="login-logo">
|
||||
<b>IT</b>Flow
|
||||
</div>
|
||||
|
||||
<!-- /.login-logo -->
|
||||
<div class="card">
|
||||
<div class="card-body login-card-body">
|
||||
<p class="login-box-msg"><?php if(isset($response)) { echo $response; } ?></p>
|
||||
<form method="post">
|
||||
<div class="input-group mb-3">
|
||||
<input type="text" class="form-control" placeholder="Agent Email" name="email" value="<?php if(!empty($token_field)){ echo $email; }?>" required <?php if(empty($token_field)){ echo "autofocus"; } ?> >
|
||||
<div class="input-group-append">
|
||||
<div class="input-group-text">
|
||||
<span class="fas fa-envelope"></span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="input-group mb-3">
|
||||
<input type="password" class="form-control" placeholder="Agent Password" name="password" value="<?php if(!empty($token_field)){ echo $password; } ?>" required>
|
||||
<div class="input-group-append">
|
||||
<div class="input-group-text">
|
||||
<span class="fas fa-lock"></span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<?php if(!empty($token_field)){ echo $token_field; } ?>
|
||||
|
||||
<button type="submit" class="btn btn-primary btn-block mb-3" name="login">Sign In</button>
|
||||
|
||||
<hr><br>
|
||||
|
||||
<h4>Looking for the <a href="portal">Client Portal?<a/></h4>
|
||||
|
||||
</form>
|
||||
|
||||
</div>
|
||||
<!-- /.login-card-body -->
|
||||
</div>
|
||||
<!-- /.login-card-body -->
|
||||
</div>
|
||||
</div>
|
||||
<!-- /.login-box -->
|
||||
|
||||
|
||||
Reference in New Issue
Block a user