Improved brutforce protection and added ban page.

1 files changed, 36 insertions, 13 deletions

diff --git a/www/functions/func_login.php b/www/functions/func_login.php
index a4d4696..afd116c 100755
--- a/www/functions/func_login.php
+++ b/www/functions/func_login.php
@@ -54,19 +54,29 @@ function logout(){
 function brutforce_protection($db){
 	$_SESSION["login_attempts"] = $_SESSION["login_attempts"] - 1;
 
+	$remote_ip = $_SERVER["REMOTE_ADDR"];
+	$session_id = session_id();
+	$time = $_SERVER["REQUEST_TIME"];
+
 	if($_SESSION["login_attempts"] <= 0){
-		$remote_ip = $_SERVER["REMOTE_ADDR"];
-		$session_id = session_id();
-		$time = $_SERVER["REQUEST_TIME"];
 
-		if($db->exec("
+		$db->exec("
 			BEGIN TRANSACTION;
 			INSERT INTO banned_user (id, ip, session_id, time) VALUES (NULL, '".SQLite3::escapeString($remote_ip)."', '".SQLite3::escapeString($session_id)."', ".$time.");
 			COMMIT;
-		")){
-			echo "You are banned. ;_;";
-		}
-		exit;
+		")
+		banned();
+
+	} else {
+		 if($db->exec("
+		 	BEGIN TRANSACTION;
+			INSERT INTO banned_user (id, login_attemps, ip, session_id, time) VALUES (NULL, ".$_SESSION["login_attempts"].", ".$db->escapeString($remote_ip).", '".SQLite3::escapeString($session_id)    ."', '".$time."');
+			COMMIT;
+		 ")){
+		 	return true;
+		 } else {
+		 	return false;
+		 }
 	}
 }
 
@@ -74,14 +84,27 @@ function check_if_banned($db){
 
 	$remote_ip = $_SERVER["REMOTE_ADDR"];
 	$session_id = session_id();
-	$check_db = $db->query("SELECT time FROM banned_user WHERE ip='".SQLite3::escapeString($remote_ip)."' OR session_id='".SQLite3::escapeString($session_id)."';");
+	$check_db = $db->query("SELECT time, login_attempts, id FROM banned_user WHERE ip='".SQLite3::escapeString($remote_ip)."' OR session_id='".SQLite3::escapeString($session_id)."' ORDER BY id DESC;");
 	$check_ar = $check_db->fetchArray(SQLITE3_NUM);
 
+	$log_at = $check_ar[1];
+	if($log_at){
+		$_SESSION["login_attempts"] = $log_at;
+	}
+
 	$accepted_time = $_SERVER["REQUEST_TIME"] - 21600; 	// == 6h
+	$db->exec("DELETE FROM banned_user WHERE time<'".$accepted_time."'");
 
-	if($check_ar[0] < $accepted_time){
-		return false; 					// not longer banned
-	} else {
-		return true;					// still banned
+	if($log_at <= 0)
+		if ($check_ar[0] >= $accepted_time){
+			return true;					// still banned
+		}
 	}
+
+	return false; 					// not longer banned
+}
+
+function banned(){
+	header("Refresh: 0; ".$GLOBALS["scheme"].$_SERVER["HTTP_HOST"]."/banned");
+	exit;
 }