Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Login.php Does not report bad logins #2

Closed
mattotone opened this issue Apr 4, 2021 · 1 comment
Closed

Login.php Does not report bad logins #2

mattotone opened this issue Apr 4, 2021 · 1 comment

Comments

@mattotone
Copy link

Login.php and admin_model do not show errors on incorrect login or lockout after incorrect activations.

Fixes bellow.

LOGIN CONTROLLER

public function index()
{
/*
Error List:
0 - No Error
1 - Too Many Login Attempts
2 - Bad Credentials
*/
$data["error"] = 0;
if ($this->input->post())
{

		if (!$this->session->userdata("loginattempts")) {
			$this->session->set_userdata("loginattempts", 1);
		}
		$loginattempts = $this->session->userdata("loginattempts");		
		$postData = $this->input->post();
	
		if ($loginattempts > 4) {  //To Many Attempts
			$data["error"] = 1;
			echo"e1";
			$this->load->view('login', $data);
		} else {
			$auth = $this->Admin_model->adminLogin($postData);
			if ($auth == 0) {
				echo"s1";
				redirect(base_url(), "auto");
			} else {
				echo"e2";
				$data["error"] = 2;
				$this->session->set_userdata("loginattempts", $loginattempts + 1);
				$this->load->view('login', $data);
			}			
		} 
	} else {
		$this->load->view('login', $data);
	}
	
}

###ADMIN_MODLE
public function adminLogin($postData) {
if (!isset($postData["username"])) { return 2; }
if (!isset($postData["password"])) { return 2; }
$salt = $this->generateSalt();
$username = $this->db->escape(strip_tags($postData["username"]));
$password = $this->db->escape(strip_tags(md5($salt.$postData["password"])));
$sql = "SELECT * FROM admin WHERE username = ".$username." AND password = ".$password;
$query = $this->db->query($sql);
if ($query->num_rows() > 0) {
$q = $query->row();
$this->session->set_userdata("username",$q->username);
$this->session->set_userdata("verification_key",$q->verification_key);
$this->session->set_userdata("admin_id", $q->id);
$this->session->set_userdata("loggedin",1);
$ip = $this->getUserIP();
$sql2 = "UPDATE admin SET last_signin = NOW(), ip = ".$this->db->escape($ip)." WHERE id = ".$q->id;
$this->db->query($sql2);
return 0;
} else {
return 2;
}
}

@jopanel
Copy link
Owner

jopanel commented Jul 14, 2021

Make a pull request with working changes and I will accept it.

@jopanel jopanel closed this as completed Jul 14, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants