Prevent login by someone from barred IP who has stolen user credentials.

turnermm · Dec 3, 2017 · 345e848 · 345e848
1 parent f4628bb
commit 345e848
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/action.php b/action.php
@@ -37,6 +37,13 @@ function dw_start(&$event, $param)
               header("HTTP/1.0 403 Forbidden");           
               exit("<div style='text-align:center; padding-top:2em;'><h1>403: Login Forbidden</h1></div>");
       }
+
+
+       if( empty($u) && empty($p) && empty($_REQUEST['http_credentials']) && !empty($USERINFO) && !$this->is_allowed($allowed, $ip)){
+            header("HTTP/1.0 403 Forbidden");                   
+            exit("<div style='text-align:center; padding-top:2em;'><h1>403:  Login Required</h1></div>");
+      }   
+
       if($test && isset($USERINFO) && in_array('admin', $USERINFO['grps'])) {         
           $tests = explode(',',$test);
           foreach ($tests as $test) {