makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 06:08:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/7538] Limit user_login_attempts to prevent SQL errors.

Browse source 
PHPBB3-7538
This commit is contained in:
Andreas Fischer 2010-10-15 18:54:44 +02:00
parent b8f37a5024
commit 0452da2bf1
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
phpBB/includes/auth/auth_db.php
View file

@ -134,7 +134,8 @@ function login_db(&$username, &$password)
// increase login attempt count to make sure this cannot be exploited // increase login attempt count to make sure this cannot be exploited
$sql = 'UPDATE ' . USERS_TABLE . ' $sql = 'UPDATE ' . USERS_TABLE . '
SET user_login_attempts = user_login_attempts + 1 SET user_login_attempts = user_login_attempts + 1
WHERE user_id = ' . $row['user_id']; WHERE user_id = ' . (int) $row['user_id'] . '
AND user_login_attempts < ' . LOGIN_ATTEMPTS_MAX;
$db->sql_query($sql); $db->sql_query($sql);
return array( return array(
@ -194,7 +195,8 @@ function login_db(&$username, &$password)
// Password incorrect - increase login attempts // Password incorrect - increase login attempts
$sql = 'UPDATE ' . USERS_TABLE . ' $sql = 'UPDATE ' . USERS_TABLE . '
SET user_login_attempts = user_login_attempts + 1 SET user_login_attempts = user_login_attempts + 1
WHERE user_id = ' . $row['user_id']; WHERE user_id = ' . (int) $row['user_id'] . '
AND user_login_attempts < ' . LOGIN_ATTEMPTS_MAX;
$db->sql_query($sql); $db->sql_query($sql);
// Give status about wrong password... // Give status about wrong password...

4
phpBB/includes/constants.php
View file

@ -69,6 +69,10 @@ define('LOGIN_ERROR_ATTEMPTS', 13);
define('LOGIN_ERROR_EXTERNAL_AUTH', 14); define('LOGIN_ERROR_EXTERNAL_AUTH', 14);
define('LOGIN_ERROR_PASSWORD_CONVERT', 15); define('LOGIN_ERROR_PASSWORD_CONVERT', 15);
// Maximum login attempts
// The value is arbitrary, but it has to fit into the user_login_attempts field.
define('LOGIN_ATTEMPTS_MAX', 100);
// Group settings // Group settings
define('GROUP_OPEN', 0); define('GROUP_OPEN', 0);
define('GROUP_CLOSED', 1); define('GROUP_CLOSED', 1);