Protect user account

[pepi]

hallo

habe den Protect user account installiert aber der login haut nicht mehr
hin immer weisse seite glaube der ist in der login.php drin
denn wenn ich die orig zurückspiele geht alles wieder einwandfrei
obwohl ich die anderen datein unverändert gelassen habe

ich hänge mal die login.php an viellicht finde jemand den fehler
denn ich habe nichts gefunden habe alles min. 5 mal alles neu
instliert und auch die codes neun eingebaut

bitte um hilfe

[oxpus]

Versuchs mal mit dieser Version. Ich habe die erstmal neu formatiert...

[pepi]

hallo oxpus

super danke
haut hin ..............

//edit

habe noch ein problem
wenn sich ein neuer user sicht registriert und dann einloggt muss er das passwort ändern
tut er das nicht wird er beim nächsten einloggen "passwort ist abgelaufen sende mir ein neues"
habe im ACP 0 eingestellt kann auch jede andere zahl eingeben er muss immer
sein passwort ändern ...............

was ist da falsch

ps: gebe ich 0 ein dann muss wird er jedemal aufgefordert ein neues passwort anzufordern
auch als admin ............ und dann ist es wie oben erwähnt

[oxpus]

Stell irgendwas jenseits der 700 Tage ein oder bau den Part des MODs aus der page_header.php aus. Dann wird die Routine überhaupt nicht mehr benutzt.
Habe ich auch gemacht, damit es wirklich nicht mehr nervt...

[pepi]

aha danke
habe 9999 drin
aber werde das mit der page_header.php versuchen

//edit
habe ich gemacht ................... den ausbau
wenn ich mich dann wieder einlogge werde ich aufgefordert ein neues passwort zu beantragen
und das geht so weiter und weiter und weiter
bis ich den part in der page_header.php wieder eingebaut habe und
das pass neu eingegeben habe dann funktioniert es

[oxpus]

Hm, mag mich da auch geirrt haben, daß der auslösende Part in der login.php liegt. Aber in der page_header.php muss der profende Part vorhanden sein.
Ich hatte nach dem entsprechenden Ausbau sofort Ruhe vor dem MOD...

[pepi]

das ist der code in der login.php

Code: Alles auswählen

# 
#-----[ OPEN ]------------------------------------------------ 
# 
login.php

# 
#-----[ FIND ]------------------------------------------------ 
# 
$sql = "SELECT
FROM " . USERS_TABLE . "

# 
#-----[ IN-LINE FIND ]---------------------------------------- 
# 
, user_level

# 
#-----[ IN-LINE AFTER, ADD ]---------------------------------- 
# 
, user_badlogin, user_blocktime, user_email, user_lang, user_timezone,user_passwd_change

# 
#-----[ FIND ]------------------------------------------------ 
# 
if( md5($password) == $row['user_password'] && $row['user_active'] )

# 
#-----[ BEFORE, ADD ]----------------------------------------- 
# 

// Start add - Protect user account MOD
if ($row['user_blocktime']<time() )
{
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
# 
if( $session_id )
{

# 
#-----[ AFTER, ADD ]------------------------------------------ 
#

// Start add - Protect user account MOD
$sql = "UPDATE " . USERS_TABLE . " SET user_badlogin='0'
	WHERE username = '" . str_replace("\'", "''", $username) . "'";
if ( !($result = $db->sql_query($sql)) )
{
	message_die(GENERAL_ERROR, 'Error updating correct login data', '', __LINE__, __FILE__, $sql);
}
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
# 
redirect(appen

# 
#-----[ BEFORE, ADD ]----------------------------------------- 
#

// Start add - Protect user account MOD
if ($session_id['user_id']!=ANONYMOUS)
{
include($phpbb_root_path . "includes/functions_validate.$phpEx");
$pass_result = validate_complex_password ($username, $password);
if ( $session_id['user_passwd_change']==0 || $pass_result['error']== true)
{
	//force a change of password, do not allow a secound login
	$sql = "UPDATE " . USERS_TABLE . " SET user_passwd_change='-9999'
	WHERE user_id = '" . $session_id['user_id'] . "'";
	if ( !($result = $db->sql_query($sql)) )
	{
		message_die(GENERAL_ERROR, 'Error updating correct login data2', '', __LINE__, __FILE__, $sql);
	}
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400) >= $board_config['max_password_age'])
{
	session_end($session_id['session_id'], $session_id['user_id']);
	$message = $lang['Passwd_have_expired'] . '<br /><br /><a href="'.append_sid("profile.$phpEx?mode=sendpassword").'">'.$lang['Send_new_passwd'].'</a><br /><br />' .  sprintf($lang['Click_return_portal'], '<a href="' . append_sid("portal.$phpEx") . '">', '</a>');
	message_die(GENERAL_MESSAGE, $message);
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400)+(($board_config['max_password_age']<14) ? 1 : 14) >= $board_config['max_password_age'] )
{
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
}
}
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
# 
$redirect = str_replace('?', '&', $redirect);
$template->assign_vars(array(
'META' => 
);

# 
#-----[ AFTER, ADD ]------------------------------------------ 
#

// Start add - Protect user account MOD
if ($row['user_active'] )
{
	//count bad login
	// block the user for X min
	if (($row['user_badlogin']+1) % $board_config['max_login_error'])
	{
		$sql = "UPDATE " . USERS_TABLE . " SET user_badlogin=user_badlogin+1
			WHERE username = '" . str_replace("\'", "''", $username) . "'";
		if ( !($result = $db->sql_query($sql)) )
		{
			message_die(GENERAL_ERROR, 'Error updating bad login data'.$user_ip, '', __LINE__, __FILE__, $sql);
		}
	} else
	{
		$blocktime = ", user_block_by='$user_ip', user_blocktime='" . (time()+($board_config['block_time']*60)) . "'";
		$sql = "UPDATE " . USERS_TABLE . " SET user_badlogin=user_badlogin+1 $blocktime
			WHERE username = '" . str_replace("\'", "''", $username) . "'";
		if ( !($result = $db->sql_query($sql)) )
		{
			message_die(GENERAL_ERROR, 'Error updating bad login data'.$user_ip, '', __LINE__, __FILE__, $sql);
		}

		if ($row['user_email']  && $row['user_blocktime']<(time()-3600))
		{
		      include($phpbb_root_path . 'includes/emailer.'.$phpEx); 
			$server_name = trim($board_config['server_name']);
     	      	$emailer = new emailer($board_config['smtp_delivery']); 
     	       	$emailer->email_address($row['user_email']); 
     	        $email_headers = "To: \"".$row['username']."\" <".$row['user_email']. ">\r\n"; 
     	       	$email_headers .= "From: \"".$board_config['sitename']."\" <".$board_config['board_email'].">\r\n"; 
     	      	$email_headers .= "X-AntiAbuse: Board servername - " . $server_name . "\r\n"; 
     	      	$email_headers .= "X-AntiAbuse: User IP - " . decode_ip($user_ip) . "\r\n"; 
		$emailer->use_template('bad_login', $row['user_lang']);
     	       	$emailer->extra_headers($email_headers); 
     		      $emailer->assign_vars(array( 
     		      	'USER' => '"'.$row['username'].'"',
				'BLOCK_TIME' => $board_config['block_time'],
           			'BAD_LOGINS' => $row['user_badlogin']+1, 
				'BLOCK_UNTIL' => create_date ($lang['Time_format'],time()+($board_config['block_time']*60),$row['user_timezone']),
           			'SITENAME' => $board_config['sitename'], 
     	     			'BOARD_EMAIL' => $board_config['board_email'])); 
       	    	$emailer->send(); 
       	    	$emailer->reset(); 
		}
	}
}
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
#
}
}
else
{
$redirect = (
$redirect = str_replace("?", "&", $redirect);

# 
#-----[ BEFORE, ADD ]----------------------------------------- 
#

// Start add - Protect user account MOD
} else
{
	$message = (($lang['Error_login_tomutch'])?$lang['Error_login_tomutch']:$lang['Error_login']) . '<br /><br />' . sprintf($lang['Click_return_login'], '<a href="' . append_sid("login.$phpEx?redirect=$redirect") . '">', '</a>') . '<br /><br />' .  sprintf($lang['Click_return_index'], '<a href="' . append_sid("index.$phpEx") . '">', '</a>');
	message_die(GENERAL_MESSAGE, $message);
}
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
#
else
{
$url =

# 
#-----[ AFTER, ADD ]------------------------------------------ 
#

// Start add - Protect user account MOD
if ($session_id['user_id']!=ANONYMOUS)
{
include($phpbb_root_path . "includes/functions_validate.$phpEx");
$pass_result = validate_complex_password ($username, $password);
if ( $session_id['user_passwd_change']==0 || $pass_result['error']== true)
{
	//force a change of password, do not allow a secound login
	$sql = "UPDATE " . USERS_TABLE . " SET user_passwd_change='-9999'
	WHERE user_id = '" . $session_id['user_id'] . "'";
	if ( !($result = $db->sql_query($sql)) )
	{
		message_die(GENERAL_ERROR, 'Error updating correct login data2', '', __LINE__, __FILE__, $sql);
	}
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400) >= $board_config['max_password_age'])
{
	session_end($session_id['session_id'], $session_id['user_id']);
	$message = $lang['Passwd_have_expired'] . '<br /><br /><a href="'.append_sid("profile.$phpEx?mode=sendpassword").'">'.$lang['Send_new_passwd'].'</a><br /><br />' .  sprintf($lang['Click_return_portal'], '<a href="' . append_sid("portal.$phpEx") . '">', '</a>');
	message_die(GENERAL_MESSAGE, $message);
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400)+(($board_config['max_password_age']<14) ? 1 : 14) >= $board_config['max_password_age'] )
{
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
}
}
// End add - Protect user account MOD

und wie gesagt habe das in der page_header.php ausgebaut
ist nur das popup

Code: Alles auswählen

# 
#-----[ OPEN ]------------------------------------------------ 
# 
includes/page_header.php

# 
#-----[ FIND ]------------------------------------------------ 
#
// Add no-cache control for cookies if they are set

# 
#-----[ BEFORE, ADD ]----------------------------------------- 
#

// Start add - Protect user account MOD
// change password ?
if ($HTTP_GET_VARS['ch_passwd'])
{
		$template->assign_var("PASSWD_POPUP",  
		"<script language=\"Javascript\" type=\"text/javascript\"><!-- 
		   window.open('".append_sid('change_password.'.$phpEx)."', '_phpbbpasswd', 'HEIGHT=400,resizable=yes,WIDTH=600'); 
		  //--> 
		</script>");
}
// End add - Protect user account MOD

was muss ich dann ausbauen ?

[oxpus]

Ja genau das ist es: Aus der login.php muss der Part raus, bzw. draussen bleiben und das Popup aus der page_header.php dann auch, weil es überflüssig wird.
Dann hast Du wirklich Ruhe.

Genauer:
Das hier muss in der login.php drinnen bleiben

Code: Alles auswählen

# 
#-----[ OPEN ]------------------------------------------------ 
# 
login.php

# 
#-----[ FIND ]------------------------------------------------ 
# 
$sql = "SELECT
FROM " . USERS_TABLE . "

# 
#-----[ IN-LINE FIND ]---------------------------------------- 
# 
, user_level

# 
#-----[ IN-LINE AFTER, ADD ]---------------------------------- 
# 
, user_badlogin, user_blocktime, user_email, user_lang, user_timezone,user_passwd_change

# 
#-----[ FIND ]------------------------------------------------ 
# 
if( md5($password) == $row['user_password'] && $row['user_active'] )

# 
#-----[ BEFORE, ADD ]----------------------------------------- 
# 

// Start add - Protect user account MOD
if ($row['user_blocktime']<time() )
{
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
# 
if( $session_id )
{

# 
#-----[ AFTER, ADD ]------------------------------------------ 
#

// Start add - Protect user account MOD
$sql = "UPDATE " . USERS_TABLE . " SET user_badlogin='0'
	WHERE username = '" . str_replace("\'", "''", $username) . "'";
if ( !($result = $db->sql_query($sql)) )
{
	message_die(GENERAL_ERROR, 'Error updating correct login data', '', __LINE__, __FILE__, $sql);
}
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
# 
$redirect = str_replace('?', '&', $redirect);
$template->assign_vars(array(
'META' => 
);

# 
#-----[ AFTER, ADD ]------------------------------------------ 
#

// Start add - Protect user account MOD
if ($row['user_active'] )
{
	//count bad login
	// block the user for X min
	if (($row['user_badlogin']+1) % $board_config['max_login_error'])
	{
		$sql = "UPDATE " . USERS_TABLE . " SET user_badlogin=user_badlogin+1
			WHERE username = '" . str_replace("\'", "''", $username) . "'";
		if ( !($result = $db->sql_query($sql)) )
		{
			message_die(GENERAL_ERROR, 'Error updating bad login data'.$user_ip, '', __LINE__, __FILE__, $sql);
		}
	} else
	{
		$blocktime = ", user_block_by='$user_ip', user_blocktime='" . (time()+($board_config['block_time']*60)) . "'";
		$sql = "UPDATE " . USERS_TABLE . " SET user_badlogin=user_badlogin+1 $blocktime
			WHERE username = '" . str_replace("\'", "''", $username) . "'";
		if ( !($result = $db->sql_query($sql)) )
		{
			message_die(GENERAL_ERROR, 'Error updating bad login data'.$user_ip, '', __LINE__, __FILE__, $sql);
		}

		if ($row['user_email']  && $row['user_blocktime']<(time()-3600))
		{
		      include($phpbb_root_path . 'includes/emailer.'.$phpEx); 
			$server_name = trim($board_config['server_name']);
     	      	$emailer = new emailer($board_config['smtp_delivery']); 
     	       	$emailer->email_address($row['user_email']); 
     	        $email_headers = "To: \"".$row['username']."\" <".$row['user_email']. ">\r
"; 
     	       	$email_headers .= "From: \"".$board_config['sitename']."\" <".$board_config['board_email'].">\r
"; 
     	      	$email_headers .= "X-AntiAbuse: Board servername - " . $server_name . "\r
"; 
     	      	$email_headers .= "X-AntiAbuse: User IP - " . decode_ip($user_ip) . "\r
"; 
		$emailer->use_template('bad_login', $row['user_lang']);
     	       	$emailer->extra_headers($email_headers); 
     		      $emailer->assign_vars(array( 
     		      	'USER' => '"'.$row['username'].'"',
				'BLOCK_TIME' => $board_config['block_time'],
           			'BAD_LOGINS' => $row['user_badlogin']+1, 
				'BLOCK_UNTIL' => create_date ($lang['Time_format'],time()+($board_config['block_time']*60),$row['user_timezone']),
           			'SITENAME' => $board_config['sitename'], 
     	     			'BOARD_EMAIL' => $board_config['board_email'])); 
       	    	$emailer->send(); 
       	    	$emailer->reset(); 
		}
	}
}
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
#
}
}
else
{
$redirect = (
$redirect = str_replace("?", "&", $redirect);

# 
#-----[ BEFORE, ADD ]----------------------------------------- 
#

// Start add - Protect user account MOD
} else
{
	$message = (($lang['Error_login_tomutch'])?$lang['Error_login_tomutch']:$lang['Error_login']) . '<br /><br />' . sprintf($lang['Click_return_login'], '<a href="' . append_sid("login.$phpEx?redirect=$redirect") . '">', '</a>') . '<br /><br />' .  sprintf($lang['Click_return_index'], '<a href="' . append_sid("index.$phpEx") . '">', '</a>');
	message_die(GENERAL_MESSAGE, $message);
}
// End add - Protect user account MOD

und das hier raus

Code: Alles auswählen

# 
#-----[ FIND ]------------------------------------------------ 
# 
redirect(appen

# 
#-----[ BEFORE, ADD ]----------------------------------------- 
#

// Start add - Protect user account MOD
if ($session_id['user_id']!=ANONYMOUS)
{
include($phpbb_root_path . "includes/functions_validate.$phpEx");
$pass_result = validate_complex_password ($username, $password);
if ( $session_id['user_passwd_change']==0 || $pass_result['error']== true)
{
	//force a change of password, do not allow a secound login
	$sql = "UPDATE " . USERS_TABLE . " SET user_passwd_change='-9999'
	WHERE user_id = '" . $session_id['user_id'] . "'";
	if ( !($result = $db->sql_query($sql)) )
	{
		message_die(GENERAL_ERROR, 'Error updating correct login data2', '', __LINE__, __FILE__, $sql);
	}
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400) >= $board_config['max_password_age'])
{
	session_end($session_id['session_id'], $session_id['user_id']);
	$message = $lang['Passwd_have_expired'] . '<br /><br /><a href="'.append_sid("profile.$phpEx?mode=sendpassword").'">'.$lang['Send_new_passwd'].'</a><br /><br />' .  sprintf($lang['Click_return_portal'], '<a href="' . append_sid("portal.$phpEx") . '">', '</a>');
	message_die(GENERAL_MESSAGE, $message);
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400)+(($board_config['max_password_age']<14) ? 1 : 14) >= $board_config['max_password_age'] )
{
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
}
}
// End add - Protect user account MOD

# 
#-----[ FIND ]------------------------------------------------ 
#
else
{
$url =

# 
#-----[ AFTER, ADD ]------------------------------------------ 
#

// Start add - Protect user account MOD
if ($session_id['user_id']!=ANONYMOUS)
{
include($phpbb_root_path . "includes/functions_validate.$phpEx");
$pass_result = validate_complex_password ($username, $password);
if ( $session_id['user_passwd_change']==0 || $pass_result['error']== true)
{
	//force a change of password, do not allow a secound login
	$sql = "UPDATE " . USERS_TABLE . " SET user_passwd_change='-9999'
	WHERE user_id = '" . $session_id['user_id'] . "'";
	if ( !($result = $db->sql_query($sql)) )
	{
		message_die(GENERAL_ERROR, 'Error updating correct login data2', '', __LINE__, __FILE__, $sql);
	}
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400) >= $board_config['max_password_age'])
{
	session_end($session_id['session_id'], $session_id['user_id']);
	$message = $lang['Passwd_have_expired'] . '<br /><br /><a href="'.append_sid("profile.$phpEx?mode=sendpassword").'">'.$lang['Send_new_passwd'].'</a><br /><br />' .  sprintf($lang['Click_return_portal'], '<a href="' . append_sid("portal.$phpEx") . '">', '</a>');
	message_die(GENERAL_MESSAGE, $message);
} else
if (  intval((time()-$session_id['user_passwd_change']) / 86400)+(($board_config['max_password_age']<14) ? 1 : 14) >= $board_config['max_password_age'] )
{
	$url .= ( ereg( "\?" , $url) ) ? '&ch_passwd=1' : '?ch_passwd=1';
}
}
// End add - Protect user account MOD

Auch in der page_header.php den MOD nicht einbauen.

[pepi]

vielen dank funktioniert

[oxpus]

Na sag ich doch