return $this->logout();
}
+ if(!empty($_REQUEST['user_has_oath'])) {
+ return $this->checkUserOath();
+ }
+
// general query...
if (!empty($_REQUEST['getAuthUser'])) {
//DB_Dataobject::debugLevel(5);
$this->sendAuthUserDetails();
exit;
-
+ }
+
+ if(!empty($_REQUEST['check_owner_company'])) {
+ $core_company = DB_DataObject::factory('core_company');
+ $core_company->comptype = 'OWNER';
+ $this->jok($core_company->count());
}
// might be an idea to disable this?!?
$this->switchPublicUser($_REQUEST['loginPublic']);
}
-
$this->jerr("INVALID REQUEST");
exit;
}
function logout()
{
$ff = class_exists('HTML_FlexyFramework2') ? HTML_FlexyFramework2::get() : HTML_FlexyFramework::get();
- //DB_DAtaObject::debugLevel(1);
+
+ //DB_DAtaObject::debugLevel(1);
$u = $this->getAuthUser();
//print_r($u);
if ($u) {
}
-
function switchUser($id)
{
$tbl = empty($ff->Pman['authTable']) ? 'core_person' : $ff->Pman['authTable'];
$au = $u->getAuthUser();
-
// first check they have perms to do this..
if (!$au|| ($au->company()->comptype != 'OWNER') || !$this->hasPerm('Core.Person', 'E')) {
$this->jerr("User switching not permitted");
}
-
-
+
$u = DB_DataObject::factory($tbl);
$u->get($id);
if (!$u->active()) {
}
$u->login();
// we might need this later..
- $this->addEvent("SWITCH USER", false, $au->name . ' TO ' . $u->name);
+ $this->addEvent("SWITCH-USER", false, $au->name . ' TO ' . $u->name);
$this->jok("SWITCH");
}
{
//DB_DataObject::debugLevel(1);
- $this->ip_checking();
-
if (!empty($_REQUEST['getAuthUser'])) {
$this->sendAuthUserDetails();
exit;
$u = DB_DataObject::factory($tbl);
-
-
+ $ip = $this->ip_lookup();
// ratelimit
- if (!empty($_SERVER['REMOTE_ADDR'])) {
+ if (!empty($ip)) {
//DB_DataObject::DebugLevel(1);
$e = DB_DataObject::Factory('Events');
$e->action = 'LOGIN-BAD';
- $e->ipaddr = $_SERVER['REMOTE_ADDR'];
+ $e->ipaddr = $ip;
$e->whereAdd('event_when > NOW() - INTERVAL 10 MINUTE');
if ($e->count() > 5) {
$this->jerror('LOGIN-RATE', "Login failures are rate limited - please try later");
}
if(!empty($u->oath_key) && empty($_REQUEST['oath_password'])){
- $this->jerror('LOGIN-BAD','Your account require Two-Factor Authentication');
+ $this->jerror('LOGIN-BAD','Your account requires Two-Factor Authentication');
}
// check if config allows non-owner passwords.
exit;
}
+ $this->ip_checking();
+
$u->login();
// we might need this later..
$this->addEvent("LOGIN", false, session_id());
));
$core_ip_access->insert();
+
+ return;
}
$core_ip_access = DB_DataObject::factory('core_ip_access');
'ip' => $ip,
'created_dt' => $core_ip_access->sqlValue("NOW()"),
'authorized_key' => md5(openssl_random_pseudo_bytes(16)),
- 'status' => 0
+ 'status' => 0,
+ 'email' => (empty($_REQUEST['username'])) ? '' : $_REQUEST['username'],
+ 'user_agent' => (empty($_SERVER['HTTP_USER_AGENT'])) ? '' : $_SERVER['HTTP_USER_AGENT']
));
$core_ip_access->insert();
$core_ip_access->sendXMPP();
$this->jerr('NEW-IP-ADDRESS', array('ip' => $ip));
+
+ return;
}
- $core_ip_access->sendXMPP();
- exit;
-
if(empty($core_ip_access->status)){
$this->jerr('PENDING-IP-ADDRESS', array('ip' => $ip));
}
if($core_ip_access->status == -1){
$this->jerr('BLOCKED-IP-ADDRESS', array('ip' => $ip));
+ return;
}
+ if($core_ip_access->status == -2 && strtotime($core_ip_access->expire_dt) < strtotime('NOW')){
+ $this->jerr('BLOCKED-IP-ADDRESS', array('ip' => $ip));
+ return;
+ }
-
+ return;
}
function ip_lookup()
return $_SERVER['REMOTE_ADDR'];
}
-
-
}