ViciDial/ViciDialSVN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added several security changes to the admin interface, including freezing a user's account for 15 minutes after 10 failed login attempts.

Browse Source 
Added 3 new reports to the admin interface: url log, lagged log and user group login reports
Added new AST_phone_update.pl --agent-lookup flag to allow for logging of the IP address of the agent's SIP or IAX phone connection. Can be enabled as a crontab entry to perform the lookups on each asterisk server.

git-svn-id: svn://192.168.202.10@1997 3d104415-ff17-0410-8863-d5cf3c621b8a
This commit is contained in:
mattf
2013-07-02 06:00:53 +00:00
parent d585504151
commit cf21ae391e
112 changed files with 8058 additions and 4242 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agc_2-X/trunk/www/vicidial/functions.php
+111 -7
View File
@@ -1,10 +1,10 @@
<?php
#
# functions.php version 2.4
# functions.php version 2.8
#
# functions for administrative scripts and reports
#
# Copyright (C) 2012 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
# Copyright (C) 2013 Matt Florell <vicidial@gmail.com> LICENSE: AGPLv2
#
#
# CHANGES:
@@ -14,9 +14,107 @@
# 120125-1235 - Small changes to max stats function to allow for total system stats
# 120213-1417 - Changes to allow for ra stats
# 120713-2137 - Added download function for max stats
# 130615-2111 - Added user authentication function and login lockout for 15 minutes after 10 failed login
#
##### reformat seconds into HH:MM:SS or MM:SS #####
##### BEGIN validate user login credentials, check for failed lock out #####
function user_authorization($user,$pass,$user_option,$user_update)
{
require("dbconnect.php");
#############################################
##### START SYSTEM_SETTINGS LOOKUP #####
$stmt = "SELECT use_non_latin,webroot_writable,pass_hash_enabled,pass_key,pass_cost FROM system_settings;";
$rslt=mysql_query($stmt, $link);
if ($DB) {echo "$stmt\n";}
$qm_conf_ct = mysql_num_rows($rslt);
if ($qm_conf_ct > 0)
{
$row=mysql_fetch_row($rslt);
$non_latin = $row[0];
$SSwebroot_writable = $row[1];
$SSpass_hash_enabled = $row[2];
$SSpass_key = $row[3];
$SSpass_cost = $row[4];
}
##### END SETTINGS LOOKUP #####
###########################################
$STARTtime = date("U");
$TODAY = date("Y-m-d");
$NOW_TIME = date("Y-m-d H:i:s");
$ip = getenv("REMOTE_ADDR");
$browser = getenv("HTTP_USER_AGENT");
$LOCK_over = ($STARTtime - 900); # failed login lockout time is 15 minutes(900 seconds)
$LOCK_trigger_attempts = 10;
$user = preg_replace("/\'|\"|\\\\|;/","",$user);
$pass = preg_replace("/\'|\"|\\\\|;/","",$pass);
$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 7 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";
if ($user_option == 'REPORTS')
{$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 6 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";}
if ($user_option == 'REMOTE')
{$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 3 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";}
if ($user_option == 'QC')
{$stmt="SELECT count(*) from vicidial_users where user='$user' and pass='$pass' and user_level > 1 and active='Y' and ( (failed_login_count < $LOCK_trigger_attempts) or (UNIX_TIMESTAMP(last_login_date) < $LOCK_over) );";}
if ($DB) {echo "|$stmt|\n";}
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$row=mysql_fetch_row($rslt);
$auth=$row[0];
if ($auth < 1)
{
$auth_key='BAD';
$stmt="SELECT failed_login_count,UNIX_TIMESTAMP(last_login_date) from vicidial_users where user='$user';";
if ($non_latin > 0) {$rslt=mysql_query("SET NAMES 'UTF8'");}
$rslt=mysql_query($stmt, $link);
$cl_user_ct = mysql_num_rows($rslt);
if ($cl_user_ct > 0)
{
$row=mysql_fetch_row($rslt);
$failed_login_count = $row[0];
$last_login_date = $row[1];
if ($failed_login_count < $LOCK_trigger_attempts)
{
$stmt="UPDATE vicidial_users set failed_login_count=(failed_login_count+1),last_ip='$ip' where user='$user';";
$rslt=mysql_query($stmt, $link);
}
else
{
if ($LOCK_over > $last_login_date)
{
$stmt="UPDATE vicidial_users set last_login_date=NOW(),failed_login_count=1,last_ip='$ip' where user='$user';";
$rslt=mysql_query($stmt, $link);
}
else
{$auth_key='LOCK';}
}
}
if ($SSwebroot_writable > 0)
{
$fp = fopen ("./project_auth_entries.txt", "a");
fwrite ($fp, "ADMIN|FAIL|$NOW_TIME|$user|$auth_key|$ip|$browser|\n");
fclose($fp);
}
}
else
{
if ($user_update > 0)
{
$stmt="UPDATE vicidial_users set last_login_date=NOW(),last_ip='$ip',failed_login_count=0 where user='$user';";
$rslt=mysql_query($stmt, $link);
}
$auth_key='GOOD';
}
return $auth_key;
}
##### END validate user login credentials, check for failed lock out #####
##### BEGIN reformat seconds into HH:MM:SS or MM:SS #####
function sec_convert($sec,$precision)
{
$sec = round($sec,0);
@@ -71,9 +169,10 @@ function sec_convert($sec,$precision)
return "$Ftime";
}
}
##### END reformat seconds into HH:MM:SS or MM:SS #####
##### counts like elements in an array, optional sort asc desc #####
##### BEGIN counts like elements in an array, optional sort asc desc #####
function array_group_count($array, $sort = false)
{
$tally_array = array();
@@ -100,9 +199,10 @@ function array_group_count($array, $sort = false)
return $tally_array;
}
##### END counts like elements in an array, optional sort asc desc #####
##### bar chart using max stats data #####
##### BEGIN bar chart using max stats data #####
function horizontal_bar_chart($campaign_id,$days_graph,$title,$link,$metric,$metric_name,$more_link,$END_DATE,$download_link)
{
$stats_start_time = time();
@@ -197,8 +297,10 @@ function horizontal_bar_chart($campaign_id,$days_graph,$title,$link,$metric,$met
echo "</table>\n";
}
}
##### END bar chart using max stats data #####
##### bar chart using max stats data #####
##### BEGIN download max stats data #####
function download_max_system_stats($campaign_id,$days_graph,$title,$metric,$metric_name,$END_DATE)
{
global $CSV_text, $link;
@@ -283,4 +385,6 @@ function download_max_system_stats($campaign_id,$days_graph,$title,$metric,$metr
$CSV_text.="\n\n";
}
}
?>
##### BEGIN download max stats data #####
?>