Daniel/hotel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Always check attempts left first

Browse Source
This commit is contained in:
Abhishek Kumar
2024-06-04 20:23:59 +05:30
parent 2e77acfc90
commit c9ee697254
3 changed files with 66 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

113
classes/controller/FrontController.php
View File

@@ -815,77 +815,80 @@ class FrontControllerCore extends Controller
{
$remoteIpAddress = Tools::getRemoteAddr();
$objMaintenanceAccess = new MaintenanceAccess();
$attemptsCount = $objMaintenanceAccess->getAttemptsCount($email, $remoteIpAddress); // does not include the current one
$attemptsCount = $objMaintenanceAccess->getFailedAttemptsCount($email, $remoteIpAddress); // does not include the current one
$maxAttempts = Configuration::get('PS_ALLOW_EMP_MAX_ATTEMPTS');
if (empty($email)) {
$this->errors[] = Tools::displayError('The Email address field is blank.');
} elseif (!Validate::isEmail($email)) {
$this->errors[] = Tools::displayError('Invalid email address.');
}
if ($attemptsCount >= $maxAttempts) {
if ($lastAttempt = $objMaintenanceAccess->getLastAttempt($email, $remoteIpAddress)) {
$minutesElapsed = round((time() - strtotime($lastAttempt['date_add'])) / 60);
if (empty($passwd)) {
$this->errors[] = Tools::displayError('The Password field is blank.');
} elseif (!Validate::isPasswd($passwd)) {
$this->errors[] = Tools::displayError('Invalid password.');
$this->errors[] = Tools::displayError(sprintf('You have reached the limit of login attempts, please try after %d minutes.', MaintenanceAccess::LOGIN_ATTEMPTS_WINDOW - $minutesElapsed));
}
}
if (!count($this->errors)) {
if ($attemptsCount >= $maxAttempts) {
if ($lastAttempt = $objMaintenanceAccess->getLastAttempt($email, $remoteIpAddress)) {
$minutes = round((time() - strtotime($lastAttempt['date_add'])) / 60);
if (empty($email)) {
$this->errors[] = Tools::displayError('The Email address field is blank.');
} elseif (!Validate::isEmail($email)) {
$this->errors[] = Tools::displayError('Invalid Email address.');
}
$this->errors[] = Tools::displayError(sprintf('You have exceeded the limit of login attempts, please try after %d minutes.', MaintenanceAccess::LOGIN_ATTEMPTS_WINDOW - $minutes));
if (empty($passwd)) {
$this->errors[] = Tools::displayError('The Password field is blank.');
} elseif (!Validate::isPasswd($passwd)) {
$this->errors[] = Tools::displayError('Invalid Password.');
}
if (!count($this->errors)) {
// Find employee
$this->context->employee = new Employee();
$is_employee_loaded = $this->context->employee->getByEmail($email, $passwd);
$employee_associated_shop = $this->context->employee->getAssociatedShops();
if (!$is_employee_loaded) {
$this->errors[] = Tools::displayError('The employee does not exist, or the password provided is incorrect.');
$this->context->employee->logout();
} elseif (empty($employee_associated_shop) && !$this->context->employee->isSuperAdmin()) {
$this->errors[] = Tools::displayError('This employee does not manage the website anymore (either the website has been deleted or permissions have been revoked).');
$this->context->employee->logout();
} else {
// Login successful
// Update cookie
$cookie = Context::getContext()->cookie;
$cookie->enable_maintenance_view = $this->context->employee->id;
$cookie->remote_addr = ip2long($remoteIpAddress);
$cookie->write();
// Reset attempts count on successful login
$objMaintenanceAccess->removeFailedAttempts($email, $remoteIpAddress);
}
}
}
if (!count($this->errors)) {
// Find employee
$this->context->employee = new Employee();
$is_employee_loaded = $this->context->employee->getByEmail($email, $passwd);
$employee_associated_shop = $this->context->employee->getAssociatedShops();
if (count($this->errors)) {
$objMaintenanceAccess = new MaintenanceAccess();
$objMaintenanceAccess->email = $email;
$objMaintenanceAccess->ip_address = $remoteIpAddress;
$objMaintenanceAccess->save();
if (!$is_employee_loaded) {
$this->errors[] = Tools::displayError('The Employee does not exist, or the password provided is incorrect.');
$this->context->employee->logout();
} elseif (empty($employee_associated_shop) && !$this->context->employee->isSuperAdmin()) {
$this->errors[] = Tools::displayError('This employee does not manage the shop anymore (Either the shop has been deleted or permissions have been revoked).');
$this->context->employee->logout();
} else {
// Update cookie
$cookie = Context::getContext()->cookie;
$cookie->enable_maintenance_view = $this->context->employee->id;
$cookie->remote_addr = ip2long($remoteIpAddress);
$cookie->write();
if ($attemptsCount < $maxAttempts) {
$attemptsLeft = $maxAttempts - $attemptsCount - 1;
// Reset attempts count on successful login
$objMaintenanceAccess->removeFailedAttempts($email, $remoteIpAddress);
}
if (count($this->errors)) {
$objMaintenanceAccess = new MaintenanceAccess();
$objMaintenanceAccess->email = $email;
$objMaintenanceAccess->ip_address = $remoteIpAddress;
$objMaintenanceAccess->save();
if ($attemptsCount < $maxAttempts) {
$attemptsLeft = $maxAttempts - $attemptsCount - 1;
if ($attemptsLeft > 0) {
if ($attemptsLeft > 1) {
$this->errors[] = Tools::displayError(sprintf('%d attempts left.', ($maxAttempts - $attemptsCount - 1)));
if ($attemptsLeft > 0) {
if ($attemptsLeft > 1) {
$this->errors[] = Tools::displayError(sprintf('%d attempts left.', ($maxAttempts - $attemptsCount - 1)));
} else {
$this->errors[] = Tools::displayError(sprintf('%d attempt left.', ($maxAttempts - $attemptsCount - 1)));
}
} else {
$this->errors[] = Tools::displayError(sprintf('%d attempt left.', ($maxAttempts - $attemptsCount - 1)));
$this->errors[] = Tools::displayError(sprintf('You have reached the limit of login attempts, please try after %d minutes.', MaintenanceAccess::LOGIN_ATTEMPTS_WINDOW));
}
} else {
$this->errors[] = Tools::displayError(sprintf('You have reached the limit of login attempts, please try after %d minutes.', MaintenanceAccess::LOGIN_ATTEMPTS_WINDOW));
}
}
$this->context->smarty->assign('errors', $this->errors);
$this->context->smarty->assign('errors', $this->errors);
} else {
Tools::redirect('index.php');
}
} else {
Tools::redirect('index.php');
$this->context->smarty->assign('errors', $this->errors);
}
} else {
$this->context->smarty->assign('errors', $this->errors);