vb.org Archive - HTTP Authentication by User / pass / ip ranges

ok , this is the first hack i post around here so i hope im doing it ok
if not mods please fix me :P
ok, this hack is ment for closed comunity of vbulltien forums that want exstra security against unwelcome guests

this hack adds HTTP Authentication which change acording to username / password

to make the security bit higher i added ip ranges part - mean every users got ip range and if his ip is not wellcome then its not let him in
(can help abit against shared account).

ok so lets start

// run this db query

PHP Code:


		
			
ALTER TABLE user ADD ipmasks varchar(250) NOT NULL default '';

// open the file admincp/user.php

find :

PHP Code:


		
			
print_input_row($vbphrase['email'], 'user[email]', $user['email'], 0);

below it add :

PHP Code:


		
			
print_input_row('ip masks', 'user[ipmasks]', $user['ipmasks'], 0);

save the file and upload it back to your server

ok, now u got 2 options :
option1 - put it only in root dir
option2 - put itin root and on admincp/modcp dir

ok
if option 1 then
// open root/global.php

find :

PHP Code:


		
			
require_once('./includes/init.php');

Below it add :

PHP Code:


		
			
//HTACCESS Hack + IP restriction

if (!isset($_SERVER['PHP_AUTH_USER'])) {

    header('WWW-Authenticate: Basic realm="Restricted area"');

    header("HTTP/1.0 401 Unauthorized");

    echo "Unauthorized login attempts are logged.\n";

    echo "bla";

    exit;

} else {

    //checking database

    $userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");

    $isvalidip=0;

    if($userinf['userid']){

        // if user exists check if ip is valid $REMOTE_ADDR

        $validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");

        $validip=explode(" ",$validip['ipmasks']);

        foreach($validip as $testip){

            if ($testip=='') { continue; }

            if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$testip){

                $isvalidip=1;

                break;

            }

        }

    }

    //checking if the user login is ok & that he connects from a valid ip

    

        $salt = $userinf['salt'];

        $pass = $userinf['password'];

        $userp = md5(md5($_SERVER['PHP_AUTH_PW']) . $salt);

        

    



        

    if ($pass != $userp) {

        //we have a looser:)

        header('WWW-Authenticate: Basic realm="Restricted area"'); 

        header('HTTP/1.0 401 Unauthorized'); 

        echo "Unauthorized login attempts are logged.\n";

        exit;

    }elseif(!$isvalidip){

        header('HTTP/1.0 401 Unauthorized'); 

        echo "Your Ip is not allowed here...Unauthorized login attempts are logged.\n";

        exit;

    }

}

//HTACCESS Hack + IP restriction (end)

save the file and upload it back to your server

now if u want option 2 then :

open includes/init.php

find :

PHP Code:


		
			
    $DB_site->connect($servername, $dbusername, $dbpassword, $usepconnect);

Below it add :

PHP Code:


		
			
//HTACCESS Hack + IP restriction

if (!isset($_SERVER['PHP_AUTH_USER'])) {

    header('WWW-Authenticate: Basic realm="Restricted area"');

    header("HTTP/1.0 401 Unauthorized");

    echo "Unauthorized login attempts are logged.\n";

    echo "bla";

    exit;

} else {

    //checking database

    $userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");

    $isvalidip=0;

    if($userinf['userid']){

        // if user exists check if ip is valid $REMOTE_ADDR

        $validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");

        $validip=explode(" ",$validip['ipmasks']);

        foreach($validip as $testip){

            if ($testip=='') { continue; }

            if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$testip){

                $isvalidip=1;

                break;

            }

        }

    }

    //checking if the user login is ok & that he connects from a valid ip

    

        $salt = $userinf['salt'];

        $pass = $userinf['password'];

        $userp = md5(md5($_SERVER['PHP_AUTH_PW']) . $salt);

        

    



        

    if ($pass != $userp) {

        //we have a looser:)

        header('WWW-Authenticate: Basic realm="Restricted area"'); 

        header('HTTP/1.0 401 Unauthorized'); 

        echo "Unauthorized login attempts are logged.\n";

        exit;

    }elseif(!$isvalidip){

        header('HTTP/1.0 401 Unauthorized'); 

        echo "Your Ip is not allowed here...Unauthorized login attempts are logged.\n";

        exit;

    }

}

//HTACCESS Hack + IP restriction (end)

thats all

*WARNING - IN ANY WAY DONT USE BOTH OPTIONS
its will cuse to the page ask for several time the user/pass
and its will be very buggy.

note :
if user got dynamic ips for exsample :

143.229.64.58
143.229.78.99
145.88.45.68

just add it like that
143.229 145.88
with 1 space between each ip range
dont user * as wildcard.

thats all :P
if u got some qustions or anything , then im here to suport u guys.

Sorry for my very bad english.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01172 seconds Memory Usage 1,796KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (8)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (2)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: