End-User Options - Second Level Login by liamwli

THIS MOD IS FOR VBULLETIN 4.1.0+

This modification provides a feature for users of your forum to request a code via email on login, which is then needed to complete the login process.

This mod is similar to the Infinity: Dual Authentication LITE modification.

This mod differs in a few aspects however:

1. You have the ability to force usergroups to use this mod
2. This mod only has the second code option
3. This mod doesn't stop people accessing the usercp if you don't want them to use this mod

Like I said, you have the ability to force usergroups to use this mod. If a user is in a usergroup you have forced, then they will get an error when they view the forumhome if they have't enabled this mod on their account.

As well as that, there is an option for Admin's to specify their own custom code algorithm. This will allow Admin's to choose how the random second code is generated, if they so wish.

Screenshots below. Please mark as installed for more support.

Changelog:
1.1.0
Added hooks to allow further development
Removed unused plugin

1.0.1
Fixed mutiple SQL Injection vulnerabilities.

1.0
Initial Release

[liamwli]

Originally Posted by Nirjonadda

Yes ! I think when login with 1st password we get Second Level Login page but cannot 1st login with main password !

Right, when you login with the main system on the homepage, where does it take you?

Please could you screenshot. It should take you a plain page with only a text box and some text, asking you to enter the second code sent to your email address.

[Nirjonadda]

when i login with the main system on the homepage get error page,
vBulletin Message
You have entered an invalid username or password.

[liamwli]

Originally Posted by Nirjonadda

when i login with the main system on the homepage get error page,
vBulletin Message
You have entered an invalid username or password.

Just like you would with an invalid username or password really?

Please could you delete all your cookies first (could be a browser issue, I got this only once).

After that, reinstall the mod.

[Nirjonadda]

Does not fixed this issue , uninstalled this mod , reason it make high server load with use many more RAM memory !

[liamwli]

Originally Posted by Nirjonadda

Does not fixed this issue , uninstalled this mod , reason it make high server load with use many more RAM memory !

These types of mods do generally cause a small increase in server load.

I will attempt to fix all issues and optimize code in a future version

[MegaManSec]

it has an sql injection in it. (probably more than just one)

	$vbulletin->input->clean_array_gpc('p', array(
		'vb_login_username'        => TYPE_STR,
		'vb_login_password'        => TYPE_STR,
		'vb_login_md5password'     => TYPE_STR,
		'vb_login_md5password_utf' => TYPE_STR,
		'postvars'                 => TYPE_BINARY,
		'cookieuser'               => TYPE_BOOL,
		'logintype'                => TYPE_STR,
		'cssprefs'                 => TYPE_STR,
		'inlineverify'             => TYPE_BOOL,
		'redirect'                 => TYPE_NOHTML));

	//get userinfo
	$userinfo = $vbulletin->db->query_first("SELECT * FROM " . TABLE_PREFIX . "user WHERE username='" . $vbulletin->GPC['vb_login_username'] . "'");

[liamwli]

Originally Posted by MegaManSec

it has an sql injection in it. (probably more than just one)

	$vbulletin->input->clean_array_gpc('p', array(
		'vb_login_username'        => TYPE_STR,
		'vb_login_password'        => TYPE_STR,
		'vb_login_md5password'     => TYPE_STR,
		'vb_login_md5password_utf' => TYPE_STR,
		'postvars'                 => TYPE_BINARY,
		'cookieuser'               => TYPE_BOOL,
		'logintype'                => TYPE_STR,
		'cssprefs'                 => TYPE_STR,
		'inlineverify'             => TYPE_BOOL,
		'redirect'                 => TYPE_NOHTML));

	//get userinfo
	$userinfo = $vbulletin->db->query_first("SELECT * FROM " . TABLE_PREFIX . "user WHERE username='" . $vbulletin->GPC['vb_login_username'] . "'");

No, it doesn't. That code is only run if the username and password are correct.

Check the if statement at the top.

For this to work, someone would have to have a username that contained the SQLi.

[MegaManSec]

Originally Posted by liamwli

No, it doesn't. That code is only run if the username and password are correct.

Check the if statement at the top.

For this to work, someone would have to have a username that contained the SQLi.

????

go directly to liam_sll.php
if (($_POST['do'] == 'login') && ($vbulletin->options['liam_dualauth_onoff']))

set post 'do' to login

[BirdOPrey5]

Mod restored from Quarantine.

[Skyrider]

Awesome mod, but for now I've disabled it. For some odd reasons after too many code submissions and testing the plugin, I was unable to log in on my own account saying I've entered an incorrect username/password. by disabling the mod, everything ran fine again and I was able to login normally.