Version: 1.00, by miz
Developer Last Online: Sep 2005
Version: 3.0.0
Rating:
Released: 04-15-2004
Last Update: Never
Installs: 12
No support by the author.
ok , this is the first hack i post around here so i hope im doing it ok
if not mods please fix me :P
ok, this hack is ment for closed comunity of vbulltien forums that want exstra security against unwelcome guests
this hack adds HTTP Authentication which change acording to username / password
to make the security bit higher i added ip ranges part - mean every users got ip range and if his ip is not wellcome then its not let him in
(can help abit against shared account).
ok so lets start
// run this db query
PHP Code:
ALTER TABLE user ADD ipmasks varchar(250) NOT NULL default '';
ok, now u got 2 options :
option1 - put it only in root dir
option2 - put itin root and on admincp/modcp dir
ok
if option 1 then
// open root/global.php
find :
PHP Code:
require_once('./includes/init.php');
Below it add :
PHP Code:
//HTACCESS Hack + IP restriction
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Restricted area"');
header("HTTP/1.0 401 Unauthorized");
echo "Unauthorized login attempts are logged.\n";
echo "bla";
exit;
} else {
//checking database
$userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");
$isvalidip=0;
if($userinf['userid']){
// if user exists check if ip is valid $REMOTE_ADDR
$validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");
$validip=explode(" ",$validip['ipmasks']);
foreach($validip as $testip){
if ($testip=='') { continue; }
if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$testip){
$isvalidip=1;
break;
}
}
}
//checking if the user login is ok & that he connects from a valid ip
//HTACCESS Hack + IP restriction
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Restricted area"');
header("HTTP/1.0 401 Unauthorized");
echo "Unauthorized login attempts are logged.\n";
echo "bla";
exit;
} else {
//checking database
$userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");
$isvalidip=0;
if($userinf['userid']){
// if user exists check if ip is valid $REMOTE_ADDR
$validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");
$validip=explode(" ",$validip['ipmasks']);
foreach($validip as $testip){
if ($testip=='') { continue; }
if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$testip){
$isvalidip=1;
break;
}
}
}
//checking if the user login is ok & that he connects from a valid ip
You know what would be nice? A hack that checks the 1st IP # of the visiting user (Ex: 233.x.x.x) against the registration ip on file in the User database. This would require no inputing of data on the admins part. If it doesn't match, it kicks them out.
You know what would be nice? A hack that checks the 1st IP # of the visiting user (Ex: 233.x.x.x) against the registration ip on file in the User database. This would require no inputing of data on the admins part. If it doesn't match, it kicks them out.
im sorry for not supporting this thread my linicence removed but its back now
ok so about the qoute , what if user changes his compeny ? or user have diff ip masks for exsample in israel netvision got something like 4 diff ip masks
Quote:
Originally Posted by bloodcult
nice hack, it's possible that the user logged in when they autenticate with this method?
you mean like when users put his user/pass on the http auth then its auto login him to forums ? well if the answer is yes then its not should be a problem just add query that will run login.php with username + password
note : dont use get methood cuse then you will have a major security problem
but if you want i think i can make your life bit more easy and do it for you
I also have another question about it. Suppose I had installed it partially (just added the ipmasks field), and I wanted to autofill this with the ip-information from the post table.
Such a thing would take time... so I figure a script to do this would be nice also.
I placed TripLcixx's code in the global.php file... I get the authentication box, but it will not accept any username/password combination, any suggestions would be greatly appreciated.
Also,
Anything new with being able to auto-login? That would be great, but is a little above my head to develope right now.