Version: .1, by Tekton
Developer Last Online: Jun 2009
Version: 3.0.6
Rating:
Released: 02-12-2005
Last Update: Never
Installs: 2
DB Changes
Is in Beta Stage
No support by the author.
___________
PRE DISCLAIMER: This beta hack has been tested and DOES work; however it IS beta so use at your own risk. (I'm not responsible, etc etc)
???????????
Apparently someone was making a much cooler Draft hack than me (although they've vanished for almost a month now), so I decided to do this in some of my free time. I did a little searching and found no hacks like this, but if there is: please tell me.
Estimated Install Time: ???? [Any questions? This thread only please ]
What is it: This hack allows you the possibility to limit your account login to certain IP addresses (or IP ranges). This would stop people that find out your password if you enable secure login on certain IP addresses (users DON'T have to specify any or do anything and it will work just like it would normally). This is mainly for people concerned with security I guess, plus it's kinda cool as long as you're careful and if you want to restrict access. If someone aquires your password, this would prevent them from using it possibly.
Why is it beta: I haven't had much time to test it out, and I'm not sure how well the checkbit-masking works even though I coded it to be honest ^^;; -- so that's why. It'd be great if you guys/girls could help out. (and the code is kinda sloppy at the moment)
// ###### INSTALLATION ###### First: Using PHPMYADMIN, or your preferred SQL tool, run this query in your vB database.
[sql]ALTER TABLE `user` ADD `secure_ip` VARCHAR( 150 ) DEFAULT '0.0.0.0~0.0.0.0~0!0.0.0.0~0.0.0.0~0!0.0.0.0~0.0.0 .0~0' NOT NULL ;[/sql]
NOTE: Add your table prefix if you have one!
??????????????????????
IN profile.php FIND:
$ve_secure_login="<fieldset class='fieldset'><legend>VE SECURE-LOGIN</legend>
<table cellpadding='0' cellspacing='$stylevar[formspacer]' border='0'>
<tr><td colspan='4' style='border-color: #000000; border-style: solid; border-width: 0px 0px 1px 0px;'>Secure your account by only allowing the IP addresses below to login.
The 'Check Bits' field allows you to specify how much of the IP address to check.
It's values are binary represented by a decimal number. ('255.255.0.0' will check the
first two octets of your entered IP.</td></tr><tr><td><div>IP Address:</div></td><td></td><td><div>Check Bits:</div></td></tr>"
.$ve_construct."<tr><td colspan='3'>
CAUTION: Do not set these values if you do not know what you're
doing as it could cause you to lock yourself out of your account!</td></tr></table></fieldset>";
// make sure they are good vals else set to zero~
$ve_wh=0;while($ve_wh<4){
if($ve_new_i1[$ve_wh]>255||$ve_new_i1[$ve_wh]<0){$ve_new_i1[$ve_wh]=0;}
if($ve_new_c1[$ve_wh]>255||$ve_new_c1[$ve_wh]<0){$ve_new_c1[$ve_wh]=0;}
if($ve_use[$ve_wh]!=1){$ve_use[$ve_wh]=0;}
$ve_wh++;}
// combine into a settable value and UPDATE!
$ve_sec_string=
implode(".", $ve_new_i1)."~".implode(".", $ve_new_c1)."~".$ve_use[0]."!".
implode(".", $ve_new_i2)."~".implode(".", $ve_new_c2)."~".$ve_use[1]."!".
implode(".", $ve_new_i3)."~".implode(".", $ve_new_c3)."~".$ve_use[2];
$DB_site->query("UPDATE ".TABLE_PREFIX."user SET secure_ip = '$ve_sec_string' WHERE userid = '$bbuserinfo[userid]'");
//======= <-- VE SECURE-LOGIN UPDATE END
??????????????????????
IN includes/functions_login.php FIND:
PHP Code:
function verify_authentication($username, $password, $md5password, $md5password_utf, $send_cookies)
{
global $DB_site, $bbuserinfo, $_REQUEST, $_COOKIE;
$username = strip_blank_ascii($username, ' ');
BELOW, ADD:
PHP Code:
//======= VE SECURE-LOGIN CHECK START -->
$ve_secure_check = $DB_site->query_first("SELECT userid, username, secure_ip FROM ".TABLE_PREFIX."user WHERE username = '".addslashes(htmlspecialchars_uni($username))."'");
// Make sure they don't count if they are disabled
if($ve_sub1[2]==0){$ve_can_login[0]=0;}
if($ve_sub2[2]==0){$ve_can_login[1]=0;}
if($ve_sub3[2]==0){$ve_can_login[2]=0;}
//======= <-- VE SECURE-LOGIN CHECK END
NEXT, FIND:
PHP Code:
if (
$bbuserinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $bbuserinfo['salt']), '') AND
$bbuserinfo['password'] != md5($md5password . $bbuserinfo['salt']) AND
$bbuserinfo['password'] != iif($md5password_utf, md5($md5password_utf . $bbuserinfo['salt']), '')
){return false;}
BELOW, ADD:
PHP Code:
//======= VE SECURE-LOGIN DENY START -->
if ($ve_can_login[0]>0||$ve_can_login[1]>0||$ve_can_login[2]>0){return false;}
//======= <-- VE SECURE-LOGIN DENY END
??????????????????????
IN "Modify User Option Templates" modifypassword TEMPLATE FIND:
// ###### END INSTALLATION ######
DONE! PLEASE let me know what you think and help me find the bugs; I KNOW they're in there!
Explanation:
Setting an IP to "12.14.x.x" with the check bits "255.255.0.0" will check the first two octets ("12.14") of the IP address.
x=any value from 0-255
It matches up the bits in the user's IP address to the ones stored for each bit, like so:
11110000.00000100.00000000.00000010 (240.0.4.2) <-- user's IP
11110000.00000100.00000000.00000001 (240.0.4.1) <-- IP stored
11111111.11111111.11111111.00000000 (255.255.255.0) <-- Check Bits
It will only check the bits you have enabled in the "Check Bits" field, so the above example would allow the IP "204.0.4.2" INTO THE ACCOUNT even though it is set to 204.0.4.1 because of the check bits.
There IS some limitation to this method.
___________
POST DISCLAIMER: This beta hack has been tested and DOES work; however it IS beta so use at your own risk. (I'm not responsible, etc etc)
???????????
Show Your Support
This modification may not be copied, reproduced or published elsewhere without author's permission.
Tekton can hack this mod in AdminCP (admincp/user.php?do=modify) !? I should think have one button chose Yes/No in Usergroup for SECURE-LOGIN UPDATE, if chose YES then have Menu in "user.php?do=modify" agree choose IP SECURE-LOGIN in appear new line after IP address (Example : IP SECURE......).
Tekton can hack this mod in AdminCP (admincp/user.php?do=modify) !? I should think have one button chose Yes/No in Usergroup for SECURE-LOGIN UPDATE, if chose YES then have Menu in "user.php?do=modify" agree choose IP SECURE-LOGIN in appear new line after IP address (Example : IP SECURE......).
Can an admin edit other people's IP settings via admincp?
Like someone suggested, I don't think it's a good idea to let users themselves have access to it via usercp. I mean...someone can steal your account and set their IP ranges, hence locking you out.
HELP ME!!! I CAN'T LOGIN MY OWN FORUM CUZ OF THIS HACK!!! I FOLLOWED THE INSTRUCTIONS TO A "T" AND THERE IS A FREAKIN PROBLEM WITH THAT QUERY YOU TOLD US TO RUN IN OUR MYSQL DATABASES!!! AND NOW NO ONE CAN ACCESS MY FORUM!!!
WHAT SHOULD I DO?!
Man, this is a HACK THAT HAS SERIOUSLY GONE WRONG!!!!
Ok. Sorry, I was out of the loop for the past week or so -- very busy.
I was planning to do an admin-able reset, and have it reset when you do the forgot-password thing through email, I just haven't gotten around to it yet.