'.$page_title.'

"; //var_dump($_SESSION); //echo ""; if (isset($_POST['submit'])) { $u = strtoupper($_POST['username']); $p = strtoupper($_POST['password']); $u = trim($u); $p = trim($p); // SANITIZE LOGON $eviltext = '[#|:~!()@&%$^?<>`*\;\[\]\{\}\/\\\\]'; if (eregi($eviltext, $u)) { $u = ereg_replace($eviltext,'',$u); } if (strlen($u) > 60) { $u = substr($u, 0, 60); } if (eregi($eviltext, $p)) { $p = ereg_replace($eviltext,'',$p); } if (strlen($p) > 40) { $p = substr($p, 0, 40); } $u = mysql_real_escape_string ($u); $p = mysql_real_escape_string ($p); // GRAB IP, SET TIME RANGE FOR LOGONS if (getenv("HTTP_CLIENT_IP")) { $ip = getenv("HTTP_CLIENT_IP"); } else if(getenv("HTTP_X_FORWARDED_FOR")) { $ip = getenv("HTTP_X_FORWARDED_FOR"); } else if(getenv("REMOTE_ADDR")) { $ip = getenv("REMOTE_ADDR"); } else { $ip = "UNKNOWN"; } $date = date("Y-m-d"); require_once ($db_path.'/access.php'); // Connect to the db. if ($u != 'GUEST') { // CHECK THE BANNED IP LIST $query = 'SELECT ip FROM events WHERE ip="'.$ip.'" AND timestamp LIKE "'.$date.'%" AND event_type="99"'; $result = @mysql_query ($query); // Run the query. $count = mysql_num_rows($result); // CHECK FOR ADMIN OVERRIDE $query2 = 'SELECT ip FROM events WHERE ip="'.$ip.'" AND timestamp LIKE "'.$date.'%" AND event_type="98"'; $result2 = @mysql_query ($query2); // Run the query. $count2 = mysql_num_rows($result2); if (($count > 0) && ($count2 == 0)) { $message = 'TOO MANY FAILURES - LOGON DISABLED'; // LOG THE FAILED ATTEMPT $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"3", "'.$u.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. } else { $queryx = "SELECT * FROM users WHERE user = '$u' AND password = MD5('$p') AND user_year = $year"; $resultx = @mysql_query ($queryx); // Run the query. $countx = mysql_num_rows($resultx); if ($countx == 0) { $message = 'Invalid Username or Password'; // LOG THE FAILED ATTEMPT $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"2", "'.$u.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. // CHECK FOR MULTIPLE FAILED ATTEMPTS $check_query = 'SELECT ip FROM events WHERE ip="'.$ip.'" AND '. 'timestamp LIKE "'.$date.'%" AND event_type="2"'; $check_result = @mysql_query ($check_query); // Run the query. $check_count = mysql_num_rows($check_result); if ($check_count > 10) { // BLOCK IP $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"99", "'.$u.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. //$disable_query = 'UPDATE users SET disabled=1 where user="'.$u.'"'; //$result = @mysql_query ($disable_query); // Run the query. } } if ($countx == 1) { while ($row = mysql_fetch_array ($resultx, MYSQL_ASSOC)) { if ($row['disabled'] == 1) { $message = 'Account Disabled'; // LOG THE FAILED ATTEMPT $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"3", "'.$u.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. } else { $_SESSION['logon'] = '1'; $_SESSION['user_id'] = $row['user_id']; $_SESSION['user'] = $row['user']; $_SESSION['company'] = $row['company']; $_SESSION['auth_level'] = $row['auth_level']; $_SESSION['year'] = $year; // LOG THE EVENT $querykeys = 'event_type, user, user_id, ip, timestamp'; $queryvalues = '"1", "'.$u.'", "'.$row['user_id'].'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. mysql_close(); // Close the database connection. if ($_SESSION['user'] == 'rchbf' && $_SESSION['auth_level'] > 0) { header('Location: rchbf_votes.php'); exit(); } if ($_SESSION['auth_level'] >= '2') { // header ('HTTP/1.0 302 Found'); // echo ' '; header('Location: admin.php'); exit(); } else { // header ('HTTP/1.0 302 Found'); // echo ' '; header('Location: proxy.php'); exit(); } } } } } mysql_close(); // Close the database connection. } } $_SESSION['year'] = $year; $_SESSION['user'] = ''; $_SESSION['user_id'] = ''; $_SESSION['company'] = ''; $_SESSION['logon'] = ''; $_SESSION['auth_level'] = 0; echo ' '.$page_title.' '; exit(); ?>