hcu_login.prg

<?php
/*
    Name: hcu_login
    Purpose: This will show the login page, allowing the user to
                            enter username and password, then use radius to authenticate
    Date:       8/2006
*/


    // ** SERVER LOCATION OF MAIN SCRIPTS --- This will be MORK later on
    $menu_link = "https://www.homecu.net/hcuadm";

$monLibrary= dirname(__FILE__) . "/../library";
require_once("$monLibrary/cu_top.i");


$dms_ok=array('username'=>'string','user_password'=>'string',
'btnLogin'=>'string');

dms_import($dms_ok);

    $default_retries = 5;

    // The Tx_hURI cookie is set in ck_hticket cookie check.  It tells where to go
    // after successful login

    $return_address = urldecode($_COOKIE['Tx_hURI']);

    $ip_address = $_SERVER['REMOTE_ADDR'];


    // The ip_address is used later to catch address spoofing.  But Proxy servers
    // confuse the address, so if X-Forward-For is set we use it instead.

    if(isset($btnLogin)) {
        $mode = "VALIDATE";
    } else {
        $mode = "LOGIN";
    }

    $err_string = "";
    $tas_no = "";
    // ** FIRST CHECK VALIDATION

    if ($mode == "VALIDATE") {

    // check the user entries to make sure we have a valid user

        $sql= "SELECT user_name, passwd, ip_range, allowed_scripts, forcechange, failedremain, forceremain
                        FROM dmsmonitorusers
                        WHERE user_name = '" . prep_save($username, 12) . "' ";

        // print $link."\n";

        $user_rs = db_query( $sql, $link);

        // print $user_rs."\n";

        if (!$user_rs) {

            $err_string = "Invalid Username or Password";
            // print "here";

        }

        if (!list($db_username, $saved_passwd, $db_ip_range,
                            $db_allowed_scripts, $db_forcechg, $db_failr, $db_forcer) =
                db_fetch_array($user_rs)) {



            $err_string = "Invalid Username or Password";
        } else {

            $saved_passwd = preg_replace("/ +$/","", $saved_passwd);

            // For development use the following check

            if (!password_verify($user_password, $saved_passwd)) {
                $err_string = "Invalid Username or Password";

                // ** Update the failed retry limit -- and the last failed login attempt date
                $sql = "UPDATE dmsmonitorusers
                                SET failedremain =
                                    CASE    WHEN failedremain > 0 THEN failedremain - 1
                                                WHEN failedremain is null THEN ({$default_retries} -1)
                                                ELSE failedremain
                                    END,
                                    failedlogin = to_char(now(),'YYYY/MM/DD HH24:MI:SS')
                                WHERE user_name = '" . prep_save($username, 12) . "' ";
                $update_rs = db_query( $sql, $link);

                if ($db_failr <= 1 || ($db_forcechg == 'Y' && $db_forcer <= 0)) {
                    $err_string = "Account is Locked";
                }

            } else {

                // ** Successful --- make sure to record a good login
                $sql = "UPDATE dmsmonitorusers
                                SET
                                    failedremain = '{$default_retries}',
                                    priorlogin = lastlogin,
                                    lastlogin = to_char(now(),'YYYY/MM/DD HH24:MI:SS')
                                WHERE user_name = '" . prep_save($username, 12) . "' ";

                $update_rs = db_query( $sql, $link);
            }
        }
        db_free_result($user_rs);

        if ($err_string == "") {

            // ** Bake the Cookie!!!

            DMSBakeCookie($username, $db_forcechg, '');
            header("Location: " . $GLOBALS['return_address']);
            exit;
        } else {
            $mode = "LOGIN";                // Change to setting of login, so they can be forced to reenter the information
        }

    }



    // ** IF VALIDATION FAILED OR REGULAR LOGIN, then SHOW LOGIN SCREEN
    if ($mode == "LOGIN") {
        cu_header("HomeCU Monitor Login");
        print "<LINK REL=stylesheet HREF=\"/monitor/css/monitor.css\" TYPE=\"text/css\">";
        print <<<EOF



            <br><br><br><br>

      <CENTER>
      <FONT SIZE=+1 COLOR="#FF0000">$err_string</FONT>
      <FORM NAME="login" ACTION="hcu_login.prg" METHOD="post">

            <table cellpadding="3" cellspacing="0" border="0" width="300" class='dmsbg'><tr><td>
            <table cellpadding="1" cellspacing="0" border="0" width="100%" bgcolor="white">
                <tr>
                    <td colspan="2" class="bar" align="center">
                        HomeCU Monitor Login
                    </td>
                </tr>
                <tr>
                    <td nowrap align="right" class="hdr">
                        Username:
                    </td>
                    <td nowrap class='dtl'>
                        <input type="text" name="username" size="15" maxlength="12" value="">
                    </td>
                </tr>
                <tr>
                    <td nowrap align="right" class="hdr">
                        Password:
                    </td>
                    <td nowrap class='dtl'>
                        <input type="password" name="user_password" size="10" maxlength="12">
                    </td>
                </tr>
                <tr>
                    <td class='dtl'>&nbsp;</td>
                    <td nowrap class='dtl'>
                        <input type="submit" name="btnLogin" Value="Login">
                    </td>
                </tr>
            </table>
            </td></tr>
        </table>
            <script language="javascript">
                <!--
                function field_focus() {
                    self.focus();
                    document.login.username.focus();
                }
                window.onload = field_focus;
                // -->
            </script>
    </FORM>
EOF;
    }



function DMSBakeCookie ($username, $fchange, $lastupdate) {

     global $ip_address;
     global $chome;
     global $cupg;
     global $self;
     global $host;
     global $MC;
     global $Flang;
     global $SYSENV;


     $secret = 'xoiilh6RFoogeMb4';

     $now = time();


     $expires = $now + (86400 * 30);
     $hash = MD5( $secret .
                  MD5(join (':', array($secret, $now,
                               $expires, $username, $lastupdate)))
                );

    // apache_note function sets some variables for the web server logging process.
    // They are used later to split the logs by credit union.  Not needed elsewhere.

     apache_note("user_name","M:${username}");
     $mycookie="Ctime=$now&Hu=$username&Ch=$hash&Ce=$expires&Clu=$lastupdate";

    // finally set the cookie, and redirect browser to Tx_hURI location

    HCU_setcookie_env($SYSENV, "HCUTicket","$mycookie",0);

    // if forcechange flag is on, redirect to Passchange instead

    if ($fchange == "Y") {
        // ** Force them to the main user screen to change their password

        header($menu_link . "hcuusers.prg?act=1&un=" . urlencode($username));
    } else {
        echo "Location: " . $GLOBALS['return_address'];
        header("Location: " . $GLOBALS['return_address']);
        exit;
    }
}

?>