This mod adds a login flood feature to your forums.
From the Readme
Description
Adds a login flood check to the forums
Users are given a specified number of attempts to login
Users that exceed the limit are redirected to the password recovery page if email is on or a warning page if email is off
Users that exceed the limit must wait a specified amount of time before attempting to login again
If a user tries to login during the waiting period, the waiting period starts all over and they are redirected to the password recovery page or login warning, depending on forum email
There is a grace period between login attempts
Features
Admin on/off switch
Admin sets login attempts
Admin sets waiting period
Admin on/off switch for grace period
Admin sets grace period
It uses session variables to keep track of failed login attempts and hold the delay and grace period times.
Installation: Easy (It took me about 4 minutes useing the Readme)
I recommend useing the readme file to install the mod. If you have a problem you can double check your code changes by looking a the reference files, just search the file for "Login Flood to find the changes.
There is some code near the top of the "inc_header.asp" reference file. It is not part of the mod! I left it there for people who wanted to test the functionality of the mod. It gives you an idea of whats going on. It should be removed when you are through testing.
If you have questions ask them here but if you have a problem installing the mod, please start a new topic in the "Help: Mod Implementation" forum. Be sure to mention "login flood" in the title.
thanks so much for this one! I don't know if they are bots or hackers or both, but we get hundreds of attempts a DAY sometimes. This oughtta fix em a little...
However, I have one small problem. I used a demo account to try the login process. I failed on purpose to login in the specified number of attempts. It then takes me to the password recovery page. But then I tried to log in with my admin account and it would not let me. It seemed to think my other account was the same one that failed to log in. Is that a cookie issue?
Also, on your password2.asp page, you need to add the parts in red below:
<% '########################################################################## '## ## '## Login Flood Control mod for Snitz Forums ## '## ## '## This is not an original Snitz Forum file ## '## ## '########################################################################## %>
Is it possible to have the final failed login attempt go to the password2.asp page even if email is enabled? I want them to know what happened and that they will have to wait. I've already changed my inc_header.asp page to direct them to log in, go to the password recovery page, and to tell them they only have a certain number a tries to attempt to log in.
I did this by changing my inc_header.asp page from this:
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Your username and/or password were incorrect.</font></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Please either try again or register for an account.</font></p>" & vbNewLine
else
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>You logged on successfully!</font></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Thank you for your participation.</font></p>" & vbNewLine
end if
Response.Write "<meta http-equiv=""Refresh"" content=""2; URL=" & strReferer & """>" & vbNewLine & _
to this:
Response.Write "<p align=""center""><b><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Your username and/or password were incorrect.</font></b></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Please either <a href=""login.asp"">try again</a> or <a href=""policy.asp"">register for an account</a>.</font></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>If you forgot your password, <a href=""password.asp"">click here</a>.</font></p>" & vbNewLine
if cLng(intLoginFloodControl) = 1 then
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Please note that if after " & intLoginAttempts & " login attempts you will have to wait " & intLoginCheckTime & " minutes before trying again.</font></p>" & vbNewLine
else
Response.Write "" & vbNewLine
end if
Response.Write "<meta http-equiv=""Refresh"" content=""60; URL=" & strReferer & """>" & vbNewLine
else
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>You logged on successfully!</font></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Thank you for your participation.</font></p>" & vbNewLine
end if
Response.Write "<meta http-equiv=""Refresh"" content=""2; URL=" & strReferer & """>" & vbNewLine & _
Note: the part in red is because I have a version earlier than 3.4.07. If you have the newest version, you will want to change that part to register.asp.
Is it possible to have the final failed login attempt go to the password2.asp page even if email is enabled?
Well I figured out a way to do it. The easiest thing to do but probably not the best was to change both references to password.asp in inc_func_common.asp to password2.asp.
if cLng(strEMail) = 1 then Response.Redirect("password2.asp") else Response.Redirect("password2.asp") end if
if cLng(strEMail) = 1 then
Response.Redirect("password.asp")
else
Response.Redirect("password2.asp")
end if
with
Response.Redirect("password2.asp")
I would suggest adding your message to password.asp. The code is the sub ShowForm() on line 225.
And your other question, it's an asp cookie thing :). The server still thinks you're the same guy that had all the failed attempts. It doesn't check your login info until the wait is over.
That's one purpose of the mod, to slow down login hits by hackers and maybe bots. The other is to remind legitamate users that there is password recovery (if email is on).
Thanks for the bug fix :). That's what happens when I make code changes after testing.
I have one more question. During the waiting period before you can log back in, if you close the browser and then reopen it you don't have to wait any longer. Is their a way to make the cookie wait the specified period of time even if the user closes and then reopens the browser? I was using IE8.
thanks so much for this one! I don't know if they are bots or hackers or both, but we get hundreds of attempts a DAY sometimes. This oughtta fix em a little...
I need a little help to the modification that I made.
I have this:
Response.Write "<p align=""center""><b><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Your username and/or password were incorrect.</font></b></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Please either <a href=""login.asp"">try again</a> or <a href=""policy.asp"">register for an account</a>.</font></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>If you forgot your password, <a href=""password.asp"">click here</a>.</font></p>" & vbNewLine
if cLng(intLoginFloodControl) = 1 then
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Please note that if after " & intLoginAttempts & " login attempts you will have to wait " & intLoginCheckTime & " minutes before trying again.</font></p>" & vbNewLine
else
Response.Write "" & vbNewLine
end if
Response.Write "<meta http-equiv=""Refresh"" content=""60; URL=" & strReferer & """>" & vbNewLine
else
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>You logged on successfully!</font></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Thank you for your participation.</font></p>" & vbNewLine
end if
Response.Write "<meta http-equiv=""Refresh"" content=""2; URL=" & strReferer & """>" & vbNewLine & _
The part is red is supposed to only work if they did not log in correctly. It seems to work for IE and Opera but when I tried it in Safari and Firefox it did not work. It seemed to instead do the part in green. Do I have the red part in the right place?
After the set number of failed log-in attempts, what exactly does the user see? I would like them to see something very similar to what leatherlips posted above in the 5th post. Is a change to inc_header the only necessary step?
After the set number of failed log-in attempts, what exactly does the user see? I would like them to see something very similar to what leatherlips posted above in the 5th post. Is a change to inc_header the only necessary step?
The way the mod is, after the number of failed log in attempts, the user will see the following:
1. If you have email enabled they will be taken to the your password.asp page.
2. If you have email disable, they will be taken to the password2.asp page which tells them they have exceeded the number of log in attempts and will have to wait the specified period of time.
Login Flood Control
Posted - 03 July 2009 : 13:23:02
