Doing that would ease the work of anyone trying to impersonate a user. If you look at most websites, if you have a login error, you always get a similar statement. It's only cautious to do so.
This will check pending and actual members' names against the login attempt. If the name does not exist, the error will reflect that.
Otherwise:
Name exists in active records:
If account is active (not locked), error will show password is incorrect.
If account is locked, error will show account has been locked by administrator.
Name does not exist in active records, but is in pending table. Error will advise member to check Email account provided during registration.
"login.asp"
Look for the following line (appx 105):
if RequestMethod = "POST" and strLoginStatus = 0 then Response.Write(" <font face=""" & strDefaultFontFace & """ size=""" & strDefaultFontSize & """ color=""" & strHiLiteFontColor & """>Your username and/or password was incorrect.</font><br />" & vbNewLine) else Response.Write("<br />" & vbNewLine)
Change it to say:
' ############ Login Details Mod ############
if RequestMethod = "POST" and strLoginStatus = 0 then Response.Write(" <font face=""" & strDefaultFontFace & """ size=""" & strDefaultFontSize & """ color=""" & strHiLiteFontColor & """>" & strError & "</font><br />" & vbNewLine) else Response.Write("<br />" & vbNewLine)
' ############ Login Details Mod ############
Next, look for the following lines (appx 84-87):
WriteFooter
Response.End
end if
end if
Change them to say:
WriteFooter
Response.End
' ############ Login Details Mod ############
else
strSQL = "SELECT M_NAME, M_PASSWORD, M_STATUS FROM " & strMemberTablePrefix & "MEMBERS WHERE M_NAME = '" & strDBNTFUserName & "'"
set rsCheckUser=my_Conn.Execute(strSQL)
if not rsCheckUser.EOF then
strError = "Password does not match user name.<br>"
if rsCheckUser("M_STATUS") = 0 then strError = strError & "Account locked by Administrator.<br>"
rsCheckUser.Close
else
strSQL = "SELECT M_NAME FROM " & strTablePrefix & "MEMBERS_PENDING WHERE M_NAME = '" & strDBNTFUserName & "'"
set rsPending = my_Conn.Execute(strSQL)
if not rsPending.EOF then
strError = "Account pending activation. Check the Email supplied during registration."
rsPending.Close
end if
set rsPending = Nothing
else
strError = "Member name does not exist.<br>"
end if
set rsCheckUser = Nothing
' ############ Login Details Mod ############
end if
end if
"inc_header.asp"
Look for the following lines (appx 314-316):
if strLoginStatus = 0 then
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Your username and/or password were incorrect.</font></p>" & vbNewLine & _
"<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Please either try again or register for an account.</font></p>" & vbNewLine
Change them to say:
if strLoginStatus = 0 then
' ############ Login Details Mod ############
strSQL = "SELECT M_NAME, M_PASSWORD, M_STATUS FROM " & strMemberTablePrefix & "MEMBERS WHERE M_NAME = '" & strDBNTFUserName & "'"
set rsCheckUser=my_Conn.Execute(strSQL)
if not rsCheckUser.EOF then
strError = "Password does not match user name.<br>"
intLocked = 0
if rsCheckUser("M_STATUS") = 0 then
strError = "Account locked by Administrator.<br>"
intLocked = 1
rsCheckUser.Close
end if
else
strSQL = "SELECT M_NAME FROM " & strTablePrefix & "MEMBERS_PENDING WHERE M_NAME = '" & strDBNTFUserName & "'"
set rsPending = my_Conn.Execute(strSQL)
if not rsPending.EOF then
strError = "Account pending activation. Check the Email supplied during registration."
rsPending.Close
else
strError = "Member name does not exist.<br>"
end if
set rsPending = Nothing
end if
set rsCheckUser = Nothing
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>" & strError & "</font></p>" & vbNewLine
if intLocked = 0 then
Response.Write "<p align=""center""><font face=""" & strDefaultFontFace & """ size=""" & strHeaderFontSize & """>Please either try again or register for an account.</font></p>" & vbNewLine
end if
' ############ Login Details Mod ############
is there any option which notice the members about
Posted - 20 November 2010 : 09:05:19
