return password_file($create);
}
+ /** Return key used to group brute force attacks; behind a reverse proxy, you want to return the last part of X-Forwarded-For
+ * @return string
+ */
+ function bruteForceKey() {
+ return $_SERVER["REMOTE_ADDR"];
+ }
+
/** Identifier of selected database
* @return string
*/
}
}
+function add_invalid_login() {
+ global $adminer;
+ $filename = get_temp_dir() . "/adminer.invalid";
+ $fp = @fopen($filename, "r+"); // @ - may not exist
+ if (!$fp) { // c+ is available since PHP 5.2.6
+ $fp = fopen($filename, "w");
+ if (!$fp) {
+ return;
+ }
+ }
+ flock($fp, LOCK_EX);
+ $invalids = unserialize(stream_get_contents($fp));
+ $time = time();
+ if ($invalids) {
+ foreach ($invalids as $ip => $val) {
+ if ($val[0] < $time) {
+ unset($invalids[$ip]);
+ }
+ }
+ }
+ $invalid = &$invalids[$adminer->bruteForceKey()];
+ if (!$invalid) {
+ $invalid = array($time + 30*60, 0); // active for 30 minutes
+ }
+ $invalid[1]++;
+ $serialized = serialize($invalids);
+ rewind($fp);
+ fwrite($fp, $serialized);
+ ftruncate($fp, strlen($serialized));
+ flock($fp, LOCK_UN);
+ fclose($fp);
+}
+
$auth = $_POST["auth"];
if ($auth) {
+ $invalids = unserialize(@file_get_contents(get_temp_dir() . "/adminer.invalid")); // @ - may not exist
+ $invalid = $invalids[$adminer->bruteForceKey()];
+ $next_attempt = ($invalid[1] > 30 ? $invalid[0] - time() : 0); // allow 30 invalid attempts
+ if ($next_attempt > 0) { //! do the same with permanent login
+ auth_error(lang('Too many unsuccessful logins, try again in %d minute(s).', ceil($next_attempt / 60)));
+ }
session_regenerate_id(); // defense against session fixation
$driver = $auth["driver"];
$server = $auth["server"];
cookie("adminer_permanent", implode(" ", $permanent));
}
-function auth_error($exception = null) {
- global $connection, $adminer, $has_token;
+function auth_error($error) {
+ global $adminer, $has_token;
$session_name = session_name();
- $error = "";
if (!$_COOKIE[$session_name] && $_GET[$session_name] && ini_bool("session.use_only_cookies")) {
$error = lang('Session support must be enabled.');
} elseif (isset($_GET["username"])) {
if (($_COOKIE[$session_name] || $_GET[$session_name]) && !$has_token) {
$error = lang('Session expired, please login again.');
} else {
+ add_invalid_login();
$password = get_password();
if ($password !== null) {
- $error = h($exception ? $exception->getMessage() : (is_string($connection) ? $connection : lang('Invalid credentials.')));
if ($password === false) {
$error .= '<br>' . lang('Master password expired. <a href="http://www.adminer.org/en/extension/" target="_blank">Implement</a> %s method to make it permanent.', '<code>permanentLogin()</code>');
}
echo "</div>\n";
echo "</form>\n";
page_footer("auth");
+ exit;
}
if (isset($_GET["username"])) {
$driver = new Min_Driver($connection);
if (!is_object($connection) || !$adminer->login($_GET["username"], get_password())) {
- auth_error();
- exit;
+ auth_error((is_string($connection) ? $connection : lang('Invalid credentials.')));
}
if ($auth && $_POST["token"]) {
return ($function ? ($function == "unixepoch" ? "DATETIME($column, '$function')" : ($function == "count distinct" ? "COUNT(DISTINCT " : strtoupper("$function(")) . "$column)") : $column);
}
-/** Read password from file adminer.key in temporary directory or create one
-* @param bool
-* @return string or false if the file can not be created
+/** Get path of the temporary directory
+* @return string
*/
-function password_file($create) {
- $dir = ini_get("upload_tmp_dir"); // session_save_path() may contain other storage path
- if (!$dir) {
+function get_temp_dir() {
+ $return = ini_get("upload_tmp_dir"); // session_save_path() may contain other storage path
+ if (!$return) {
if (function_exists('sys_get_temp_dir')) {
- $dir = sys_get_temp_dir();
+ $return = sys_get_temp_dir();
} else {
$filename = @tempnam("", ""); // @ - temp directory can be disabled by open_basedir
if (!$filename) {
return false;
}
- $dir = dirname($filename);
+ $return = dirname($filename);
unlink($filename);
}
}
- $filename = "$dir/adminer.key";
- $return = @file_get_contents($filename); // @ - can not exist
+ return $return;
+}
+
+/** Read password from file adminer.key in temporary directory or create one
+* @param bool
+* @return string or false if the file can not be created
+*/
+function password_file($create) {
+ $filename = get_temp_dir() . "/adminer.key";
+ $return = @file_get_contents($filename); // @ - may not exist
if ($return || !$create) {
return $return;
}
try {
parent::__construct($dsn, $username, $password);
} catch (Exception $ex) {
- auth_error($ex);
- exit;
+ auth_error($ex->getMessage());
}
$this->setAttribute(13, array('Min_PDOStatement')); // 13 - PDO::ATTR_STATEMENT_CLASS
$this->server_info = $this->getAttribute(4); // 4 - PDO::ATTR_SERVER_VERSION
'Logged as: %s' => 'Přihlášen jako: %s',
'Logout successful.' => 'Odhlášení proběhlo v pořádku.',
'Invalid credentials.' => 'Neplatné přihlašovací údaje.',
+ 'Too many unsuccessful logins, try again in %d minute(s).' => array('Příliš mnoho pokusů o přihlášení, zkuste to znovu za %d minutu.', 'Příliš mnoho pokusů o přihlášení, zkuste to znovu za %d minuty.', 'Příliš mnoho pokusů o přihlášení, zkuste to znovu za %d minut.'),
'Master password expired. <a href="http://www.adminer.org/en/extension/" target="_blank">Implement</a> %s method to make it permanent.' => 'Platnost hlavního hesla vypršela. <a href="http://www.adminer.org/cs/extension/" target="_blank">Implementujte</a> metodu %s, aby platilo stále.',
'Language' => 'Jazyk',
'Invalid CSRF token. Send the form again.' => 'Neplatný token CSRF. Odešlete formulář znovu.',
<?php
$translations = array(
+ 'Too many unsuccessful logins, try again in %d minute(s).' => array('Too many unsuccessful logins, try again in %d minute.', 'Too many unsuccessful logins, try again in %d minutes.'),
'Query executed OK, %d row(s) affected.' => array('Query executed OK, %d row affected.', 'Query executed OK, %d rows affected.'),
'%d byte(s)' => array('%d byte', '%d bytes'),
'Routine has been called, %d row(s) affected.' => array('Routine has been called, %d row affected.', 'Routine has been called, %d rows affected.'),
'Logged as: %s' => 'xx',
'Logout successful.' => 'xx',
'Invalid credentials.' => 'xx',
+ 'Too many unsuccessful logins, try again in %d minute(s).' => array('xx', 'xx'),
'Master password expired. <a href="http://www.adminer.org/en/extension/" target="_blank">Implement</a> %s method to make it permanent.' => 'xx',
'Language' => 'xx',
'Invalid CSRF token. Send the form again.' => 'xx',
Adminer 4.1.0-dev:
Provide size of all databases in the overview
+Prevent against brute force login attempts from the same IP address
Compute number of tables in the overview explicitly
Display edit form after error in clone or multi-edit
Trim trailing non-breaking spaces in SQL textarea
return password_file($create);
}
+ function bruteForceKey() {
+ return $_SERVER["REMOTE_ADDR"];
+ }
+
function database() {
global $connection;
if ($connection) {
projects / adminer.git / commitdiff