lbbs/src/login.c

/* SPDX-License-Identifier: GPL-3.0-or-later */
/*
 * login
 *   - user authentication and online status manager
 *
 * Copyright (C) 2004-2025  Leaflet <leaflet@leafok.com>
 */

#include "bbs.h"
#include "common.h"
#include "database.h"
#include "io.h"
#include "ip_mask.h"
#include "log.h"
#include "login.h"
#include "screen.h"
#include "user_priv.h"
#include <ctype.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <regex.h>
#include <unistd.h>
#include <mysql/mysql.h>
#include <sys/param.h>

static const int BBS_username_min_len = 3; // common len = 5, special len = 3
static const int BBS_password_min_len = 5; // legacy len = 5, current len = 6

int bbs_login(void)
{
        char username[BBS_username_max_len + 1];
        char password[BBS_password_max_len + 1];
        int i = 0;
        int ok = 0;

        for (; !SYS_server_exit && !ok && i < BBS_login_retry_times; i++)
        {
                prints("\033[1;33m请输入帐号\033[m(试用请输入`\033[1;36mguest\033[m', "
                           "注册请输入`\033[1;31mnew\033[m'): ");
                iflush();

                if (str_input(username, sizeof(username), DOECHO) < 0)
                {
                        continue;
                }

                if (strcmp(username, "guest") == 0)
                {
                        load_guest_info();

                        return 0;
                }

                if (strcmp(username, "new") == 0)
                {
                        display_file(DATA_REGISTER, 1);

                        return -1;
                }

                if (username[0] != '\0')
                {
                        prints("\033[1;37m请输入密码\033[m: ");
                        iflush();

                        if (str_input(password, sizeof(password), NOECHO) < 0)
                        {
                                continue;
                        }

                        ok = (check_user(username, password) == 0);
                        iflush();
                }
        }

        if (!ok)
        {
                display_file(DATA_LOGIN_ERROR, 1);
                return -1;
        }

        log_common("User \"%s\"(%ld) login from %s:%d\n",
                           BBS_username, BBS_priv.uid, hostaddr_client, port_client);

        return 0;
}

int check_user(const char *username, const char *password)
{
        MYSQL *db = NULL;
        MYSQL_RES *rs = NULL;
        MYSQL_ROW row;
        char sql[SQL_BUFFER_LEN];
        int ret = 0;
        int BBS_uid = 0;
        char client_addr[IP_ADDR_LEN];
        int i;
        int ok = 1;
        char user_tz_env[BBS_user_tz_max_len + 2];

        db = db_open();
        if (db == NULL)
        {
                ret = -1;
                goto cleanup;
        }

        // Verify format
        for (i = 0; ok && username[i] != '\0'; i++)
        {
                if (!(isalpha(username[i]) || (i > 0 && (isdigit(username[i]) || username[i] == '_'))))
                {
                        ok = 0;
                }
        }
        if (ok && (i < BBS_username_min_len || i > BBS_username_max_len))
        {
                ok = 0;
        }
        for (i = 0; ok && password[i] != '\0'; i++)
        {
                if (!isalnum(password[i]))
                {
                        ok = 0;
                }
        }
        if (ok && (i < BBS_password_min_len || i > BBS_password_max_len))
        {
                ok = 0;
        }

        if (!ok)
        {
                prints("\033[1;31m用户名或密码格式错误...\033[m\r\n");
                ret = 1;
                goto cleanup;
        }

        // Begin transaction
        if (mysql_query(db, "SET autocommit=0") != 0)
        {
                log_error("SET autocommit=0 error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        if (mysql_query(db, "BEGIN") != 0)
        {
                log_error("Begin transaction error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        // Failed login attempts from the same source (subnet /24) during certain time period
        strncpy(client_addr, hostaddr_client, sizeof(client_addr) - 1);
        client_addr[sizeof(client_addr) - 1] = '\0';

        snprintf(sql, sizeof(sql),
                         "SELECT COUNT(*) AS err_count FROM user_err_login_log "
                         "WHERE login_dt >= SUBDATE(NOW(), INTERVAL %d MINUTE) "
                         "AND login_ip LIKE '%s'",
                         BBS_login_failures_count_interval,
                         ip_mask(client_addr, 1, '%'));
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_list error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_list data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                if (atoi(row[0]) >= BBS_allowed_login_failures_within_interval)
                {
                        prints("\033[1;31m来源存在多次失败登陆尝试，请稍后再试，或使用Web方式访问\033[m\r\n");
                        ret = 1;
                        goto cleanup;
                }
        }
        mysql_free_result(rs);
        rs = NULL;

        // Failed login attempts against the current username since last successful login
        snprintf(sql, sizeof(sql),
                         "SELECT COUNT(*) AS err_count FROM user_err_login_log "
                         "LEFT JOIN user_list ON user_err_login_log.username = user_list.username "
                         "LEFT JOIN user_pubinfo ON user_list.UID = user_pubinfo.UID "
                         "WHERE user_err_login_log.username = '%s' "
                         "AND (user_err_login_log.login_dt >= user_pubinfo.last_login_dt "
                         "OR user_pubinfo.last_login_dt IS NULL)",
                         username);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_list error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_list data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                if (atoi(row[0]) >= BBS_allowed_login_failures_per_account)
                {
                        prints("\033[1;31m账户存在多次失败登陆尝试，请使用Web方式登录解锁\033[m\r\n");
                        ret = 1;
                        goto cleanup;
                }
        }
        mysql_free_result(rs);
        rs = NULL;

        snprintf(sql, sizeof(sql),
                         "SELECT UID, username, p_login FROM user_list "
                         "WHERE username = '%s' AND password = SHA2('%s', 256) AND enable",
                         username, password);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_list error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_list data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                BBS_uid = atoi(row[0]);
                strncpy(BBS_username, row[1], sizeof(BBS_username) - 1);
                BBS_username[sizeof(BBS_username) - 1] = '\0';
                int p_login = atoi(row[2]);

                mysql_free_result(rs);
                rs = NULL;

                // Add user login log
                snprintf(sql, sizeof(sql),
                                 "INSERT INTO user_login_log(UID, login_dt, login_ip) "
                                 "VALUES(%d, NOW(), '%s')",
                                 BBS_uid, hostaddr_client);
                if (mysql_query(db, sql) != 0)
                {
                        log_error("Insert into user_login_log error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                // Commit transaction
                if (mysql_query(db, "COMMIT") != 0)
                {
                        log_error("Commit transaction error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                if (p_login == 0)
                {
                        prints("\033[1;31m您目前无权登陆...\033[m\r\n");
                        ret = 1;
                        goto cleanup;
                }
        }
        else
        {
                mysql_free_result(rs);
                rs = NULL;

                snprintf(sql, sizeof(sql),
                                 "INSERT INTO user_err_login_log(username, password, login_dt, login_ip) "
                                 "VALUES('%s', '%s', NOW(), '%s')",
                                 username, password, hostaddr_client);
                if (mysql_query(db, sql) != 0)
                {
                        log_error("Insert into user_err_login_log error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                // Commit transaction
                if (mysql_query(db, "COMMIT") != 0)
                {
                        log_error("Commit transaction error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                prints("\033[1;31m错误的用户名或密码...\033[m\r\n");
                ret = 1;
                goto cleanup;
        }

        // Set AUTOCOMMIT = 1
        if (mysql_query(db, "SET autocommit=1") != 0)
        {
                log_error("SET autocommit=1 error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        ret = load_user_info(db, BBS_uid);

        switch (ret)
        {
        case 0: // Login successfully
                break;
        case -1: // Load data error
                prints("\033[1;31m读取用户数据错误...\033[m\r\n");
                ret = -1;
                goto cleanup;
        case -2: // Unused
                prints("\033[1;31m请通过Web登录更新用户许可协议...\033[m\r\n");
                ret = 1;
                goto cleanup;
        case -3: // Dead
                prints("\033[1;31m很遗憾，您已经永远离开了我们的世界！\033[m\r\n");
                ret = 1;
                goto cleanup;
        default:
                ret = -2;
                goto cleanup;
        }

        snprintf(sql, sizeof(sql),
                         "UPDATE user_pubinfo SET visit_count = visit_count + 1, "
                         "last_login_dt = NOW() WHERE UID = %d",
                         BBS_uid);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Update user_pubinfo error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        if (user_online_add(db) != 0)
        {
                ret = -1;
                goto cleanup;
        }

        BBS_last_access_tm = BBS_login_tm = time(NULL);

        // Set user tz to process env
        if (BBS_user_tz[0] != '\0')
        {
                user_tz_env[0] = ':';
                strncpy(user_tz_env + 1, BBS_user_tz, sizeof(user_tz_env) - 2);
                user_tz_env[sizeof(user_tz_env) - 1] = '\0';

                if (setenv("TZ", user_tz_env, 1) == -1)
                {
                        log_error("setenv(TZ = %s) error %d\n", user_tz_env, errno);
                        return -3;
                }

                tzset();
        }

cleanup:
        mysql_free_result(rs);
        mysql_close(db);

        return ret;
}

int load_user_info(MYSQL *db, int BBS_uid)
{
        MYSQL_RES *rs = NULL;
        MYSQL_ROW row;
        char sql[SQL_BUFFER_LEN];
        int life;
        time_t last_login_dt;
        int ret = 0;

        snprintf(sql, sizeof(sql),
                         "SELECT life, UNIX_TIMESTAMP(last_login_dt), user_timezone, exp, nickname "
                         "FROM user_pubinfo WHERE UID = %d",
                         BBS_uid);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_pubinfo error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_pubinfo data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                life = atoi(row[0]);
                last_login_dt = (time_t)atol(row[1]);

                strncpy(BBS_user_tz, row[2], sizeof(BBS_user_tz) - 1);
                BBS_user_tz[sizeof(BBS_user_tz) - 1] = '\0';

                BBS_user_exp = atoi(row[3]);

                strncpy(BBS_nickname, row[4], sizeof(BBS_nickname));
                BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';
        }
        else
        {
                ret = -1; // Data not found
                goto cleanup;
        }
        mysql_free_result(rs);
        rs = NULL;

        if (life != 333 && life != 365 && life != 666 && life != 999 && // Not immortal
                time(NULL) - last_login_dt > 60 * 60 * 24 * life)
        {
                ret = -3; // Dead
                goto cleanup;
        }

        if (load_priv(db, &BBS_priv, BBS_uid) != 0)
        {
                ret = -1;
                goto cleanup;
        }

cleanup:
        mysql_free_result(rs);

        return ret;
}

int load_guest_info(void)
{
        MYSQL *db = NULL;
        int ret = 0;

        db = db_open();
        if (db == NULL)
        {
                ret = -1;
                goto cleanup;
        }

        strncpy(BBS_username, "guest", sizeof(BBS_username) - 1);
        BBS_username[sizeof(BBS_username) - 1] = '\0';

        BBS_user_exp = 0;

        strncpy(BBS_nickname, "Guest", sizeof(BBS_nickname));
        BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';

        if (load_priv(db, &BBS_priv, 0) != 0)
        {
                ret = -1;
                goto cleanup;
        }

        if (user_online_add(db) != 0)
        {
                ret = -1;
                goto cleanup;
        }

        BBS_last_access_tm = BBS_login_tm = time(NULL);

cleanup:
        mysql_close(db);

        return ret;
}

int user_online_add(MYSQL *db)
{
        char sql[SQL_BUFFER_LEN];

        snprintf(sql, sizeof(sql),
                         "INSERT INTO visit_log(dt, IP) VALUES(NOW(), '%s')",
                         hostaddr_client);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Add visit log error: %s\n", mysql_error(db));
                return -1;
        }

        if (user_online_del(db) != 0)
        {
                return -2;
        }

        snprintf(sql, sizeof(sql),
                         "INSERT INTO user_online(SID, UID, ip, current_action, login_tm, last_tm) "
                         "VALUES('Telnet_Process_%d', %d, '%s', 'LOGIN', NOW(), NOW())",
                         getpid(), BBS_priv.uid, hostaddr_client);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Add user_online error: %s\n", mysql_error(db));
                return -3;
        }

        return 0;
}

int user_online_del(MYSQL *db)
{
        char sql[SQL_BUFFER_LEN];

        snprintf(sql, sizeof(sql),
                         "DELETE FROM user_online WHERE SID = 'Telnet_Process_%d'",
                         getpid());
        if (mysql_query(db, sql) != 0)
        {
                log_error("Delete user_online error: %s\n", mysql_error(db));
                return -1;
        }

        return 0;
}

int user_online_exp(MYSQL *db)
{
        char sql[SQL_BUFFER_LEN];

        // +1 exp for every 5 minutes online since last logout
        // but at most 24 hours worth of exp can be gained in Telnet session
        snprintf(sql, sizeof(sql),
                         "UPDATE user_pubinfo SET exp = exp + FLOOR(LEAST(TIMESTAMPDIFF("
                         "SECOND, GREATEST(last_login_dt, IF(last_logout_dt IS NULL, last_login_dt, last_logout_dt)), NOW()"
                         ") / 60 / 5, 12 * 24)), last_logout_dt = NOW() "
                         "WHERE UID = %d",
                         BBS_priv.uid);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Update user_pubinfo error: %s\n", mysql_error(db));
                return -1;
        }

        return 0;
}

int user_online_update(const char *action)
{
        MYSQL *db = NULL;
        char sql[SQL_BUFFER_LEN];

        if ((action == NULL || strcmp(BBS_current_action, action) == 0) &&
                time(NULL) - BBS_current_action_tm < BBS_current_action_refresh_interval) // No change
        {
                return 0;
        }

        if (action != NULL)
        {
                strncpy(BBS_current_action, action, sizeof(BBS_current_action) - 1);
                BBS_current_action[sizeof(BBS_current_action) - 1] = '\0';
        }

        BBS_current_action_tm = time(NULL);

        db = db_open();
        if (db == NULL)
        {
                log_error("db_open() error: %s\n", mysql_error(db));
                return -1;
        }

        snprintf(sql, sizeof(sql),
                         "UPDATE user_online SET current_action = '%s', last_tm = NOW() "
                         "WHERE SID = 'Telnet_Process_%d'",
                         BBS_current_action, getpid());
        if (mysql_query(db, sql) != 0)
        {
                log_error("Update user_online error: %s\n", mysql_error(db));
                return -2;
        }

        mysql_close(db);

        return 1;
}
1	sysadm	1.65	/* SPDX-License-Identifier: GPL-3.0-or-later */
2			/*
3			* login
4			* - user authentication and online status manager
5			*
6	sysadm	1.66	* Copyright (C) 2004-2025 Leaflet <leaflet@leafok.com>
7	sysadm	1.65	*/
8	sysadm	1.1
9			#include "bbs.h"
10			#include "common.h"
11	sysadm	1.48	#include "database.h"
12			#include "io.h"
13	sysadm	1.50	#include "ip_mask.h"
14	sysadm	1.14	#include "log.h"
15	sysadm	1.48	#include "login.h"
16	sysadm	1.14	#include "screen.h"
17	sysadm	1.48	#include "user_priv.h"
18			#include <ctype.h>
19	sysadm	1.34	#include <errno.h>
20	sysadm	1.48	#include <stdlib.h>
21	sysadm	1.14	#include <string.h>
22	sysadm	1.3	#include <regex.h>
23	sysadm	1.14	#include <unistd.h>
24	sysadm	1.36	#include <mysql/mysql.h>
25	sysadm	1.56	#include <sys/param.h>
26	sysadm	1.1
27	sysadm	1.64	static const int BBS_username_min_len = 3; // common len = 5, special len = 3
28			static const int BBS_password_min_len = 5; // legacy len = 5, current len = 6
29
30	sysadm	1.41	int bbs_login(void)
31	sysadm	1.1	{
32	sysadm	1.15	char username[BBS_username_max_len + 1];
33			char password[BBS_password_max_len + 1];
34	sysadm	1.37	int i = 0;
35	sysadm	1.16	int ok = 0;
36	sysadm	1.2
37	sysadm	1.37	for (; !SYS_server_exit && !ok && i < BBS_login_retry_times; i++)
38	sysadm	1.11	{
39	sysadm	1.49	prints("\033[1;33m请输入帐号\033[m(试用请输入`\033[1;36mguest\033[m', "
40			"注册请输入`\033[1;31mnew\033[m'): ");
41	sysadm	1.11	iflush();
42
43	sysadm	1.24	if (str_input(username, sizeof(username), DOECHO) < 0)
44			{
45			continue;
46			}
47	sysadm	1.11
48			if (strcmp(username, "guest") == 0)
49			{
50	sysadm	1.41	load_guest_info();
51	sysadm	1.14
52	sysadm	1.11	return 0;
53			}
54
55			if (strcmp(username, "new") == 0)
56			{
57	sysadm	1.42	display_file(DATA_REGISTER, 1);
58	sysadm	1.30
59	sysadm	1.51	return -1;
60	sysadm	1.11	}
61
62	sysadm	1.17	if (username[0] != '\0')
63	sysadm	1.11	{
64	sysadm	1.49	prints("\033[1;37m请输入密码\033[m: ");
65	sysadm	1.11	iflush();
66
67	sysadm	1.24	if (str_input(password, sizeof(password), NOECHO) < 0)
68			{
69			continue;
70			}
71	sysadm	1.11
72	sysadm	1.41	ok = (check_user(username, password) == 0);
73	sysadm	1.31	iflush();
74	sysadm	1.11	}
75	sysadm	1.24	}
76
77			if (!ok)
78			{
79	sysadm	1.42	display_file(DATA_LOGIN_ERROR, 1);
80	sysadm	1.24	return -1;
81	sysadm	1.11	}
82	sysadm	1.2
83	sysadm	1.38	log_common("User \"%s\"(%ld) login from %s:%d\n",
84	sysadm	1.39	BBS_username, BBS_priv.uid, hostaddr_client, port_client);
85	sysadm	1.28
86	sysadm	1.11	return 0;
87			}
88	sysadm	1.2
89	sysadm	1.41	int check_user(const char username, const char password)
90	sysadm	1.11	{
91	sysadm	1.44	MYSQL *db = NULL;
92			MYSQL_RES *rs = NULL;
93	sysadm	1.11	MYSQL_ROW row;
94	sysadm	1.15	char sql[SQL_BUFFER_LEN];
95	sysadm	1.44	int ret = 0;
96	sysadm	1.40	int BBS_uid = 0;
97	sysadm	1.22	char client_addr[IP_ADDR_LEN];
98	sysadm	1.27	int i;
99			int ok = 1;
100	sysadm	1.34	char user_tz_env[BBS_user_tz_max_len + 2];
101	sysadm	1.11
102	sysadm	1.41	db = db_open();
103			if (db == NULL)
104			{
105	sysadm	1.44	ret = -1;
106			goto cleanup;
107	sysadm	1.41	}
108
109	sysadm	1.11	// Verify format
110	sysadm	1.27	for (i = 0; ok && username[i] != '\0'; i++)
111			{
112	sysadm	1.63	if (!(isalpha(username[i]) \|\| (i > 0 && (isdigit(username[i]) \|\| username[i] == '_'))))
113	sysadm	1.27	{
114			ok = 0;
115			}
116			}
117	sysadm	1.64	if (ok && (i < BBS_username_min_len \|\| i > BBS_username_max_len))
118	sysadm	1.27	{
119			ok = 0;
120			}
121			for (i = 0; ok && password[i] != '\0'; i++)
122			{
123			if (!isalnum(password[i]))
124			{
125			ok = 0;
126			}
127			}
128	sysadm	1.64	if (ok && (i < BBS_password_min_len \|\| i > BBS_password_max_len))
129	sysadm	1.27	{
130			ok = 0;
131			}
132
133			if (!ok)
134	sysadm	1.5	{
135	sysadm	1.49	prints("\033[1;31m用户名或密码格式错误...\033[m\r\n");
136	sysadm	1.44	ret = 1;
137			goto cleanup;
138	sysadm	1.5	}
139
140	sysadm	1.13	// Begin transaction
141			if (mysql_query(db, "SET autocommit=0") != 0)
142			{
143	sysadm	1.33	log_error("SET autocommit=0 error: %s\n", mysql_error(db));
144	sysadm	1.44	ret = -1;
145			goto cleanup;
146	sysadm	1.13	}
147
148			if (mysql_query(db, "BEGIN") != 0)
149			{
150	sysadm	1.33	log_error("Begin transaction error: %s\n", mysql_error(db));
151	sysadm	1.44	ret = -1;
152			goto cleanup;
153	sysadm	1.13	}
154
155	sysadm	1.22	// Failed login attempts from the same source (subnet /24) during certain time period
156			strncpy(client_addr, hostaddr_client, sizeof(client_addr) - 1);
157			client_addr[sizeof(client_addr) - 1] = '\0';
158
159			snprintf(sql, sizeof(sql),
160			"SELECT COUNT(*) AS err_count FROM user_err_login_log "
161	sysadm	1.44	"WHERE login_dt >= SUBDATE(NOW(), INTERVAL %d MINUTE) "
162	sysadm	1.22	"AND login_ip LIKE '%s'",
163	sysadm	1.44	BBS_login_failures_count_interval,
164	sysadm	1.22	ip_mask(client_addr, 1, '%'));
165			if (mysql_query(db, sql) != 0)
166			{
167	sysadm	1.33	log_error("Query user_list error: %s\n", mysql_error(db));
168	sysadm	1.44	ret = -1;
169			goto cleanup;
170	sysadm	1.22	}
171			if ((rs = mysql_store_result(db)) == NULL)
172			{
173			log_error("Get user_list data failed\n");
174	sysadm	1.44	ret = -1;
175			goto cleanup;
176	sysadm	1.22	}
177			if ((row = mysql_fetch_row(rs)))
178			{
179	sysadm	1.52	if (atoi(row[0]) >= BBS_allowed_login_failures_within_interval)
180	sysadm	1.22	{
181	sysadm	1.52	prints("\033[1;31m来源存在多次失败登陆尝试，请稍后再试，或使用Web方式访问\033[m\r\n");
182	sysadm	1.44	ret = 1;
183			goto cleanup;
184	sysadm	1.22	}
185			}
186			mysql_free_result(rs);
187	sysadm	1.44	rs = NULL;
188	sysadm	1.22
189	sysadm	1.52	// Failed login attempts against the current username since last successful login
190	sysadm	1.22	snprintf(sql, sizeof(sql),
191			"SELECT COUNT(*) AS err_count FROM user_err_login_log "
192	sysadm	1.52	"LEFT JOIN user_list ON user_err_login_log.username = user_list.username "
193			"LEFT JOIN user_pubinfo ON user_list.UID = user_pubinfo.UID "
194			"WHERE user_err_login_log.username = '%s' "
195			"AND (user_err_login_log.login_dt >= user_pubinfo.last_login_dt "
196			"OR user_pubinfo.last_login_dt IS NULL)",
197	sysadm	1.22	username);
198			if (mysql_query(db, sql) != 0)
199			{
200	sysadm	1.33	log_error("Query user_list error: %s\n", mysql_error(db));
201	sysadm	1.44	ret = -1;
202			goto cleanup;
203	sysadm	1.22	}
204			if ((rs = mysql_store_result(db)) == NULL)
205			{
206			log_error("Get user_list data failed\n");
207	sysadm	1.44	ret = -1;
208			goto cleanup;
209	sysadm	1.22	}
210			if ((row = mysql_fetch_row(rs)))
211			{
212	sysadm	1.53	if (atoi(row[0]) >= BBS_allowed_login_failures_per_account)
213	sysadm	1.22	{
214	sysadm	1.52	prints("\033[1;31m账户存在多次失败登陆尝试，请使用Web方式登录解锁\033[m\r\n");
215	sysadm	1.44	ret = 1;
216			goto cleanup;
217	sysadm	1.22	}
218			}
219			mysql_free_result(rs);
220	sysadm	1.44	rs = NULL;
221	sysadm	1.22
222	sysadm	1.18	snprintf(sql, sizeof(sql),
223	sysadm	1.22	"SELECT UID, username, p_login FROM user_list "
224			"WHERE username = '%s' AND password = SHA2('%s', 256) AND enable",
225			username, password);
226	sysadm	1.11	if (mysql_query(db, sql) != 0)
227			{
228	sysadm	1.33	log_error("Query user_list error: %s\n", mysql_error(db));
229	sysadm	1.44	ret = -1;
230			goto cleanup;
231	sysadm	1.11	}
232			if ((rs = mysql_store_result(db)) == NULL)
233	sysadm	1.2	{
234	sysadm	1.11	log_error("Get user_list data failed\n");
235	sysadm	1.44	ret = -1;
236			goto cleanup;
237	sysadm	1.11	}
238	sysadm	1.15	if ((row = mysql_fetch_row(rs)))
239	sysadm	1.11	{
240	sysadm	1.40	BBS_uid = atoi(row[0]);
241	sysadm	1.17	strncpy(BBS_username, row[1], sizeof(BBS_username) - 1);
242			BBS_username[sizeof(BBS_username) - 1] = '\0';
243	sysadm	1.13	int p_login = atoi(row[2]);
244
245			mysql_free_result(rs);
246	sysadm	1.44	rs = NULL;
247	sysadm	1.13
248			// Add user login log
249	sysadm	1.18	snprintf(sql, sizeof(sql),
250	sysadm	1.22	"INSERT INTO user_login_log(UID, login_dt, login_ip) "
251	sysadm	1.40	"VALUES(%d, NOW(), '%s')",
252	sysadm	1.22	BBS_uid, hostaddr_client);
253	sysadm	1.13	if (mysql_query(db, sql) != 0)
254			{
255	sysadm	1.33	log_error("Insert into user_login_log error: %s\n", mysql_error(db));
256	sysadm	1.44	ret = -1;
257			goto cleanup;
258	sysadm	1.13	}
259
260			// Commit transaction
261			if (mysql_query(db, "COMMIT") != 0)
262			{
263	sysadm	1.33	log_error("Commit transaction error: %s\n", mysql_error(db));
264	sysadm	1.44	ret = -1;
265			goto cleanup;
266	sysadm	1.13	}
267
268			if (p_login == 0)
269	sysadm	1.11	{
270	sysadm	1.49	prints("\033[1;31m您目前无权登陆...\033[m\r\n");
271	sysadm	1.44	ret = 1;
272			goto cleanup;
273	sysadm	1.11	}
274			}
275			else
276			{
277			mysql_free_result(rs);
278	sysadm	1.44	rs = NULL;
279	sysadm	1.2
280	sysadm	1.18	snprintf(sql, sizeof(sql),
281	sysadm	1.22	"INSERT INTO user_err_login_log(username, password, login_dt, login_ip) "
282			"VALUES('%s', '%s', NOW(), '%s')",
283			username, password, hostaddr_client);
284	sysadm	1.11	if (mysql_query(db, sql) != 0)
285			{
286	sysadm	1.33	log_error("Insert into user_err_login_log error: %s\n", mysql_error(db));
287	sysadm	1.44	ret = -1;
288			goto cleanup;
289	sysadm	1.11	}
290
291	sysadm	1.13	// Commit transaction
292			if (mysql_query(db, "COMMIT") != 0)
293			{
294	sysadm	1.33	log_error("Commit transaction error: %s\n", mysql_error(db));
295	sysadm	1.44	ret = -1;
296			goto cleanup;
297	sysadm	1.13	}
298
299	sysadm	1.49	prints("\033[1;31m错误的用户名或密码...\033[m\r\n");
300	sysadm	1.44	ret = 1;
301			goto cleanup;
302	sysadm	1.11	}
303	sysadm	1.13
304			// Set AUTOCOMMIT = 1
305			if (mysql_query(db, "SET autocommit=1") != 0)
306			{
307	sysadm	1.33	log_error("SET autocommit=1 error: %s\n", mysql_error(db));
308	sysadm	1.44	ret = -1;
309			goto cleanup;
310	sysadm	1.13	}
311	sysadm	1.2
312	sysadm	1.11	ret = load_user_info(db, BBS_uid);
313
314			switch (ret)
315	sysadm	1.2	{
316	sysadm	1.11	case 0: // Login successfully
317			break;
318			case -1: // Load data error
319	sysadm	1.49	prints("\033[1;31m读取用户数据错误...\033[m\r\n");
320	sysadm	1.44	ret = -1;
321			goto cleanup;
322	sysadm	1.11	case -2: // Unused
323	sysadm	1.49	prints("\033[1;31m请通过Web登录更新用户许可协议...\033[m\r\n");
324	sysadm	1.44	ret = 1;
325			goto cleanup;
326	sysadm	1.11	case -3: // Dead
327	sysadm	1.49	prints("\033[1;31m很遗憾，您已经永远离开了我们的世界！\033[m\r\n");
328	sysadm	1.44	ret = 1;
329			goto cleanup;
330	sysadm	1.11	default:
331	sysadm	1.44	ret = -2;
332			goto cleanup;
333	sysadm	1.2	}
334
335	sysadm	1.18	snprintf(sql, sizeof(sql),
336	sysadm	1.22	"UPDATE user_pubinfo SET visit_count = visit_count + 1, "
337	sysadm	1.40	"last_login_dt = NOW() WHERE UID = %d",
338	sysadm	1.22	BBS_uid);
339	sysadm	1.13	if (mysql_query(db, sql) != 0)
340			{
341	sysadm	1.33	log_error("Update user_pubinfo error: %s\n", mysql_error(db));
342	sysadm	1.44	ret = -1;
343			goto cleanup;
344	sysadm	1.13	}
345
346	sysadm	1.15	if (user_online_add(db) != 0)
347			{
348	sysadm	1.44	ret = -1;
349			goto cleanup;
350	sysadm	1.15	}
351
352	sysadm	1.45	BBS_last_access_tm = BBS_login_tm = time(NULL);
353	sysadm	1.13
354	sysadm	1.34	// Set user tz to process env
355			if (BBS_user_tz[0] != '\0')
356			{
357			user_tz_env[0] = ':';
358			strncpy(user_tz_env + 1, BBS_user_tz, sizeof(user_tz_env) - 2);
359			user_tz_env[sizeof(user_tz_env) - 1] = '\0';
360
361			if (setenv("TZ", user_tz_env, 1) == -1)
362			{
363			log_error("setenv(TZ = %s) error %d\n", user_tz_env, errno);
364			return -3;
365			}
366
367			tzset();
368			}
369
370	sysadm	1.44	cleanup:
371			mysql_free_result(rs);
372	sysadm	1.41	mysql_close(db);
373
374	sysadm	1.44	return ret;
375	sysadm	1.1	}
376	sysadm	1.2
377	sysadm	1.40	int load_user_info(MYSQL *db, int BBS_uid)
378	sysadm	1.3	{
379	sysadm	1.44	MYSQL_RES *rs = NULL;
380	sysadm	1.11	MYSQL_ROW row;
381	sysadm	1.15	char sql[SQL_BUFFER_LEN];
382	sysadm	1.11	int life;
383			time_t last_login_dt;
384	sysadm	1.44	int ret = 0;
385	sysadm	1.11
386	sysadm	1.18	snprintf(sql, sizeof(sql),
387	sysadm	1.43	"SELECT life, UNIX_TIMESTAMP(last_login_dt), user_timezone, exp, nickname "
388	sysadm	1.40	"FROM user_pubinfo WHERE UID = %d",
389	sysadm	1.22	BBS_uid);
390	sysadm	1.11	if (mysql_query(db, sql) != 0)
391			{
392	sysadm	1.33	log_error("Query user_pubinfo error: %s\n", mysql_error(db));
393	sysadm	1.44	ret = -1;
394			goto cleanup;
395	sysadm	1.11	}
396			if ((rs = mysql_store_result(db)) == NULL)
397			{
398			log_error("Get user_pubinfo data failed\n");
399	sysadm	1.44	ret = -1;
400			goto cleanup;
401	sysadm	1.11	}
402	sysadm	1.15	if ((row = mysql_fetch_row(rs)))
403	sysadm	1.11	{
404			life = atoi(row[0]);
405			last_login_dt = (time_t)atol(row[1]);
406	sysadm	1.34
407			strncpy(BBS_user_tz, row[2], sizeof(BBS_user_tz) - 1);
408			BBS_user_tz[sizeof(BBS_user_tz) - 1] = '\0';
409	sysadm	1.43
410			BBS_user_exp = atoi(row[3]);
411
412			strncpy(BBS_nickname, row[4], sizeof(BBS_nickname));
413			BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';
414	sysadm	1.11	}
415			else
416			{
417	sysadm	1.44	ret = -1; // Data not found
418			goto cleanup;
419	sysadm	1.11	}
420			mysql_free_result(rs);
421	sysadm	1.44	rs = NULL;
422	sysadm	1.3
423	sysadm	1.13	if (life != 333 && life != 365 && life != 666 && life != 999 && // Not immortal
424	sysadm	1.45	time(NULL) - last_login_dt > 60 * 60 * 24 * life)
425	sysadm	1.11	{
426	sysadm	1.44	ret = -3; // Dead
427			goto cleanup;
428	sysadm	1.11	}
429	sysadm	1.5
430	sysadm	1.15	if (load_priv(db, &BBS_priv, BBS_uid) != 0)
431			{
432	sysadm	1.44	ret = -1;
433			goto cleanup;
434	sysadm	1.15	}
435	sysadm	1.11
436	sysadm	1.44	cleanup:
437			mysql_free_result(rs);
438
439			return ret;
440	sysadm	1.2	}
441	sysadm	1.5
442	sysadm	1.41	int load_guest_info(void)
443	sysadm	1.5	{
444	sysadm	1.44	MYSQL *db = NULL;
445			int ret = 0;
446	sysadm	1.41
447			db = db_open();
448			if (db == NULL)
449			{
450	sysadm	1.44	ret = -1;
451			goto cleanup;
452	sysadm	1.41	}
453
454	sysadm	1.17	strncpy(BBS_username, "guest", sizeof(BBS_username) - 1);
455			BBS_username[sizeof(BBS_username) - 1] = '\0';
456	sysadm	1.5
457	sysadm	1.43	BBS_user_exp = 0;
458
459			strncpy(BBS_nickname, "Guest", sizeof(BBS_nickname));
460			BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';
461
462	sysadm	1.15	if (load_priv(db, &BBS_priv, 0) != 0)
463			{
464	sysadm	1.44	ret = -1;
465			goto cleanup;
466	sysadm	1.15	}
467	sysadm	1.6
468	sysadm	1.15	if (user_online_add(db) != 0)
469			{
470	sysadm	1.44	ret = -1;
471			goto cleanup;
472	sysadm	1.15	}
473	sysadm	1.5
474	sysadm	1.45	BBS_last_access_tm = BBS_login_tm = time(NULL);
475	sysadm	1.5
476	sysadm	1.44	cleanup:
477	sysadm	1.41	mysql_close(db);
478	sysadm	1.44
479			return ret;
480	sysadm	1.5	}
481	sysadm	1.15
482			int user_online_add(MYSQL *db)
483			{
484			char sql[SQL_BUFFER_LEN];
485
486	sysadm	1.60	snprintf(sql, sizeof(sql),
487			"INSERT INTO visit_log(dt, IP) VALUES(NOW(), '%s')",
488			hostaddr_client);
489			if (mysql_query(db, sql) != 0)
490			{
491			log_error("Add visit log error: %s\n", mysql_error(db));
492			return -1;
493			}
494
495	sysadm	1.15	if (user_online_del(db) != 0)
496			{
497	sysadm	1.60	return -2;
498	sysadm	1.15	}
499
500	sysadm	1.18	snprintf(sql, sizeof(sql),
501	sysadm	1.61	"INSERT INTO user_online(SID, UID, ip, current_action, login_tm, last_tm) "
502			"VALUES('Telnet_Process_%d', %d, '%s', 'LOGIN', NOW(), NOW())",
503	sysadm	1.22	getpid(), BBS_priv.uid, hostaddr_client);
504	sysadm	1.15	if (mysql_query(db, sql) != 0)
505			{
506	sysadm	1.33	log_error("Add user_online error: %s\n", mysql_error(db));
507	sysadm	1.60	return -3;
508	sysadm	1.15	}
509
510			return 0;
511			}
512
513			int user_online_del(MYSQL *db)
514			{
515			char sql[SQL_BUFFER_LEN];
516
517	sysadm	1.57	snprintf(sql, sizeof(sql),
518			"DELETE FROM user_online WHERE SID = 'Telnet_Process_%d'",
519			getpid());
520			if (mysql_query(db, sql) != 0)
521			{
522			log_error("Delete user_online error: %s\n", mysql_error(db));
523			return -1;
524			}
525
526			return 0;
527			}
528
529			int user_online_exp(MYSQL *db)
530			{
531			char sql[SQL_BUFFER_LEN];
532
533	sysadm	1.56	// +1 exp for every 5 minutes online since last logout
534			// but at most 24 hours worth of exp can be gained in Telnet session
535			snprintf(sql, sizeof(sql),
536	sysadm	1.60	"UPDATE user_pubinfo SET exp = exp + FLOOR(LEAST(TIMESTAMPDIFF("
537			"SECOND, GREATEST(last_login_dt, IF(last_logout_dt IS NULL, last_login_dt, last_logout_dt)), NOW()"
538			") / 60 / 5, 12 * 24)), last_logout_dt = NOW() "
539			"WHERE UID = %d",
540			BBS_priv.uid);
541	sysadm	1.56	if (mysql_query(db, sql) != 0)
542			{
543			log_error("Update user_pubinfo error: %s\n", mysql_error(db));
544			return -1;
545			}
546	sysadm	1.15
547			return 0;
548			}
549	sysadm	1.47
550			int user_online_update(const char *action)
551			{
552			MYSQL *db = NULL;
553			char sql[SQL_BUFFER_LEN];
554
555	sysadm	1.55	if ((action == NULL \|\| strcmp(BBS_current_action, action) == 0) &&
556	sysadm	1.54	time(NULL) - BBS_current_action_tm < BBS_current_action_refresh_interval) // No change
557	sysadm	1.47	{
558			return 0;
559			}
560
561	sysadm	1.55	if (action != NULL)
562			{
563			strncpy(BBS_current_action, action, sizeof(BBS_current_action) - 1);
564			BBS_current_action[sizeof(BBS_current_action) - 1] = '\0';
565			}
566
567	sysadm	1.54	BBS_current_action_tm = time(NULL);
568	sysadm	1.47
569			db = db_open();
570			if (db == NULL)
571			{
572			log_error("db_open() error: %s\n", mysql_error(db));
573			return -1;
574			}
575
576			snprintf(sql, sizeof(sql),
577	sysadm	1.62	"UPDATE user_online SET current_action = '%s', last_tm = NOW() "
578	sysadm	1.47	"WHERE SID = 'Telnet_Process_%d'",
579			BBS_current_action, getpid());
580			if (mysql_query(db, sql) != 0)
581			{
582			log_error("Update user_online error: %s\n", mysql_error(db));
583			return -2;
584			}
585
586			mysql_close(db);
587
588			return 1;
589			}
webmaster@leafok.com	ViewVC Help
Powered by ViewVC 1.3.0-beta1