lbbs/src/login.c

/* SPDX-License-Identifier: GPL-3.0-or-later */
/*
 * login
 *   - user authentication and online status manager
 *
 * Copyright (C) 2004-2025  Leaflet <leaflet@leafok.com>
 */

#include "bbs.h"
#include "common.h"
#include "database.h"
#include "io.h"
#include "ip_mask.h"
#include "log.h"
#include "login.h"
#include "screen.h"
#include "user_priv.h"
#include <ctype.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <regex.h>
#include <unistd.h>
#include <mysql/mysql.h>
#include <sys/param.h>

static const int BBS_username_min_len = 3; // common len = 5, special len = 3
static const int BBS_password_min_len = 5; // legacy len = 5, current len = 6

static const int BBS_allowed_login_failures_within_interval = 10;
static const int BBS_login_failures_count_interval = 10; // minutes
static const int BBS_allowed_login_failures_per_account = 3;

const int BBS_login_retry_times = 3;

int bbs_login(void)
{
        char username[BBS_username_max_len + 1];
        char password[BBS_password_max_len + 1];
        int i = 0;
        int ok = 0;

        for (; !SYS_server_exit && !ok && i < BBS_login_retry_times; i++)
        {
                prints("\033[1;33m请输入帐号\033[m(试用请输入`\033[1;36mguest\033[m', "
                           "注册请输入`\033[1;31mnew\033[m'): ");
                iflush();

                if (str_input(username, sizeof(username), DOECHO) < 0)
                {
                        continue;
                }

                if (strcmp(username, "guest") == 0)
                {
                        load_guest_info();

                        return 0;
                }

                if (strcmp(username, "new") == 0)
                {
                        display_file(DATA_REGISTER, 1);

                        return -1;
                }

                if (username[0] != '\0')
                {
                        prints("\033[1;37m请输入密码\033[m: ");
                        iflush();

                        if (str_input(password, sizeof(password), NOECHO) < 0)
                        {
                                continue;
                        }

                        ok = (check_user(username, password) == 0);
                        iflush();
                }
        }

        if (!ok)
        {
                display_file(DATA_LOGIN_ERROR, 1);
                return -1;
        }

        log_common("User \"%s\"(%ld) login from %s:%d\n",
                           BBS_username, BBS_priv.uid, hostaddr_client, port_client);

        return 0;
}

int check_user(const char *username, const char *password)
{
        MYSQL *db = NULL;
        MYSQL_RES *rs = NULL;
        MYSQL_ROW row;
        char sql[SQL_BUFFER_LEN];
        int ret = 0;
        int BBS_uid = 0;
        char client_addr[IP_ADDR_LEN];
        int i;
        int ok = 1;
        char user_tz_env[BBS_user_tz_max_len + 2];

        db = db_open();
        if (db == NULL)
        {
                ret = -1;
                goto cleanup;
        }

        // Verify format
        for (i = 0; ok && username[i] != '\0'; i++)
        {
                if (!(isalpha(username[i]) || (i > 0 && (isdigit(username[i]) || username[i] == '_'))))
                {
                        ok = 0;
                }
        }
        if (ok && (i < BBS_username_min_len || i > BBS_username_max_len))
        {
                ok = 0;
        }
        for (i = 0; ok && password[i] != '\0'; i++)
        {
                if (!isalnum(password[i]))
                {
                        ok = 0;
                }
        }
        if (ok && (i < BBS_password_min_len || i > BBS_password_max_len))
        {
                ok = 0;
        }

        if (!ok)
        {
                prints("\033[1;31m用户名或密码格式错误...\033[m\r\n");
                ret = 1;
                goto cleanup;
        }

        // Begin transaction
        if (mysql_query(db, "SET autocommit=0") != 0)
        {
                log_error("SET autocommit=0 error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        if (mysql_query(db, "BEGIN") != 0)
        {
                log_error("Begin transaction error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        // Failed login attempts from the same source (subnet /24) during certain time period
        strncpy(client_addr, hostaddr_client, sizeof(client_addr) - 1);
        client_addr[sizeof(client_addr) - 1] = '\0';

        snprintf(sql, sizeof(sql),
                         "SELECT COUNT(*) AS err_count FROM user_err_login_log "
                         "WHERE login_dt >= SUBDATE(NOW(), INTERVAL %d MINUTE) "
                         "AND login_ip LIKE '%s'",
                         BBS_login_failures_count_interval,
                         ip_mask(client_addr, 1, '%'));
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_list error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_list data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                if (atoi(row[0]) >= BBS_allowed_login_failures_within_interval)
                {
                        prints("\033[1;31m来源存在多次失败登陆尝试，请稍后再试，或使用Web方式访问\033[m\r\n");
                        ret = 1;
                        goto cleanup;
                }
        }
        mysql_free_result(rs);
        rs = NULL;

        // Failed login attempts against the current username since last successful login
        snprintf(sql, sizeof(sql),
                         "SELECT COUNT(*) AS err_count FROM user_err_login_log "
                         "LEFT JOIN user_list ON user_err_login_log.username = user_list.username "
                         "LEFT JOIN user_pubinfo ON user_list.UID = user_pubinfo.UID "
                         "WHERE user_err_login_log.username = '%s' "
                         "AND (user_err_login_log.login_dt >= user_pubinfo.last_login_dt "
                         "OR user_pubinfo.last_login_dt IS NULL)",
                         username);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_list error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_list data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                if (atoi(row[0]) >= BBS_allowed_login_failures_per_account)
                {
                        prints("\033[1;31m账户存在多次失败登陆尝试，请使用Web方式登录解锁\033[m\r\n");
                        ret = 1;
                        goto cleanup;
                }
        }
        mysql_free_result(rs);
        rs = NULL;

        snprintf(sql, sizeof(sql),
                         "SELECT UID, username, p_login FROM user_list "
                         "WHERE username = '%s' AND password = SHA2('%s', 256) AND enable",
                         username, password);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_list error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_list data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                BBS_uid = atoi(row[0]);
                strncpy(BBS_username, row[1], sizeof(BBS_username) - 1);
                BBS_username[sizeof(BBS_username) - 1] = '\0';
                int p_login = atoi(row[2]);

                mysql_free_result(rs);
                rs = NULL;

                // Add user login log
                snprintf(sql, sizeof(sql),
                                 "INSERT INTO user_login_log(UID, login_dt, login_ip) "
                                 "VALUES(%d, NOW(), '%s')",
                                 BBS_uid, hostaddr_client);
                if (mysql_query(db, sql) != 0)
                {
                        log_error("Insert into user_login_log error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                // Commit transaction
                if (mysql_query(db, "COMMIT") != 0)
                {
                        log_error("Commit transaction error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                if (p_login == 0)
                {
                        prints("\033[1;31m您目前无权登陆...\033[m\r\n");
                        ret = 1;
                        goto cleanup;
                }
        }
        else
        {
                mysql_free_result(rs);
                rs = NULL;

                snprintf(sql, sizeof(sql),
                                 "INSERT INTO user_err_login_log(username, password, login_dt, login_ip) "
                                 "VALUES('%s', '%s', NOW(), '%s')",
                                 username, password, hostaddr_client);
                if (mysql_query(db, sql) != 0)
                {
                        log_error("Insert into user_err_login_log error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                // Commit transaction
                if (mysql_query(db, "COMMIT") != 0)
                {
                        log_error("Commit transaction error: %s\n", mysql_error(db));
                        ret = -1;
                        goto cleanup;
                }

                prints("\033[1;31m错误的用户名或密码...\033[m\r\n");
                ret = 1;
                goto cleanup;
        }

        // Set AUTOCOMMIT = 1
        if (mysql_query(db, "SET autocommit=1") != 0)
        {
                log_error("SET autocommit=1 error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        ret = load_user_info(db, BBS_uid);

        switch (ret)
        {
        case 0: // Login successfully
                break;
        case -1: // Load data error
                prints("\033[1;31m读取用户数据错误...\033[m\r\n");
                ret = -1;
                goto cleanup;
        case -2: // Unused
                prints("\033[1;31m请通过Web登录更新用户许可协议...\033[m\r\n");
                ret = 1;
                goto cleanup;
        case -3: // Dead
                prints("\033[1;31m很遗憾，您已经永远离开了我们的世界！\033[m\r\n");
                ret = 1;
                goto cleanup;
        default:
                ret = -2;
                goto cleanup;
        }

        snprintf(sql, sizeof(sql),
                         "UPDATE user_pubinfo SET visit_count = visit_count + 1, "
                         "last_login_dt = NOW() WHERE UID = %d",
                         BBS_uid);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Update user_pubinfo error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }

        if (user_online_add(db) != 0)
        {
                ret = -1;
                goto cleanup;
        }

        BBS_last_access_tm = BBS_login_tm = time(NULL);

        // Set user tz to process env
        if (BBS_user_tz[0] != '\0')
        {
                user_tz_env[0] = ':';
                strncpy(user_tz_env + 1, BBS_user_tz, sizeof(user_tz_env) - 2);
                user_tz_env[sizeof(user_tz_env) - 1] = '\0';

                if (setenv("TZ", user_tz_env, 1) == -1)
                {
                        log_error("setenv(TZ = %s) error %d\n", user_tz_env, errno);
                        return -3;
                }

                tzset();
        }

cleanup:
        mysql_free_result(rs);
        mysql_close(db);

        return ret;
}

int load_user_info(MYSQL *db, int BBS_uid)
{
        MYSQL_RES *rs = NULL;
        MYSQL_ROW row;
        char sql[SQL_BUFFER_LEN];
        int life;
        time_t last_login_dt;
        int ret = 0;

        snprintf(sql, sizeof(sql),
                         "SELECT life, UNIX_TIMESTAMP(last_login_dt), user_timezone, exp, nickname "
                         "FROM user_pubinfo WHERE UID = %d",
                         BBS_uid);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Query user_pubinfo error: %s\n", mysql_error(db));
                ret = -1;
                goto cleanup;
        }
        if ((rs = mysql_store_result(db)) == NULL)
        {
                log_error("Get user_pubinfo data failed\n");
                ret = -1;
                goto cleanup;
        }
        if ((row = mysql_fetch_row(rs)))
        {
                life = atoi(row[0]);
                last_login_dt = (time_t)atol(row[1]);

                strncpy(BBS_user_tz, row[2], sizeof(BBS_user_tz) - 1);
                BBS_user_tz[sizeof(BBS_user_tz) - 1] = '\0';

                BBS_user_exp = atoi(row[3]);

                strncpy(BBS_nickname, row[4], sizeof(BBS_nickname));
                BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';
        }
        else
        {
                ret = -1; // Data not found
                goto cleanup;
        }
        mysql_free_result(rs);
        rs = NULL;

        if (life != 333 && life != 365 && life != 666 && life != 999 && // Not immortal
                time(NULL) - last_login_dt > 60 * 60 * 24 * life)
        {
                ret = -3; // Dead
                goto cleanup;
        }

        if (load_priv(db, &BBS_priv, BBS_uid) != 0)
        {
                ret = -1;
                goto cleanup;
        }

cleanup:
        mysql_free_result(rs);

        return ret;
}

int load_guest_info(void)
{
        MYSQL *db = NULL;
        int ret = 0;

        db = db_open();
        if (db == NULL)
        {
                ret = -1;
                goto cleanup;
        }

        strncpy(BBS_username, "guest", sizeof(BBS_username) - 1);
        BBS_username[sizeof(BBS_username) - 1] = '\0';

        BBS_user_exp = 0;

        strncpy(BBS_nickname, "Guest", sizeof(BBS_nickname));
        BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';

        if (load_priv(db, &BBS_priv, 0) != 0)
        {
                ret = -1;
                goto cleanup;
        }

        if (user_online_add(db) != 0)
        {
                ret = -1;
                goto cleanup;
        }

        BBS_last_access_tm = BBS_login_tm = time(NULL);

cleanup:
        mysql_close(db);

        return ret;
}

int user_online_add(MYSQL *db)
{
        char sql[SQL_BUFFER_LEN];

        snprintf(sql, sizeof(sql),
                         "INSERT INTO visit_log(dt, IP) VALUES(NOW(), '%s')",
                         hostaddr_client);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Add visit log error: %s\n", mysql_error(db));
                return -1;
        }

        if (user_online_del(db) != 0)
        {
                return -2;
        }

        snprintf(sql, sizeof(sql),
                         "INSERT INTO user_online(SID, UID, ip, current_action, login_tm, last_tm) "
                         "VALUES('Telnet_Process_%d', %d, '%s', 'LOGIN', NOW(), NOW())",
                         getpid(), BBS_priv.uid, hostaddr_client);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Add user_online error: %s\n", mysql_error(db));
                return -3;
        }

        return 0;
}

int user_online_del(MYSQL *db)
{
        char sql[SQL_BUFFER_LEN];

        snprintf(sql, sizeof(sql),
                         "DELETE FROM user_online WHERE SID = 'Telnet_Process_%d'",
                         getpid());
        if (mysql_query(db, sql) != 0)
        {
                log_error("Delete user_online error: %s\n", mysql_error(db));
                return -1;
        }

        return 0;
}

int user_online_exp(MYSQL *db)
{
        char sql[SQL_BUFFER_LEN];

        // +1 exp for every 5 minutes online since last logout
        // but at most 24 hours worth of exp can be gained in Telnet session
        snprintf(sql, sizeof(sql),
                         "UPDATE user_pubinfo SET exp = exp + FLOOR(LEAST(TIMESTAMPDIFF("
                         "SECOND, GREATEST(last_login_dt, IF(last_logout_dt IS NULL, last_login_dt, last_logout_dt)), NOW()"
                         ") / 60 / 5, 12 * 24)), last_logout_dt = NOW() "
                         "WHERE UID = %d",
                         BBS_priv.uid);
        if (mysql_query(db, sql) != 0)
        {
                log_error("Update user_pubinfo error: %s\n", mysql_error(db));
                return -1;
        }

        return 0;
}

int user_online_update(const char *action)
{
        MYSQL *db = NULL;
        char sql[SQL_BUFFER_LEN];

        if ((action == NULL || strcmp(BBS_current_action, action) == 0) &&
                time(NULL) - BBS_current_action_tm < BBS_current_action_refresh_interval) // No change
        {
                return 0;
        }

        if (action != NULL)
        {
                strncpy(BBS_current_action, action, sizeof(BBS_current_action) - 1);
                BBS_current_action[sizeof(BBS_current_action) - 1] = '\0';
        }

        BBS_current_action_tm = time(NULL);

        db = db_open();
        if (db == NULL)
        {
                log_error("db_open() error: %s\n", mysql_error(db));
                return -1;
        }

        snprintf(sql, sizeof(sql),
                         "UPDATE user_online SET current_action = '%s', last_tm = NOW() "
                         "WHERE SID = 'Telnet_Process_%d'",
                         BBS_current_action, getpid());
        if (mysql_query(db, sql) != 0)
        {
                log_error("Update user_online error: %s\n", mysql_error(db));
                return -2;
        }

        mysql_close(db);

        return 1;
}
1	sysadm	1.65	/* SPDX-License-Identifier: GPL-3.0-or-later */
2			/*
3			* login
4			* - user authentication and online status manager
5			*
6	sysadm	1.66	* Copyright (C) 2004-2025 Leaflet <leaflet@leafok.com>
7	sysadm	1.65	*/
8	sysadm	1.1
9			#include "bbs.h"
10			#include "common.h"
11	sysadm	1.48	#include "database.h"
12			#include "io.h"
13	sysadm	1.50	#include "ip_mask.h"
14	sysadm	1.14	#include "log.h"
15	sysadm	1.48	#include "login.h"
16	sysadm	1.14	#include "screen.h"
17	sysadm	1.48	#include "user_priv.h"
18			#include <ctype.h>
19	sysadm	1.34	#include <errno.h>
20	sysadm	1.48	#include <stdlib.h>
21	sysadm	1.14	#include <string.h>
22	sysadm	1.3	#include <regex.h>
23	sysadm	1.14	#include <unistd.h>
24	sysadm	1.36	#include <mysql/mysql.h>
25	sysadm	1.56	#include <sys/param.h>
26	sysadm	1.1
27	sysadm	1.64	static const int BBS_username_min_len = 3; // common len = 5, special len = 3
28			static const int BBS_password_min_len = 5; // legacy len = 5, current len = 6
29
30	sysadm	1.67	static const int BBS_allowed_login_failures_within_interval = 10;
31			static const int BBS_login_failures_count_interval = 10; // minutes
32			static const int BBS_allowed_login_failures_per_account = 3;
33
34			const int BBS_login_retry_times = 3;
35
36	sysadm	1.41	int bbs_login(void)
37	sysadm	1.1	{
38	sysadm	1.15	char username[BBS_username_max_len + 1];
39			char password[BBS_password_max_len + 1];
40	sysadm	1.37	int i = 0;
41	sysadm	1.16	int ok = 0;
42	sysadm	1.2
43	sysadm	1.37	for (; !SYS_server_exit && !ok && i < BBS_login_retry_times; i++)
44	sysadm	1.11	{
45	sysadm	1.49	prints("\033[1;33m请输入帐号\033[m(试用请输入`\033[1;36mguest\033[m', "
46			"注册请输入`\033[1;31mnew\033[m'): ");
47	sysadm	1.11	iflush();
48
49	sysadm	1.24	if (str_input(username, sizeof(username), DOECHO) < 0)
50			{
51			continue;
52			}
53	sysadm	1.11
54			if (strcmp(username, "guest") == 0)
55			{
56	sysadm	1.41	load_guest_info();
57	sysadm	1.14
58	sysadm	1.11	return 0;
59			}
60
61			if (strcmp(username, "new") == 0)
62			{
63	sysadm	1.42	display_file(DATA_REGISTER, 1);
64	sysadm	1.30
65	sysadm	1.51	return -1;
66	sysadm	1.11	}
67
68	sysadm	1.17	if (username[0] != '\0')
69	sysadm	1.11	{
70	sysadm	1.49	prints("\033[1;37m请输入密码\033[m: ");
71	sysadm	1.11	iflush();
72
73	sysadm	1.24	if (str_input(password, sizeof(password), NOECHO) < 0)
74			{
75			continue;
76			}
77	sysadm	1.11
78	sysadm	1.41	ok = (check_user(username, password) == 0);
79	sysadm	1.31	iflush();
80	sysadm	1.11	}
81	sysadm	1.24	}
82
83			if (!ok)
84			{
85	sysadm	1.42	display_file(DATA_LOGIN_ERROR, 1);
86	sysadm	1.24	return -1;
87	sysadm	1.11	}
88	sysadm	1.2
89	sysadm	1.38	log_common("User \"%s\"(%ld) login from %s:%d\n",
90	sysadm	1.39	BBS_username, BBS_priv.uid, hostaddr_client, port_client);
91	sysadm	1.28
92	sysadm	1.11	return 0;
93			}
94	sysadm	1.2
95	sysadm	1.41	int check_user(const char username, const char password)
96	sysadm	1.11	{
97	sysadm	1.44	MYSQL *db = NULL;
98			MYSQL_RES *rs = NULL;
99	sysadm	1.11	MYSQL_ROW row;
100	sysadm	1.15	char sql[SQL_BUFFER_LEN];
101	sysadm	1.44	int ret = 0;
102	sysadm	1.40	int BBS_uid = 0;
103	sysadm	1.22	char client_addr[IP_ADDR_LEN];
104	sysadm	1.27	int i;
105			int ok = 1;
106	sysadm	1.34	char user_tz_env[BBS_user_tz_max_len + 2];
107	sysadm	1.11
108	sysadm	1.41	db = db_open();
109			if (db == NULL)
110			{
111	sysadm	1.44	ret = -1;
112			goto cleanup;
113	sysadm	1.41	}
114
115	sysadm	1.11	// Verify format
116	sysadm	1.27	for (i = 0; ok && username[i] != '\0'; i++)
117			{
118	sysadm	1.63	if (!(isalpha(username[i]) \|\| (i > 0 && (isdigit(username[i]) \|\| username[i] == '_'))))
119	sysadm	1.27	{
120			ok = 0;
121			}
122			}
123	sysadm	1.64	if (ok && (i < BBS_username_min_len \|\| i > BBS_username_max_len))
124	sysadm	1.27	{
125			ok = 0;
126			}
127			for (i = 0; ok && password[i] != '\0'; i++)
128			{
129			if (!isalnum(password[i]))
130			{
131			ok = 0;
132			}
133			}
134	sysadm	1.64	if (ok && (i < BBS_password_min_len \|\| i > BBS_password_max_len))
135	sysadm	1.27	{
136			ok = 0;
137			}
138
139			if (!ok)
140	sysadm	1.5	{
141	sysadm	1.49	prints("\033[1;31m用户名或密码格式错误...\033[m\r\n");
142	sysadm	1.44	ret = 1;
143			goto cleanup;
144	sysadm	1.5	}
145
146	sysadm	1.13	// Begin transaction
147			if (mysql_query(db, "SET autocommit=0") != 0)
148			{
149	sysadm	1.33	log_error("SET autocommit=0 error: %s\n", mysql_error(db));
150	sysadm	1.44	ret = -1;
151			goto cleanup;
152	sysadm	1.13	}
153
154			if (mysql_query(db, "BEGIN") != 0)
155			{
156	sysadm	1.33	log_error("Begin transaction error: %s\n", mysql_error(db));
157	sysadm	1.44	ret = -1;
158			goto cleanup;
159	sysadm	1.13	}
160
161	sysadm	1.22	// Failed login attempts from the same source (subnet /24) during certain time period
162			strncpy(client_addr, hostaddr_client, sizeof(client_addr) - 1);
163			client_addr[sizeof(client_addr) - 1] = '\0';
164
165			snprintf(sql, sizeof(sql),
166			"SELECT COUNT(*) AS err_count FROM user_err_login_log "
167	sysadm	1.44	"WHERE login_dt >= SUBDATE(NOW(), INTERVAL %d MINUTE) "
168	sysadm	1.22	"AND login_ip LIKE '%s'",
169	sysadm	1.44	BBS_login_failures_count_interval,
170	sysadm	1.22	ip_mask(client_addr, 1, '%'));
171			if (mysql_query(db, sql) != 0)
172			{
173	sysadm	1.33	log_error("Query user_list error: %s\n", mysql_error(db));
174	sysadm	1.44	ret = -1;
175			goto cleanup;
176	sysadm	1.22	}
177			if ((rs = mysql_store_result(db)) == NULL)
178			{
179			log_error("Get user_list data failed\n");
180	sysadm	1.44	ret = -1;
181			goto cleanup;
182	sysadm	1.22	}
183			if ((row = mysql_fetch_row(rs)))
184			{
185	sysadm	1.52	if (atoi(row[0]) >= BBS_allowed_login_failures_within_interval)
186	sysadm	1.22	{
187	sysadm	1.52	prints("\033[1;31m来源存在多次失败登陆尝试，请稍后再试，或使用Web方式访问\033[m\r\n");
188	sysadm	1.44	ret = 1;
189			goto cleanup;
190	sysadm	1.22	}
191			}
192			mysql_free_result(rs);
193	sysadm	1.44	rs = NULL;
194	sysadm	1.22
195	sysadm	1.52	// Failed login attempts against the current username since last successful login
196	sysadm	1.22	snprintf(sql, sizeof(sql),
197			"SELECT COUNT(*) AS err_count FROM user_err_login_log "
198	sysadm	1.52	"LEFT JOIN user_list ON user_err_login_log.username = user_list.username "
199			"LEFT JOIN user_pubinfo ON user_list.UID = user_pubinfo.UID "
200			"WHERE user_err_login_log.username = '%s' "
201			"AND (user_err_login_log.login_dt >= user_pubinfo.last_login_dt "
202			"OR user_pubinfo.last_login_dt IS NULL)",
203	sysadm	1.22	username);
204			if (mysql_query(db, sql) != 0)
205			{
206	sysadm	1.33	log_error("Query user_list error: %s\n", mysql_error(db));
207	sysadm	1.44	ret = -1;
208			goto cleanup;
209	sysadm	1.22	}
210			if ((rs = mysql_store_result(db)) == NULL)
211			{
212			log_error("Get user_list data failed\n");
213	sysadm	1.44	ret = -1;
214			goto cleanup;
215	sysadm	1.22	}
216			if ((row = mysql_fetch_row(rs)))
217			{
218	sysadm	1.53	if (atoi(row[0]) >= BBS_allowed_login_failures_per_account)
219	sysadm	1.22	{
220	sysadm	1.52	prints("\033[1;31m账户存在多次失败登陆尝试，请使用Web方式登录解锁\033[m\r\n");
221	sysadm	1.44	ret = 1;
222			goto cleanup;
223	sysadm	1.22	}
224			}
225			mysql_free_result(rs);
226	sysadm	1.44	rs = NULL;
227	sysadm	1.22
228	sysadm	1.18	snprintf(sql, sizeof(sql),
229	sysadm	1.22	"SELECT UID, username, p_login FROM user_list "
230			"WHERE username = '%s' AND password = SHA2('%s', 256) AND enable",
231			username, password);
232	sysadm	1.11	if (mysql_query(db, sql) != 0)
233			{
234	sysadm	1.33	log_error("Query user_list error: %s\n", mysql_error(db));
235	sysadm	1.44	ret = -1;
236			goto cleanup;
237	sysadm	1.11	}
238			if ((rs = mysql_store_result(db)) == NULL)
239	sysadm	1.2	{
240	sysadm	1.11	log_error("Get user_list data failed\n");
241	sysadm	1.44	ret = -1;
242			goto cleanup;
243	sysadm	1.11	}
244	sysadm	1.15	if ((row = mysql_fetch_row(rs)))
245	sysadm	1.11	{
246	sysadm	1.40	BBS_uid = atoi(row[0]);
247	sysadm	1.17	strncpy(BBS_username, row[1], sizeof(BBS_username) - 1);
248			BBS_username[sizeof(BBS_username) - 1] = '\0';
249	sysadm	1.13	int p_login = atoi(row[2]);
250
251			mysql_free_result(rs);
252	sysadm	1.44	rs = NULL;
253	sysadm	1.13
254			// Add user login log
255	sysadm	1.18	snprintf(sql, sizeof(sql),
256	sysadm	1.22	"INSERT INTO user_login_log(UID, login_dt, login_ip) "
257	sysadm	1.40	"VALUES(%d, NOW(), '%s')",
258	sysadm	1.22	BBS_uid, hostaddr_client);
259	sysadm	1.13	if (mysql_query(db, sql) != 0)
260			{
261	sysadm	1.33	log_error("Insert into user_login_log error: %s\n", mysql_error(db));
262	sysadm	1.44	ret = -1;
263			goto cleanup;
264	sysadm	1.13	}
265
266			// Commit transaction
267			if (mysql_query(db, "COMMIT") != 0)
268			{
269	sysadm	1.33	log_error("Commit transaction error: %s\n", mysql_error(db));
270	sysadm	1.44	ret = -1;
271			goto cleanup;
272	sysadm	1.13	}
273
274			if (p_login == 0)
275	sysadm	1.11	{
276	sysadm	1.49	prints("\033[1;31m您目前无权登陆...\033[m\r\n");
277	sysadm	1.44	ret = 1;
278			goto cleanup;
279	sysadm	1.11	}
280			}
281			else
282			{
283			mysql_free_result(rs);
284	sysadm	1.44	rs = NULL;
285	sysadm	1.2
286	sysadm	1.18	snprintf(sql, sizeof(sql),
287	sysadm	1.22	"INSERT INTO user_err_login_log(username, password, login_dt, login_ip) "
288			"VALUES('%s', '%s', NOW(), '%s')",
289			username, password, hostaddr_client);
290	sysadm	1.11	if (mysql_query(db, sql) != 0)
291			{
292	sysadm	1.33	log_error("Insert into user_err_login_log error: %s\n", mysql_error(db));
293	sysadm	1.44	ret = -1;
294			goto cleanup;
295	sysadm	1.11	}
296
297	sysadm	1.13	// Commit transaction
298			if (mysql_query(db, "COMMIT") != 0)
299			{
300	sysadm	1.33	log_error("Commit transaction error: %s\n", mysql_error(db));
301	sysadm	1.44	ret = -1;
302			goto cleanup;
303	sysadm	1.13	}
304
305	sysadm	1.49	prints("\033[1;31m错误的用户名或密码...\033[m\r\n");
306	sysadm	1.44	ret = 1;
307			goto cleanup;
308	sysadm	1.11	}
309	sysadm	1.13
310			// Set AUTOCOMMIT = 1
311			if (mysql_query(db, "SET autocommit=1") != 0)
312			{
313	sysadm	1.33	log_error("SET autocommit=1 error: %s\n", mysql_error(db));
314	sysadm	1.44	ret = -1;
315			goto cleanup;
316	sysadm	1.13	}
317	sysadm	1.2
318	sysadm	1.11	ret = load_user_info(db, BBS_uid);
319
320			switch (ret)
321	sysadm	1.2	{
322	sysadm	1.11	case 0: // Login successfully
323			break;
324			case -1: // Load data error
325	sysadm	1.49	prints("\033[1;31m读取用户数据错误...\033[m\r\n");
326	sysadm	1.44	ret = -1;
327			goto cleanup;
328	sysadm	1.11	case -2: // Unused
329	sysadm	1.49	prints("\033[1;31m请通过Web登录更新用户许可协议...\033[m\r\n");
330	sysadm	1.44	ret = 1;
331			goto cleanup;
332	sysadm	1.11	case -3: // Dead
333	sysadm	1.49	prints("\033[1;31m很遗憾，您已经永远离开了我们的世界！\033[m\r\n");
334	sysadm	1.44	ret = 1;
335			goto cleanup;
336	sysadm	1.11	default:
337	sysadm	1.44	ret = -2;
338			goto cleanup;
339	sysadm	1.2	}
340
341	sysadm	1.18	snprintf(sql, sizeof(sql),
342	sysadm	1.22	"UPDATE user_pubinfo SET visit_count = visit_count + 1, "
343	sysadm	1.40	"last_login_dt = NOW() WHERE UID = %d",
344	sysadm	1.22	BBS_uid);
345	sysadm	1.13	if (mysql_query(db, sql) != 0)
346			{
347	sysadm	1.33	log_error("Update user_pubinfo error: %s\n", mysql_error(db));
348	sysadm	1.44	ret = -1;
349			goto cleanup;
350	sysadm	1.13	}
351
352	sysadm	1.15	if (user_online_add(db) != 0)
353			{
354	sysadm	1.44	ret = -1;
355			goto cleanup;
356	sysadm	1.15	}
357
358	sysadm	1.45	BBS_last_access_tm = BBS_login_tm = time(NULL);
359	sysadm	1.13
360	sysadm	1.34	// Set user tz to process env
361			if (BBS_user_tz[0] != '\0')
362			{
363			user_tz_env[0] = ':';
364			strncpy(user_tz_env + 1, BBS_user_tz, sizeof(user_tz_env) - 2);
365			user_tz_env[sizeof(user_tz_env) - 1] = '\0';
366
367			if (setenv("TZ", user_tz_env, 1) == -1)
368			{
369			log_error("setenv(TZ = %s) error %d\n", user_tz_env, errno);
370			return -3;
371			}
372
373			tzset();
374			}
375
376	sysadm	1.44	cleanup:
377			mysql_free_result(rs);
378	sysadm	1.41	mysql_close(db);
379
380	sysadm	1.44	return ret;
381	sysadm	1.1	}
382	sysadm	1.2
383	sysadm	1.40	int load_user_info(MYSQL *db, int BBS_uid)
384	sysadm	1.3	{
385	sysadm	1.44	MYSQL_RES *rs = NULL;
386	sysadm	1.11	MYSQL_ROW row;
387	sysadm	1.15	char sql[SQL_BUFFER_LEN];
388	sysadm	1.11	int life;
389			time_t last_login_dt;
390	sysadm	1.44	int ret = 0;
391	sysadm	1.11
392	sysadm	1.18	snprintf(sql, sizeof(sql),
393	sysadm	1.43	"SELECT life, UNIX_TIMESTAMP(last_login_dt), user_timezone, exp, nickname "
394	sysadm	1.40	"FROM user_pubinfo WHERE UID = %d",
395	sysadm	1.22	BBS_uid);
396	sysadm	1.11	if (mysql_query(db, sql) != 0)
397			{
398	sysadm	1.33	log_error("Query user_pubinfo error: %s\n", mysql_error(db));
399	sysadm	1.44	ret = -1;
400			goto cleanup;
401	sysadm	1.11	}
402			if ((rs = mysql_store_result(db)) == NULL)
403			{
404			log_error("Get user_pubinfo data failed\n");
405	sysadm	1.44	ret = -1;
406			goto cleanup;
407	sysadm	1.11	}
408	sysadm	1.15	if ((row = mysql_fetch_row(rs)))
409	sysadm	1.11	{
410			life = atoi(row[0]);
411			last_login_dt = (time_t)atol(row[1]);
412	sysadm	1.34
413			strncpy(BBS_user_tz, row[2], sizeof(BBS_user_tz) - 1);
414			BBS_user_tz[sizeof(BBS_user_tz) - 1] = '\0';
415	sysadm	1.43
416			BBS_user_exp = atoi(row[3]);
417
418			strncpy(BBS_nickname, row[4], sizeof(BBS_nickname));
419			BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';
420	sysadm	1.11	}
421			else
422			{
423	sysadm	1.44	ret = -1; // Data not found
424			goto cleanup;
425	sysadm	1.11	}
426			mysql_free_result(rs);
427	sysadm	1.44	rs = NULL;
428	sysadm	1.3
429	sysadm	1.13	if (life != 333 && life != 365 && life != 666 && life != 999 && // Not immortal
430	sysadm	1.45	time(NULL) - last_login_dt > 60 * 60 * 24 * life)
431	sysadm	1.11	{
432	sysadm	1.44	ret = -3; // Dead
433			goto cleanup;
434	sysadm	1.11	}
435	sysadm	1.5
436	sysadm	1.15	if (load_priv(db, &BBS_priv, BBS_uid) != 0)
437			{
438	sysadm	1.44	ret = -1;
439			goto cleanup;
440	sysadm	1.15	}
441	sysadm	1.11
442	sysadm	1.44	cleanup:
443			mysql_free_result(rs);
444
445			return ret;
446	sysadm	1.2	}
447	sysadm	1.5
448	sysadm	1.41	int load_guest_info(void)
449	sysadm	1.5	{
450	sysadm	1.44	MYSQL *db = NULL;
451			int ret = 0;
452	sysadm	1.41
453			db = db_open();
454			if (db == NULL)
455			{
456	sysadm	1.44	ret = -1;
457			goto cleanup;
458	sysadm	1.41	}
459
460	sysadm	1.17	strncpy(BBS_username, "guest", sizeof(BBS_username) - 1);
461			BBS_username[sizeof(BBS_username) - 1] = '\0';
462	sysadm	1.5
463	sysadm	1.43	BBS_user_exp = 0;
464
465			strncpy(BBS_nickname, "Guest", sizeof(BBS_nickname));
466			BBS_nickname[sizeof(BBS_nickname) - 1] = '\0';
467
468	sysadm	1.15	if (load_priv(db, &BBS_priv, 0) != 0)
469			{
470	sysadm	1.44	ret = -1;
471			goto cleanup;
472	sysadm	1.15	}
473	sysadm	1.6
474	sysadm	1.15	if (user_online_add(db) != 0)
475			{
476	sysadm	1.44	ret = -1;
477			goto cleanup;
478	sysadm	1.15	}
479	sysadm	1.5
480	sysadm	1.45	BBS_last_access_tm = BBS_login_tm = time(NULL);
481	sysadm	1.5
482	sysadm	1.44	cleanup:
483	sysadm	1.41	mysql_close(db);
484	sysadm	1.44
485			return ret;
486	sysadm	1.5	}
487	sysadm	1.15
488			int user_online_add(MYSQL *db)
489			{
490			char sql[SQL_BUFFER_LEN];
491
492	sysadm	1.60	snprintf(sql, sizeof(sql),
493			"INSERT INTO visit_log(dt, IP) VALUES(NOW(), '%s')",
494			hostaddr_client);
495			if (mysql_query(db, sql) != 0)
496			{
497			log_error("Add visit log error: %s\n", mysql_error(db));
498			return -1;
499			}
500
501	sysadm	1.15	if (user_online_del(db) != 0)
502			{
503	sysadm	1.60	return -2;
504	sysadm	1.15	}
505
506	sysadm	1.18	snprintf(sql, sizeof(sql),
507	sysadm	1.61	"INSERT INTO user_online(SID, UID, ip, current_action, login_tm, last_tm) "
508			"VALUES('Telnet_Process_%d', %d, '%s', 'LOGIN', NOW(), NOW())",
509	sysadm	1.22	getpid(), BBS_priv.uid, hostaddr_client);
510	sysadm	1.15	if (mysql_query(db, sql) != 0)
511			{
512	sysadm	1.33	log_error("Add user_online error: %s\n", mysql_error(db));
513	sysadm	1.60	return -3;
514	sysadm	1.15	}
515
516			return 0;
517			}
518
519			int user_online_del(MYSQL *db)
520			{
521			char sql[SQL_BUFFER_LEN];
522
523	sysadm	1.57	snprintf(sql, sizeof(sql),
524			"DELETE FROM user_online WHERE SID = 'Telnet_Process_%d'",
525			getpid());
526			if (mysql_query(db, sql) != 0)
527			{
528			log_error("Delete user_online error: %s\n", mysql_error(db));
529			return -1;
530			}
531
532			return 0;
533			}
534
535			int user_online_exp(MYSQL *db)
536			{
537			char sql[SQL_BUFFER_LEN];
538
539	sysadm	1.56	// +1 exp for every 5 minutes online since last logout
540			// but at most 24 hours worth of exp can be gained in Telnet session
541			snprintf(sql, sizeof(sql),
542	sysadm	1.60	"UPDATE user_pubinfo SET exp = exp + FLOOR(LEAST(TIMESTAMPDIFF("
543			"SECOND, GREATEST(last_login_dt, IF(last_logout_dt IS NULL, last_login_dt, last_logout_dt)), NOW()"
544			") / 60 / 5, 12 * 24)), last_logout_dt = NOW() "
545			"WHERE UID = %d",
546			BBS_priv.uid);
547	sysadm	1.56	if (mysql_query(db, sql) != 0)
548			{
549			log_error("Update user_pubinfo error: %s\n", mysql_error(db));
550			return -1;
551			}
552	sysadm	1.15
553			return 0;
554			}
555	sysadm	1.47
556			int user_online_update(const char *action)
557			{
558			MYSQL *db = NULL;
559			char sql[SQL_BUFFER_LEN];
560
561	sysadm	1.55	if ((action == NULL \|\| strcmp(BBS_current_action, action) == 0) &&
562	sysadm	1.54	time(NULL) - BBS_current_action_tm < BBS_current_action_refresh_interval) // No change
563	sysadm	1.47	{
564			return 0;
565			}
566
567	sysadm	1.55	if (action != NULL)
568			{
569			strncpy(BBS_current_action, action, sizeof(BBS_current_action) - 1);
570			BBS_current_action[sizeof(BBS_current_action) - 1] = '\0';
571			}
572
573	sysadm	1.54	BBS_current_action_tm = time(NULL);
574	sysadm	1.47
575			db = db_open();
576			if (db == NULL)
577			{
578			log_error("db_open() error: %s\n", mysql_error(db));
579			return -1;
580			}
581
582			snprintf(sql, sizeof(sql),
583	sysadm	1.62	"UPDATE user_online SET current_action = '%s', last_tm = NOW() "
584	sysadm	1.47	"WHERE SID = 'Telnet_Process_%d'",
585			BBS_current_action, getpid());
586			if (mysql_query(db, sql) != 0)
587			{
588			log_error("Update user_online error: %s\n", mysql_error(db));
589			return -2;
590			}
591
592			mysql_close(db);
593
594			return 1;
595			}
webmaster@leafok.com	ViewVC Help
Powered by ViewVC 1.3.0-beta1