- [DEV-178] fixes to permission scheme in DM setup (Artem)

 - [DEV-153] changes in brute force blocking scheme (Artem)

git-svn-id: svn://svn.zabbix.com/trunk@5775 97f52cf1-0a1b-0410-bd0e-c28be96e8082

1 files changed, 10 insertions, 4 deletions

diff --git a/frontends/php/index.php b/frontends/php/index.php
index 831dba6d..1dc8bdd1 100644
--- a/frontends/php/index.php
+++ b/frontends/php/index.php
@@ -76,14 +76,20 @@
 		
 		$sql = 'SELECT u.userid,u.attempt_failed, u.attempt_clock, u.attempt_ip '.
 				' FROM users u '.
-				' WHERE u.alias='.zbx_dbstr($name).
-					' AND ( attempt_failed<'.ZBX_LOGIN_ATTEMPTS.
-							' OR (attempt_failed>'.(ZBX_LOGIN_ATTEMPTS-1).
-									' AND ('.time().'-attempt_clock)>'.ZBX_LOGIN_BLOCK.'))';
+				' WHERE u.alias='.zbx_dbstr($name);
+				
+//SQL to BLOCK attempts
+//					.' AND ( attempt_failed<'.ZBX_LOGIN_ATTEMPTS.
+//							' OR (attempt_failed>'.(ZBX_LOGIN_ATTEMPTS-1).
+//									' AND ('.time().'-attempt_clock)>'.ZBX_LOGIN_BLOCK.'))';
 					
 		$login = $attempt = DBfetch(DBselect($sql));
 		
 		if($login){
+			if($login['attempt_failed'] >= ZBX_LOGIN_ATTEMPTS){
+				sleep(ZBX_LOGIN_BLOCK);
+			}
+			
 			switch($config['authentication_type']){
 				case ZBX_AUTH_LDAP:
 					$login = ldap_authentication($name,get_request('password',''));