# This patch file was generated by NetBeans IDE # This patch can be applied using context Tools: Apply Diff Patch action on respective folder. # It uses platform neutral UTF-8 encoding. # Above lines and this line are ignored by the patching process. Index: contributions/modules/login_security/login_security.admin.inc --- contributions/modules/login_security/login_security.admin.inc No Base Revision +++ contributions/modules/login_security/login_security.admin.inc Locally New @@ -0,0 +1,177 @@ + 'textfield', + '#title' => t('Track time'), + '#default_value' => variable_get('login_security_track_time', LOGIN_SECURITY_TRACK_TIME), + '#element_validate' => array('_login_security_valid_integer'), + '#size' => 3, + '#maxlength' => 3, + '#description' => t('The time window where to check for security violiations: the time in hours the login information is kept to compute the login attempts count. A common example could be 24 hours. After that time, the attempt is deleted from the list, and will never be considered again.'), + '#field_suffix' => ''. t('Hours') .'' + ); + $form['login_security_delay_base_time'] = array( + '#type' => 'textfield', + '#title' => t('Login delay base time'), + '#default_value' => variable_get('login_security_delay_base_time', LOGIN_SECURITY_BASE_TIME), + '#element_validate' => array('_login_security_valid_integer'), + '#size' => 3, + '#maxlength' => 3, + '#description' => t('Delay in seconds for the login process: any invalid login attempt will have a punishment of these seconds, as a protection for password guessing attempts.'), + '#field_suffix' => ''. t('Seconds') .'' + ); + $form['login_security_delay_increase'] = array( + '#type' => 'radios', + '#title' => t('Increase delay for each attempt?'), + '#default_value' => variable_get('login_security_delay_increase', LOGIN_SECURITY_DELAY_INCREASE), + '#options' => array(1 => 'Yes', 0 => 'No'), + '#description' => t('Increase delay in seconds for the next login count. It is computed by host and user, so any attempt to login again with the same user from the same IP address will be punished with a delay computed as (delay base time) x (login attempts for this user from this IP address) in seconds. The number of attempts is counted within the "Track time" time value. In the previous example of 24 hours tracking time, after 24h the login attemps will be cleared, and the delay decreased.'), + ); + $form['login_security_user_wrong_count'] = array( + '#type' => 'textfield', + '#title' => t('Maximum number of login failures before blocking a user'), + '#default_value' => variable_get('login_security_user_wrong_count', LOGIN_SECURITY_USER_WRONG_COUNT), + '#element_validate' => array('_login_security_valid_integer'), + '#size' => 3, + '#maxlength' => 3, + '#description' => t('Enter the number of login failures a user is allowed. After that amount is reached, the user will be blocked, no matter the host attempting to log in. Use this option carefully on public sites, as an attacker may block your site users. The user blocking protection will not dissapear and should be removed manually from the !users interface.', array('!users' => l('user management', 'admin/user/user'))), + '#field_suffix' => ''. t('Failed attempts') .'' + ); + $form['login_security_host_wrong_count'] = array( + '#type' => 'textfield', + '#title' => t('Maximum number of login failures before soft blocking a host'), + '#default_value' => variable_get('login_security_host_wrong_count', LOGIN_SECURITY_HOST_WRONG_COUNT), + '#element_validate' => array('_login_security_valid_integer'), + '#size' => 3, + '#maxlength' => 3, + '#description' => t('Enter the number of login failures a host is allowed. After that amount is reached, the host will not be able to submit the log in form again, but can still browse the site contents as an anonymous user. This protection is efective during the time indicated at tracking time opion.'), + '#field_suffix' => ''. t('Failed attempts') .'' + ); + $form['login_security_host_wrong_count_hard'] = array( + '#type' => 'textfield', + '#title' => t('Maximum number of login failures before blocking a host'), + '#default_value' => variable_get('login_security_host_wrong_count_hard', LOGIN_SECURITY_HOST_WRONG_COUNT_HARD), + '#element_validate' => array('_login_security_valid_integer'), + '#size' => 3, + '#maxlength' => 3, + '#description' => t('Enter the number of login failures a host is allowed. After that number is reached, the host will be blocked, no matter the username attempting to log in. The host blocking protection will not dissapear automatically and should be removed manually from the !access administration interface.', array('!access' => l('access rules', 'admin/user/rules'))), + '#field_suffix' => ''. t('Failed attempts') .'' + ); + + $form['login_messages'] = array( + '#type' => 'fieldset', + '#title' => t('Notifications'), + ); + $form['login_messages']['login_security_disable_core_login_error'] = array( + '#type' => 'checkbox', + '#title' => t('Disable login failure error message'), + '#description' => t('Checking this option login error messages will never be shown to the users. They will not be aware if the account exists, an invalid user name or password has been submitted or if the account is blocked. The core message "Sorry, unrecognized username or password. Have you forgotten your password?" is also hidden for the user.'), + '#default_value' => variable_get('login_security_disable_core_login_error', LOGIN_SECURITY_DISABLE_CORE_LOGIN_ERROR) + ); + $form['login_messages']['login_security_notice_attempts_available'] = array( + '#type' => 'checkbox', + '#title' => t('Notify the user about the number of remaining login attempts'), + '#default_value' => variable_get('login_security_notice_attempts_available', LOGIN_SECURITY_NOTICE_ATTEMPTS_AVAILABLE), + '#description' => t('Checking this option, the user is notified about the number of remaining login attempts before the account gets blocked. Security tip: If you enable this option, try to not disclose as much of your login policies as possible in the message shown on any failed login attempt.'), + ); + $form['login_messages']['login_security_last_login_timestamp'] = array( + '#type' => 'checkbox', + '#title' => t('Display last login timestamp'), + '#description' => t('Checking this option, when a user does success in login, a message will remember him when was the last time he logged in the site.'), + '#default_value' => variable_get('login_security_last_login_timestamp', 0) + ); + $form['login_messages']['login_security_last_access_timestamp'] = array( + '#type' => 'checkbox', + '#title' => t('Display last access timestamp'), + '#description' => t('Checking this option, when a user does success in login, a message will remember him when was the last site access with this account.'), + '#default_value' => variable_get('login_security_last_access_timestamp', 0) + ); + $form['login_messages']['login_security_user_blocked_email'] = array( + '#type' => 'checkbox', + '#title' => t('Send email message to the admin (uid 1) when a user is blocked by this module.'), + '#default_value' => variable_get('login_security_user_blocked_email', LOGIN_SECURITY_USER_BLOCKED_EMAIL), + ); + + + $form['login_security']['Notifications'] = array( + '#type' => 'fieldset', + '#title' => t('Edit notification texts'), + '#weight' => 3, + '#collapsible' => TRUE, + '#collapsed' => TRUE, + '#description' => t("You may edit the notifications used by the Login Security module. Allowed placeholders for all the notifications include the following: "), + ); + $form['login_security']['Notifications']['login_security_notice_attempts_message'] = array( + '#type' => 'textarea', + '#title' => t('Message to be shown on each failed login attempt'), + '#rows' => 2, + '#default_value' => variable_get('login_security_notice_attempts_message', LOGIN_SECURITY_NOTICE_ATTEMPTS_MESSAGE), + '#description' => t('Enter the message string to be shown if the login fails after the form is submitted. You can use any of the placeholders here.'), + ); + $form['login_security']['Notifications']['login_security_host_soft_banned'] = array( + '#type' => 'textarea', + '#title' => t('Message for banned host (Soft IP ban)'), + '#rows' => 2, + '#default_value' => variable_get('login_security_host_soft_banned', LOGIN_SECURITY_HOST_SOFT_BANNED), + '#description' => t('Enter the soft IP ban message to be shown when a host attempts to log in too many times.'), + ); + $form['login_security']['Notifications']['login_security_host_hard_banned'] = array( + '#type' => 'textarea', + '#rows' => 2, + '#title' => t('Message for banned host (Hard IP ban)'), + '#default_value' => variable_get('login_security_host_hard_banned', LOGIN_SECURITY_HOST_HARD_BANNED), + '#description' => t('Enter the hard IP ban message to be shown when a host attempts to log in too many times.'), + ); + $form['login_security']['Notifications']['login_security_user_blocked'] = array( + '#type' => 'textarea', + '#rows' => 2, + '#title' => t('Message when user is blocked by uid'), + '#default_value' => variable_get('login_security_user_blocked', LOGIN_SECURITY_USER_BLOCKED), + '#description' => t('Enter the message to be shown when a user gets blocked due to enough failed login attempts.'), + ); + + $form['login_security']['Notifications']['email'] = array( + '#type' => 'fieldset', + '#title' => t('Email to be sent to the administrator user (uid 1) for blocked accounts.'), + '#weight' => 3, + '#description' => t('Configure the subject and body fo the email message.'), + ); + + $form['login_security']['Notifications']['email']['login_security_user_blocked_email_subject'] = array( + '#type' => 'textfield', + '#title' => t('Email subject'), + '#default_value' => variable_get('login_security_user_blocked_email_subject', LOGIN_SECURITY_USER_BLOCKED_EMAIL_SUBJECT), + ); + $form['login_security']['Notifications']['email']['login_security_user_blocked_email_body'] = array( + '#type' => 'textarea', + '#title' => t('Email body'), + '#default_value' => variable_get('login_security_user_blocked_email_body', LOGIN_SECURITY_USER_BLOCKED_EMAIL_BODY), + '#description' => t('Enter the message to be sent to the administrator informing a user has been blocked.'), + ); + + return system_settings_form($form); +} + +/* + * Verify that element is a positive integer value + */ +function _login_security_valid_integer($element, &$form_state) { + if (!ctype_alnum($element['#value']) || intval($element['#value']) < 0 ) { + form_error($element, t('The !field field should be a positive integer value greater than or equal to 0.', array('!field' => $element['#title']))); + } +} Index: contributions/modules/login_security/login_security.install --- contributions/modules/login_security/login_security.install Base (1.6.2.6) +++ contributions/modules/login_security/login_security.install Locally Modified (Based On 1.6.2.6) @@ -1,5 +1,5 @@ t('Keeps track of failed login attempts and the associated IP address and user name.'), + 'description' => t('Keeps track of failed login attempts, as a pair of the IP address and user name.'), 'fields' => array( 'id' => array( 'type' => 'serial', 'not null' => TRUE, - 'description' => t("Hidden ID for each security event."), + 'description' => t("ID of each login event."), ), 'host' => array( 'type' => 'varchar', 'length' => 39, 'not null' => TRUE, 'default' => '', - 'description' => t("The ip address of the connection."), + 'description' => t("The IP address of the request."), ), 'name' => array( 'type' => 'varchar', 'length' => 64, 'not null' => TRUE, 'default' => '', - 'description' => t("Username used in the login."), + 'description' => t("Clean username, submitted using the login form."), ), 'timestamp' => array( 'type' => 'int', @@ -98,7 +98,7 @@ 'length' => 39, 'not null' => TRUE, 'default' => '', - 'description' => t("The IP address of the connection."), + 'description' => t("The IP address of the request."), ) ); db_add_index($ret, 'login_security_track', 'host', array('host')); @@ -126,7 +126,7 @@ 'length' => 64, 'not null' => TRUE, 'default' => '', - 'description' => t("Username used in the login submission."), + 'description' => t("Clean username, after submitted using the login form."), ) ); db_change_field($ret, 'login_security_track', 'timestamp', 'timestamp', array( Index: contributions/modules/login_security/login_security.menu.inc --- contributions/modules/login_security/login_security.menu.inc No Base Revision +++ contributions/modules/login_security/login_security.menu.inc Locally New @@ -0,0 +1,26 @@ +> Site configuration >> Login Security settings + 'admin/settings/login_security' => array( + 'title' => 'Login Security', + 'description' => 'Configure security settings in the login form submission.', + 'access arguments' => array('administer site configuration'), + 'page callback' => 'drupal_get_form', + 'page arguments' => array('login_security_admin_settings'), + 'file' => 'login_security.admin.inc', + ), + ); +} Index: contributions/modules/login_security/login_security.module --- contributions/modules/login_security/login_security.module Base (1.12.2.12) +++ contributions/modules/login_security/login_security.module Locally Modified (Based On 1.12.2.12) @@ -36,6 +36,14 @@ } /** + * Implementation of hook_menu(). + */ +function login_security_menu() { + module_load_include('inc', 'login_security', 'login_security.menu'); + return _login_security_menu(); +} + +/** * Implementation of hook_user(). */ function login_security_user($op, &$edit, &$account, $category = NULL) { @@ -69,188 +77,10 @@ $form['#validate'] = array_merge(array('login_security_soft_block_validate', 'login_security_set_login_timestamp'), $form['#validate']); $form['#validate'][] = 'login_security_validate'; break; - case 'user_admin_settings': - if (user_access('administer users')) { - $form['login_security'] = array( - '#type' => 'fieldset', - '#title' => t('Login Security settings'), - '#weight' => 0, - '#collapsible' => FALSE, - ); - $form['login_security'][] = login_security_build_admin_form(); } - break; } -} /** - * Build a form body for the configuration settings. - */ -function login_security_build_admin_form() { - $form = array(); - - $form['login_security_track_time'] = array( - '#type' => 'textfield', - '#title' => t('Track time'), - '#default_value' => variable_get('login_security_track_time', LOGIN_SECURITY_TRACK_TIME), - '#element_validate' => array('_login_security_valid_integer'), - '#size' => 3, - '#maxlength' => 3, - '#description' => t('The time window where to check for security violiations: the time in hours the login information is kept to compute the login attempts count. A common example could be 24 hours. After that time, the attempt is deleted from the list, and will never be considered again.'), - '#field_suffix' => ''. t('Hours') .'' - ); - $form['login_security_delay_base_time'] = array( - '#type' => 'textfield', - '#title' => t('Login delay base time'), - '#default_value' => variable_get('login_security_delay_base_time', LOGIN_SECURITY_BASE_TIME), - '#element_validate' => array('_login_security_valid_integer'), - '#size' => 3, - '#maxlength' => 3, - '#description' => t('Delay in seconds for the login process: any invalid login attempt will have a punishment of these seconds, as a protection for password guessing attempts.'), - '#field_suffix' => ''. t('Seconds') .'' - ); - $form['login_security_delay_increase'] = array( - '#type' => 'radios', - '#title' => t('Increase delay for each attempt?'), - '#default_value' => variable_get('login_security_delay_increase', LOGIN_SECURITY_DELAY_INCREASE), - '#options' => array(1 => 'Yes', 0 => 'No'), - '#description' => t('Increase delay in seconds for the next login count. It is computed by host and user, so any attempt to login again with the same user from the same IP address will be punished with a delay computed as (delay base time) x (login attempts for this user from this IP address) in seconds. The number of attempts is counted within the "Track time" time value. In the previous example of 24 hours tracking time, after 24h the login attemps will be cleared, and the delay decreased.'), - ); - $form['login_security_user_wrong_count'] = array( - '#type' => 'textfield', - '#title' => t('Maximum number of login failures before blocking a user'), - '#default_value' => variable_get('login_security_user_wrong_count', LOGIN_SECURITY_USER_WRONG_COUNT), - '#element_validate' => array('_login_security_valid_integer'), - '#size' => 3, - '#maxlength' => 3, - '#description' => t('Enter the number of login failures a user is allowed. After that amount is reached, the user will be blocked, no matter the host attempting to log in. Use this option carefully on public sites, as an attacker may block your site users. The user blocking protection will not dissapear and should be removed manually from the !users interface.', array('!users' => l('user management', 'admin/user/user'))), - '#field_suffix' => ''. t('Failed attempts') .'' - ); - $form['login_security_host_wrong_count'] = array( - '#type' => 'textfield', - '#title' => t('Maximum number of login failures before soft blocking a host'), - '#default_value' => variable_get('login_security_host_wrong_count', LOGIN_SECURITY_HOST_WRONG_COUNT), - '#element_validate' => array('_login_security_valid_integer'), - '#size' => 3, - '#maxlength' => 3, - '#description' => t('Enter the number of login failures a host is allowed. After that amount is reached, the host will not be able to submit the log in form again, but can still browse the site contents as an anonymous user. This protection is efective during the time indicated at tracking time opion.'), - '#field_suffix' => ''. t('Failed attempts') .'' - ); - $form['login_security_host_wrong_count_hard'] = array( - '#type' => 'textfield', - '#title' => t('Maximum number of login failures before blocking a host'), - '#default_value' => variable_get('login_security_host_wrong_count_hard', LOGIN_SECURITY_HOST_WRONG_COUNT_HARD), - '#element_validate' => array('_login_security_valid_integer'), - '#size' => 3, - '#maxlength' => 3, - '#description' => t('Enter the number of login failures a host is allowed. After that number is reached, the host will be blocked, no matter the username attempting to log in. The host blocking protection will not dissapear automatically and should be removed manually from the !access administration interface.', array('!access' => l('access rules', 'admin/user/rules'))), - '#field_suffix' => ''. t('Failed attempts') .'' - ); - - $form['login_messages'] = array( - '#type' => 'fieldset', - '#title' => t('Notifications'), - ); - $form['login_messages']['login_security_disable_core_login_error'] = array( - '#type' => 'checkbox', - '#title' => t('Disable login failure error message'), - '#description' => t('Checking this option login error messages will never be shown to the users. They will not be aware if the account exists, an invalid user name or password has been submitted or if the account is blocked. The core message "Sorry, unrecognized username or password. Have you forgotten your password?" is also hidden for the user.'), - '#default_value' => variable_get('login_security_disable_core_login_error', LOGIN_SECURITY_DISABLE_CORE_LOGIN_ERROR) - ); - $form['login_messages']['login_security_notice_attempts_available'] = array( - '#type' => 'checkbox', - '#title' => t('Notify the user about the number of remaining login attempts'), - '#default_value' => variable_get('login_security_notice_attempts_available', LOGIN_SECURITY_NOTICE_ATTEMPTS_AVAILABLE), - '#description' => t('Checking this option, the user is notified about the number of remaining login attempts before the account gets blocked. Security tip: If you enable this option, try to not disclose as much of your login policies as possible in the message shown on any failed login attempt.'), - ); - $form['login_messages']['login_security_last_login_timestamp'] = array( - '#type' => 'checkbox', - '#title' => t('Display last login timestamp'), - '#description' => t('Checking this option, when a user does success in login, a message will remember him when was the last time he logged in the site.'), - '#default_value' => variable_get('login_security_last_login_timestamp', 0) - ); - $form['login_messages']['login_security_last_access_timestamp'] = array( - '#type' => 'checkbox', - '#title' => t('Display last access timestamp'), - '#description' => t('Checking this option, when a user does success in login, a message will remember him when was the last site access with this account.'), - '#default_value' => variable_get('login_security_last_access_timestamp', 0) - ); - $form['login_messages']['login_security_user_blocked_email'] = array( - '#type' => 'checkbox', - '#title' => t('Send email message to the admin (uid 1) when a user is blocked by this module.'), - '#default_value' => variable_get('login_security_user_blocked_email', LOGIN_SECURITY_USER_BLOCKED_EMAIL), - ); - - - $form['login_security']['Notifications'] = array( - '#type' => 'fieldset', - '#title' => t('Edit notification texts'), - '#weight' => 3, - '#collapsible' => TRUE, - '#collapsed' => TRUE, - '#description' => t("You may edit the notifications used by the Login Security module. Allowed placeholders for all the notifications include the following: "), - ); - $form['login_security']['Notifications']['login_security_notice_attempts_message'] = array( - '#type' => 'textarea', - '#title' => t('Message to be shown on each failed login attempt'), - '#rows' => 2, - '#default_value' => variable_get('login_security_notice_attempts_message', LOGIN_SECURITY_NOTICE_ATTEMPTS_MESSAGE), - '#description' => t('Enter the message string to be shown if the login fails after the form is submitted. You can use any of the placeholders here.'), - ); - $form['login_security']['Notifications']['login_security_host_soft_banned'] = array( - '#type' => 'textarea', - '#title' => t('Message for banned host (Soft IP ban)'), - '#rows' => 2, - '#default_value' => variable_get('login_security_host_soft_banned', LOGIN_SECURITY_HOST_SOFT_BANNED), - '#description' => t('Enter the soft IP ban message to be shown when a host attempts to log in too many times.'), - ); - $form['login_security']['Notifications']['login_security_host_hard_banned'] = array( - '#type' => 'textarea', - '#rows' => 2, - '#title' => t('Message for banned host (Hard IP ban)'), - '#default_value' => variable_get('login_security_host_hard_banned', LOGIN_SECURITY_HOST_HARD_BANNED), - '#description' => t('Enter the hard IP ban message to be shown when a host attempts to log in too many times.'), - ); - $form['login_security']['Notifications']['login_security_user_blocked'] = array( - '#type' => 'textarea', - '#rows' => 2, - '#title' => t('Message when user is blocked by uid'), - '#default_value' => variable_get('login_security_user_blocked', LOGIN_SECURITY_USER_BLOCKED), - '#description' => t('Enter the message to be shown when a user gets blocked due to enough failed login attempts.'), - ); - - $form['login_security']['Notifications']['email'] = array( - '#type' => 'fieldset', - '#title' => t('Email to be sent to the administrator user (uid 1) for blocked accounts.'), - '#weight' => 3, - '#description' => t('Configure the subject and body fo the email message.'), - ); - - $form['login_security']['Notifications']['email']['login_security_user_blocked_email_subject'] = array( - '#type' => 'textfield', - '#title' => t('Email subject'), - '#default_value' => variable_get('login_security_user_blocked_email_subject', LOGIN_SECURITY_USER_BLOCKED_EMAIL_SUBJECT), - ); - $form['login_security']['Notifications']['email']['login_security_user_blocked_email_body'] = array( - '#type' => 'textarea', - '#title' => t('Email body'), - '#default_value' => variable_get('login_security_user_blocked_email_body', LOGIN_SECURITY_USER_BLOCKED_EMAIL_BODY), - '#description' => t('Enter the message to be sent to the administrator informing a user has been blocked.'), - ); - - return $form; -} - -/* - * Verify that element is a positive integer value - */ -function _login_security_valid_integer($element, &$form_state) { - if (!ctype_alnum($element['#value']) || intval($element['#value']) < 0 ) { - form_error($element, t('The !field field should be a positive integer value greater than or equal to 0.', array('!field' => $element['#title']))); - } -} - -/** * Previous incarnations of this code put it in hook_submit or hook_user, but since * Drupal core validation updates the login timestamp, we have to set the message before * it gets updated with the current login instance. Index: contributions/modules/login_security/login_security.test --- contributions/modules/login_security/login_security.test Base (1.1.2.8) +++ contributions/modules/login_security/login_security.test Locally Modified (Based On 1.1.2.8) @@ -19,14 +19,14 @@ parent::setUp('login_security'); // Create and login user - $admin_user = $this->drupalCreateUser(array('administer users')); + $admin_user = $this->drupalCreateUser(array('administer site configuration')); $this->drupalLogin($admin_user); // Set time tracking window to 1 hour variable_set('login_security_track_time', 1); } function testAdminUserSettings() { - $this->drupalGet('admin/user/settings'); \ No newline at end of file + $this->drupalGet('admin/settings/login_security'); \ No newline at end of file $this->assertResponse(200, t('Access granted to settings page.')); $this->assertField('login_security_track_time', t('Track time field exists.')); $this->assertField('login_security_delay_base_time', t('Delay base time field exists.')); Index: contributions/modules/login_security/README.txt --- contributions/modules/login_security/README.txt Base (1.4.4.2) +++ contributions/modules/login_security/README.txt Locally Modified (Based On 1.4.4.2) @@ -86,9 +86,9 @@ Configuration options --------------------- -Go to Administer -> User Management -> User Settings and new box will appear -close to the registering information with the following options. Any value -set to 0 will disable that option. +Go to Administer -> Site configuration -> Login Security (the url path is +admin/settings/login_security) and a form with the module options will be shown. +(Note: Any value set to 0 will disable that option.) Basic options @@ -147,8 +147,8 @@ - Send email message to the admin: An email could also be sent to the administrator (uid 1), each time an account is blocked. -Some of the strings are configurable in the same administration section. The -strings can be personalized using the following placeholders: +Notifications are configurable in the Login Security settings section, where +the strings could be personalized using the following placeholders: %date : The (formated) date and time of the operation %ip : The IP Address performing the operation