· 9 years ago · Aug 12, 2017, 12:34 AM
1#!/usr/bin/perl -w
2
3####################################################################################################
4
5use strict;
6use CGI;
7use DBI;
8use Digest::MD5 qw(md5 md5_hex);
9
10####################################################################################################
11
12BEGIN
13{
14 use FindBin;
15 use lib "$FindBin::Bin/../lib";
16
17 use Env;
18 Env::setProjectRoot("$FindBin::Bin/..");
19}
20
21####################################################################################################
22
23use Log qw(logAMessage
24 );
25
26use DBLib qw(databaseConnect
27 databaseDisconnect
28 );
29
30use HTML_Templates qw(replaceTagsInTemplate);
31
32####################################################################################################
33
34my $dbUserName = &Env::getVariable('DataBase','username');
35my $dbPassword = &Env::getVariable('DataBase','password');
36my $templatePath = Env::getVariable("Paths", "templates");
37
38my $query = new CGI;
39
40my %tagsToFill;
41my $nextPage;
42
43my $errors = qq();
44
45my $c; # cookie
46
47# extract from the query
48my $theUsername = $query->param("username");
49my $thePassword = $query->param("password");
50
51# errors
52if ( !defined($theUsername) || $theUsername eq qq())
53{
54 $errors .= qq(Username left blank.<br />);
55}
56if ( !defined($thePassword) || $thePassword eq qq())
57{
58 $errors .= qq(Password left blank.<br />);
59}
60
61# if no errors, check db
62if ( $errors eq qq() )
63{
64 my $dbh = &databaseConnect($dbUserName, $dbPassword, $dbUserName);
65
66 # check username
67 my $usernameSQL = qq(select count(*) from people where username = ?);
68 my $sth = $dbh->prepare($usernameSQL);
69 $sth->execute($theUsername);
70 my $usernameCount;
71 $sth->bind_columns(\$usernameCount);
72 $sth->fetch();
73 $sth->finish();
74
75 if ( $usernameCount < 1 )
76 {
77 $errors .= qq(Username/Password combination invalid. (username not found**)<br />);
78 }
79
80 # if there are still no errors (username exists)
81 if ( $errors eq qq() )
82 {
83 # grab hashed password from db
84 my $sql = qq(select password from people where username = ?);
85 my $sth2 = $dbh->prepare($sql);
86 $sth2->execute($theUsername);
87
88 my $vvPass; # create var to store hashed password
89 $sth2->bind_columns(\$vvPass); # insert into var
90 $sth2->fetch();
91 $sth2->finish();
92
93 # check password
94 if ($vvPass eq md5_hex($thePassword))
95 {
96 # check login table for blocked, then log them in (or not)
97 my $sqlBlocked = qq(select blocked from logins where username = ?);
98 my $sthBlocked = $dbh->prepare($sqlBlocked);
99 $sthBlocked->execute($theUsername); # replace question mark by this, which is sanitized
100
101 my $vvBlocked;
102 $sthBlocked->bind_columns(\$vvBlocked);
103 $sthBlocked->fetch();
104 $sthBlocked->finish();
105
106 if ($vvBlocked eq 1)
107 {
108 $errors .= qq(Account blocked, contact your administrator for further assistance.<br />);
109 }
110
111 }
112 else # else : unsuccessful password match
113 {
114 $errors .= qq(Username/Password combination invalid. (password doesnt match**)<br />);
115
116 # increment unsuccessful login count in db
117
118 my $sqlUnsuccess = qq(update logins set unsuccessful_logins = unsuccessful_logins+1 where username = ?);
119 my $sthUnsuccess = $dbh->prepare($sqlUnsuccess);
120 $sthUnsuccess->execute($theUsername);
121 $sthUnsuccess->finish();
122
123 # if that count reaches 5, disable account (block)
124 my $sqlAttempts = qq(select unsuccessful_logins from logins where username = ?);
125 my $sthAttempts = $dbh->prepare($sqlAttempts);
126 $sthAttempts->execute($theUsername);
127
128 my $vvAttempts;
129 $sthAttempts->bind_columns(\$vvAttempts);
130 $sthAttempts->fetch();
131 $sthAttempts->finish();
132
133 if ($vvAttempts > 4)
134 {
135 $errors .= qq(Max Attempts reached. Contact Administrator.<br />);
136
137 my $sqlAccBlocked = qq(update logins set blocked='t' where username = ?);
138 my $sthAccBlocked = $dbh->prepare($sqlAccBlocked);
139 $sthAccBlocked->execute($theUsername);
140 $sthAccBlocked->finish();
141 }
142
143 }
144
145 # if still no errors, log them in
146 if ( $errors eq qq() ) {
147
148 # select first name, last name, last login date
149 my $sqlFinal = qq(select first_name, last_name, last_login from people join logins on people.username = logins.username where people.username = ?);
150 my $sthFinal = $dbh->prepare($sqlFinal);
151 $sthFinal->execute($theUsername);
152
153 my ($vvFirst, $vvLast, $vvLastLogin);
154 $sthFinal->bind_columns(\$vvFirst,\$vvLast,\$vvLastLogin);
155 $sthFinal->fetch();
156 $sthFinal->finish();
157
158 # update logins table
159 my $sqlSuccess = qq(update logins set unsuccessful_logins = 0, successful_logins = successful_logins+1, last_login = CURRENT_TIMESTAMP(0) where username = ?);
160 my $sthSuccess = $dbh->prepare($sqlSuccess);
161 $sthSuccess->execute($theUsername);
162 $sthSuccess->finish();
163
164 if ($vvLastLogin eq qq())
165 {
166 $vvLastLogin = qq(never);
167 }
168
169 # prep data for template
170 $tagsToFill{"FIRSTNAME"} = ucfirst($vvFirst);
171 $tagsToFill{"LASTNAME"} = ucfirst($vvLast);
172 $tagsToFill{"LASTLOGIN"} = $vvLastLogin;
173
174 $nextPage = qq(loggedin.html);
175
176 $c = $query->cookie(-name => 'login',
177 -value => $theUsername,
178 -domain => 'linux-cs.johnabbott.qc.ca',
179 -path => '/',
180 -expires => '+60M');
181 }
182 }
183
184 $dbh->commit();
185 &databaseDisconnect($dbh);
186}
187
188
189if ( $errors ne qq() )
190{
191 $tagsToFill{"ERRORS"} = $errors;
192 $nextPage = qq(create_error.html);
193}
194
195logAMessage( qq(<<$errors>>) );
196
197my $thePage = replaceTagsInTemplate(qq($templatePath/$nextPage), \%tagsToFill);
198
199print $query->header(-cookie=>$c);
200print $thePage;