[Avesta] Login Attempt won't work

[loppe]

Hello everyone.
I have problem with latest avesta.
Login limit won't work :/ I can try to login as many times I want.

	if(!(accnumber != 0 && account.accnumber == accnumber &&
			passwordTest(password, account.password))){

		g_bans.addLoginAttempt(clientip, false);
		disconnectClient(0x0A, "Please enter a valid account number and password.");
		return false;
	}

it's:

g_bans.addLoginAttempt(clientip, false);

void BanManager::addLoginAttempt(uint32_t clientip, bool isSuccess)
{
      if(clientip != 0){
            banLock.lock();
 
            uint32_t currentTime = std::time(NULL);
 
            IpLoginMap::iterator it = ipLoginMap.find(clientip);
            if(it == ipLoginMap.end()){
                  LoginBlock lb;
                  lb.lastLoginTime = 0;
                  lb.numberOfLogins = 0;
 
                  ipLoginMap[clientip] = lb;
                  it = ipLoginMap.find(clientip);
            }
 
            if(it->second.numberOfLogins >= maxLoginTries){
                  it->second.numberOfLogins = 0;
            }
 
            if(!isSuccess || (currentTime < it->second.lastLoginTime + retryTimeout)){
                  ++it->second.numberOfLogins;
            }
            else{
                  it->second.numberOfLogins = 0;
            }
 
            it->second.lastLoginTime = currentTime;
 
            banLock.unlock();
      }
}

After ~10 wrong login it should display:

	if(g_bans.isIpDisabled(clientip)){
		disconnectClient(0x0A, "Too many connections attempts from this IP. Try again later.");
		return false;
	}

bool BanManager::isIpDisabled(uint32_t clientip) const
{
      if(maxLoginTries == 0)
            return false;
 
      if(clientip != 0){
            banLock.lock();
 
            uint32_t currentTime = std::time(NULL);
            IpLoginMap::const_iterator it = ipLoginMap.find(clientip);
            if(it != ipLoginMap.end()){
                  if( (it->second.numberOfLogins >= maxLoginTries) &&
                        (currentTime < it->second.lastLoginTime + loginTimeout) )
                  {
                        banLock.unlock();
                        return true;
                  }
            }
 
            banLock.unlock();
      }
 
      return false;
}

Anyone know how to fix that?

 

[Summ]

What happens if you remove this:
if(it->second.numberOfLogins >= maxLoginTries){
it->second.numberOfLogins = 0;
}

 

[loppe]

What happens if you remove this:
if(it->second.numberOfLogins >= maxLoginTries){
it->second.numberOfLogins = 0;
}

Nothing, same problem.
latest tfs:

	if(it->second.loginsAmount > g_config.getNumber(ConfigManager::LOGIN_TRIES))
		it->second.loginsAmount = 0;

 

[Ferrus]

Looks like the problem appears because loadSettings() is not called, and so maxLoginTries, retryTimeout and loginTimeout aren't initialized with values from the config file, but 0 instead. To fix it, you'd need to replace all these three variables with direct calls to their config values.

So, each maxLoginTries should be replaced with g_config.getNumber(ConfigManager::LOGIN_TRIES) along with the other two variables replaced analogously.