I check the login before sending it to the Chilli to login.
public function get_user_password($username)
{
$stmt = $this->mysqli->prepare("SELECT value FROM radcheck WHERE username = ? AND attribute = 'Cleartext-Password'");
$stmt->bind_param('s', $username);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows() == 0)
$return = NULL;
else
{
$stmt->bind_result($password);
$stmt->fetch();
$return = $password;
}
$stmt->free_result();
$stmt->close();
return $return;
}...
function chilli_login()
{
if (!empty($_GET['challenge']))
$challenge = $_GET['challenge'];
elseif (!empty($_SESSION['chilli']['challenge']))
$challenge = $_SESSION['chilli']['challenge'];
if (empty($challenge) || empty($_POST['username']) || empty($_POST['password']))
error('CHILLI_LOGIN_FAILED');
$_SESSION['login'] = $_POST;
$uamsecret = 'zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz';
$hexchal = pack("H32", $challenge);
$newchal = pack("H*", md5($hexchal . $uamsecret));
$response = md5("\0" . $_POST['password'] . $newchal);
$query = http_build_query(array(
'username' => $_POST['username'],
'response' => $response,
// 'userurl' => $_GET['userurl']
), '', '&', PHP_QUERY_RFC3986);
header("Location: http://10.1.0.1:3990/login?" . $query);
die();
}...
if (isset($_GET['login']))
{
if (!$db_radius->user_exists($_POST['username']))
$errors[] = 'Name does not exist.';
if ($_POST['password'] != $db_radius->get_user_password($_POST['username']))
$errors[] = 'Password incorrect.';
if (empty($errors))
{
chilli_login();
}
}
if (!empty($_GET['res']))
{
switch ($_GET['res'])
{
case 'failed':
if (isset($_GET['reply']))
if ($_GET['reply'] == 'Your maximum daily usage time has been reached' ||
$_GET['reply'] == 'Your maximum weekly usage time has been reached' ||
$_GET['reply'] == 'Your maximum monthly usage time has been reached')
{
$bandwidth = $db_radius->get_user_bandwidth($_SESSION['login']['username']);
$bandwidth_types = array('all-time', 'daily', 'weekly', 'monthly');
$errors[] = "You have used your " . format_bytes($bandwidth['limit']['bytes'], 2) . " of {$bandwidth_types[$bandwidth['limit']['type']]} bandwidth!";
$remaining_time = ($bandwidth['remaining']['time'] > 0 ? duration($bandwidth['remaining']['time']) : '∞');
$errors[] = "Your bandwidth resets in: {$remaining_time}.";
}
elseif ($_GET['reply'] == 'Your maximum never usage time has been reached')
{
$errors[] = "You have used all your bandwidth.";
$errors[] = "You need to buy more to use the Internet.";
}
else
$errors[] = $_GET['reply'];
else
$errors[] = "Username and/or password rejected.";
}
}