Limit failed logins.

At most 5 per username and address, 20 per address and 50 per username
in 15 minutes.

publish/login.php

@@ -5,6 +5,7 @@ if ( ! isset($_SERVER['HTTPS'])) {
 }
 require_once("../session.lib.php");
 $denied = NULL;
+$wait_minutes = 0;
 $is_admin = NULL;
 if (isset($_SESSION['editor'])) {
   session_write_close();
@@ -12,6 +13,9 @@ if (isset($_SESSION['editor'])) {
   return;
 } else if (isset($_POST['login']) && !csrf_valid()) {
   $denied = TRUE;
+} else if (isset($_POST['login']) && ($wait = login_blocked_for((string)($_POST['username'] ?? ''))) > 0) {
+  $denied = TRUE;
+  $wait_minutes = (int)ceil($wait / 60);
 } else if (isset($_POST['login'])) {
   include_once('../open_db.lib.php');
   $table = "editors";
@@ -31,12 +35,14 @@ if (isset($_SESSION['editor'])) {
   // password_verify() also accepts hashes made by the old crypt() call
   if (!password_verify($compare_password, $stored_password)) {
     $denied = TRUE;
+    record_login_failure($username);
     open_db('close');
   } else {
     // Move an old hash to the current algorithm while we have the password
     rehash_password($username, $compare_password, $stored_password);
     open_db('close');
     login_editor($username);
+    clear_login_failures($username);
     // Keep user logged in with cookie, if they request it
     if (isset($_POST['remember'])) {
       create_persistent_login($username);
@@ -81,7 +87,9 @@ if (isset($_SESSION['editor'])) {
 <H1>editor login</H1>
 
 <?php 
-if ($denied) 
+if ($wait_minutes)
+  echo "<p><strong>Too many failed logins. Please try again in $wait_minutes minute".($wait_minutes == 1 ? "" : "s").".</strong></p>\n";
+else if ($denied) 
   echo "<p><strong>Access denied. Please try again.</strong></p>\n";
 ?>