0) { $denied = TRUE; $wait_minutes = (int)ceil($wait / 60); } else if (isset($_POST['login'])) { include_once('../open_db.lib.php'); $table = "editors"; open_db('open'); $username = (string)($_POST['username'] ?? ''); $query = "SELECT * FROM $table WHERE username = ? LIMIT 1"; $getid = $db->execute_query($query, array($username)) or die("Query failed: ".$db->error); $row = $getid->fetch_assoc(); $stored_password = ''; if (isset($row)) $stored_password = $row['password']; else $denied = TRUE; $getid->close(); $compare_password = is_string($_POST['password'] ?? NULL) ? $_POST['password'] : ''; // password_verify() also accepts hashes made by the old crypt() call if (!password_verify($compare_password, $stored_password)) { $denied = TRUE; record_login_failure($username); open_db('close'); } else { // Move an old hash to the current algorithm while we have the password rehash_password($username, $compare_password, $stored_password); open_db('close'); login_editor($username); clear_login_failures($username); // Keep user logged in with cookie, if they request it if (isset($_POST['remember'])) { create_persistent_login($username); } if (isset($_SESSION['referrer'])) { $url = $_SERVER['HTTPS'] ? "https://" : "http://"; $url .= $_SERVER['HTTP_HOST']; $url .= $_SESSION['referrer']; unset($_SESSION['referrer']); session_write_close(); header("Location: $url"); return; } else { session_write_close(); header("Location: https://xxx.org.za/publish/edit"); return; } } } ?> x.x.x [login]

editor login

Too many failed logins. Please try again in $wait_minutes minute".($wait_minutes == 1 ? "" : "s").".

\n"; else if ($denied) echo "

Access denied. Please try again.

\n"; ?>