note 107277 added to function.sleep
| From: | cyril dot garsaud at gmail dot com | Date: | Thu, 26 Jan 2012 20:31:04 +0000 |
| Subject: | note 107277 added to function.sleep | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-185758@lists.php.net to get a copy of this message | ||
@Barlow: Nope, the attacker could still send a big ammount of POST requests and one of them may
work. What we need to do is slow down his session until he succeeds.
<?php
session_start();
if(isset($_SESSION['failed']))
sleep(2);
public function handle_login() {
if($uid = user::check_password($_REQUEST['email'], $_REQUEST['password'])) {
session_destroy();
return self::authenticate_user($uid);
}
else {
$_SESSION['failed'] = 1;
return self::login_failed();
}
}
?>
----
Server IP: 69.147.83.197
Probable Submitter: 82.236.228.36
----
Manual Page -- http://www.php.net/manual/en/function.sleep.php
Edit -- https://master.php.net/note/edit/107277
Del: integrated -- https://master.php.net/note/delete/107277/integrated
Del: useless -- https://master.php.net/note/delete/107277/useless
Del: bad code -- https://master.php.net/note/delete/107277/bad+code
Del: spam -- https://master.php.net/note/delete/107277/spam
Del: non-english -- https://master.php.net/note/delete/107277/non-english
Del: in docs -- https://master.php.net/note/delete/107277/in+docs
Del: other reasons-- https://master.php.net/note/delete/107277
Reject -- https://master.php.net/note/reject/107277
Search -- https://master.php.net/manage/user-notes.php