3 files changed, 70 insertions, 2 deletions

diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index f7d4f7e8..e112f127 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -22,7 +22,10 @@ class auth_Core {
     $form = new Forge($url, "", "post", array("id" => "g-login-form"));
     $form->set_attr('class', "g-narrow");
     $group = $form->group("login")->label(t("Login"));
-    $group->input("name")->label(t("Username"))->id("g-username")->class(null);
+    $group->input("name")->label(t("Username"))->id("g-username")->class(null)
+      ->callback("auth::validate_too_many_failed_logins")
+      ->error_messages(
+        "too_many_failed_logins", t("Too many failed login attempts.  Try again later"));
     $group->password("password")->label(t("Password"))->id("g-password")->class(null);
     $group->inputs["name"]->error_messages("invalid_login", t("Invalid name or password"));
     $group->submit("")->value(t("Login"));
@@ -55,4 +58,44 @@ class auth_Core {
                 array("url" => user_profile::url($user->id),
                       "user_name" => html::clean($user->name))));
   }
+
+  /**
+   * After there have been 5 failed login attempts, any failure leads to getting locked out for a
+   * minute.
+   */
+  static function validate_too_many_failed_logins($name_input) {
+    $failed_login = ORM::factory("failed_login")
+      ->where("name", "=", $name_input->value)
+      ->find();
+    if ($failed_login->loaded() &&
+        $failed_login->count > 5 &&
+        (time() - $failed_login->time < 60)) {
+      $name_input->add_error("too_many_failed_logins", 1);
+    }
+  }
+
+  /**
+   * Record a failed login for this user
+   */
+  static function record_failed_login($name) {
+    $failed_login = ORM::factory("failed_login")
+      ->where("name", "=", $name)
+      ->find();
+    if (!$failed_login->loaded()) {
+      $failed_login->name = $name;
+    }
+    $failed_login->time = time();
+    $failed_login->count++;
+    $failed_login->save();
+  }
+
+  /**
+   * Clear any failed logins for this user
+   */
+  static function record_successful_login($user) {
+    db::build()
+      ->delete("failed_logins")
+      ->where("name", "=", $user->name)
+      ->execute();
+  }
 }
\ No newline at end of file
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 80452276..6479e2c3 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -110,6 +110,11 @@ class gallery_event_Core {
       graphics::choose_default_toolkit();
       module::clear_var("gallery", "choose_default_tookit");
     }
+    auth::record_successful_login($user);
+  }
+
+  static function user_login_failed($name) {
+    auth::record_failed_login($name);
   }
 
   static function item_index_data($item, $data) {
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index d2378d64..cf701ed4 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -42,6 +42,14 @@ class gallery_installer {
                 KEY (`tags`))
                 DEFAULT CHARSET=utf8;");
 
+    $db->query("CREATE TABLE {failed_logins} (
+                `id` int(9) NOT NULL auto_increment,
+                `count` int(9) NOT NULL,
+                `name` varchar(255) NOT NULL,
+                `time` int(9) NOT NULL,
+                PRIMARY KEY (`id`))
+                DEFAULT CHARSET=utf8;");
+
     $db->query("CREATE TABLE {graphics_rules} (
                  `id` int(9) NOT NULL auto_increment,
                  `active` BOOLEAN default 0,
@@ -276,7 +284,7 @@ class gallery_installer {
     // @todo this string needs to be picked up by l10n_scanner
     module::set_var("gallery", "credits", "Powered by <a href=\"%url\">Gallery %version</a>");
     module::set_var("gallery", "simultaneous_upload_limit", 5);
-    module::set_version("gallery", 22);
+    module::set_version("gallery", 23);
   }
 
   static function upgrade($version) {
@@ -485,6 +493,17 @@ class gallery_installer {
       }
       module::set_version("gallery", $version = 23);
     }
+
+    if ($version = 23) {
+      $db->query("CREATE TABLE {failed_logins} (
+                  `id` int(9) NOT NULL auto_increment,
+                  `count` int(9) NOT NULL,
+                  `name` varchar(255) NOT NULL,
+                  `time` int(9) NOT NULL,
+                  PRIMARY KEY (`id`))
+                  DEFAULT CHARSET=utf8;");
+      module::set_version("gallery", $version = 24);
+    }
   }
 
   static function uninstall() {
@@ -493,6 +512,7 @@ class gallery_installer {
     $db->query("DROP TABLE IF EXISTS {access_intents}");
     $db->query("DROP TABLE IF EXISTS {graphics_rules}");
     $db->query("DROP TABLE IF EXISTS {incoming_translations}");
+    $db->query("DROP TABLE IF EXISTS {failed_logins}");
     $db->query("DROP TABLE IF EXISTS {items}");
     $db->query("DROP TABLE IF EXISTS {logs}");
     $db->query("DROP TABLE IF EXISTS {modules}");