User IP Restriction and Allowed IP Address

697 Posts

jusmeig Reply #1, 16 years, 2 months ago

Hi there,

Have a requirement to only allow web users to login from a set IP address.
I see in the User tab there is and Allowed IP Address field where you enter in a list of IP’s.

Having done that it still lets me login to the site using webloginPE from any IP address?
Is this field actually used anymore? And if so does anyone know how to enforce the IP restriction?

Thanks in advance,

Justin

Using Evo btw

697 Posts

jusmeig Reply #2, 16 years, 2 months ago

Just ended up writing a snippet to do it myself.

if($modx->getLoginUserID())
{
	$id = $modx->getLoginUserID();
	$res = $modx->db->select("*", "modx_web_user_settings", "webuser = '".$id."'");
	if($modx->db->getRecordCount($res))
	{
		while($row = $modx->db->getRow($res)) 
		{
			if ($row['setting_name'] == 'allowed_ip')
			{
				$ip = $row['setting_value'];
			}
			
		}
	}
}

if($_SERVER['REMOTE_ADDR'] != $ip)
{
    echo 'Blah blah IP's dont match!';
}

☆ A M B ☆
2,475 Posts

Everett Reply #3, 16 years, 2 months ago

IPs can be spoofed... so it’s not fail-safe. You can also do this same type of filtering from within your .htaccess file, but for more secure solutions and more thorough analysis, you’d have to configure your webserver for that kind of work, and even then, it’s not a sure thing. You’d need a secondary validation (e.g. a password).

Hosting stuff: http://fireproofsocks.com/
Coding stuff: http://craftsmancoding.com/
Blog stuff: http://tipsfor.us/

24,544 Posts

BobRay Reply #4, 16 years, 2 months ago

It’s not quite the same thing, but SPForm bans users by IP, partial IP, domain, or email address and (IIRC) allows wildcards. You might find the code helpful.

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

697 Posts

jusmeig Reply #5, 16 years, 2 months ago

Thanks for the replies guys.
I’m aware of the IP Problem.

First line of defense for me would be a .htaccess username and password on the root?
As this is at the connection level they will need the username/password to get any further!