Help to code something in the CMS / Database

[UartigZone]

Hello,

Can someone help me code a IP whitelist for the client, so staffONLY can login from specific IP's?

So if the IP is in the database, you will get in, if not, you will be asked about one or two questions or a new code?

Can you help me? I think alot of people will have this and it will be good for even more security.

Thanks,
Mathias

[MentaL]

[Abidas]

Hey UartigZone.

I managed to get this working, Im pretty new to PHP, so this script can easily be improved I guess.

Add this to the top of every page, you want to affect (except for the logout page);

<?php 
$grabIPinfo = mysql_query("SELECT ip_last, ip_reg, rank FROM users WHERE id='". $_SESSION['user']['id'] ."'");
$getIPinfo = mysql_fetch_assoc($grabIPinfo);
if ($getIPinfo['rank'] > 6 && $getIPinfo['ip_last'] !== $getIPinfo['ip_reg']) {
?>Your IP doesn't have access to this staff user! - <a href="logout">Click here to log out</a>
<?php} else {?>

and at the bottom of the page add:

<?php } ?>

Med venlig hilsen Abidas,
(hvis du har brug for hjælp, så kan du jo skrive på Skype: abidas.pro)

[UartigZone]

Hey UartigZone.

I managed to get this working, Im pretty new to PHP, so this script can easily be improved I guess.

Add this to the top of every page, you want to affect (except for the logout page);

<?php 
$grabIPinfo = mysql_query("SELECT ip_last, ip_reg, rank FROM users WHERE id='". $_SESSION['user']['id'] ."'");
$getIPinfo = mysql_fetch_assoc($grabIPinfo);
if ($getIPinfo['rank'] > 6 && $getIPinfo['ip_last'] !== $getIPinfo['ip_reg']) {
?>Your IP doesn't have access to this staff user! - <a href="logout">Click here to log out</a>
<?php} else {?>

and at the bottom of the page add:

<?php } ?>

Med venlig hilsen Abidas,
(hvis du har brug for hjælp, så kan du jo skrive på Skype: abidas.pro)

Thanks! I have added your Skype :)

[UartigZone]

Well if you get the staff's IPs that shouldn't be a problem. But Abidas' script seems to solve this better Just make sure to search it thoroughly for exploits before deploying it onto your site publicly.

I can't get it to work with Staff Pin code so if the IP is right, you have to input your pin code (on the client page), and if not, you won't see it at all ?