Staff Pin System.

I recently made this for a hotel and they said I should release it here, it's nothing special, just basic PHP and HTML made for people who don't know how to do it for themselves.

Firstly, add this to your client .php below <div id="client"></div>

PHP Code:

---

        <?php                    $connect = mysql_connect("localhost", "root", "database_passwrd");            mysql_select_db("database_name", $connect);                            $username = $_SESSION["user"]["username"];            $query = mysql_query("SELECT * FROM `users` WHERE `username` = '$username'");            if(mysql_num_rows($query) == 1)            {
                $row = mysql_fetch_assoc($query);                $rank = $row["rank"];                if($rank >= 4 && !isset($_SESSION["correct_key"]))                {                                    ?>
                    <form action='spk' method='post'>                        <select name='first'>                            <option value='0'>0</option>                            <option value='1'>1</option>                            <option value='2'>2</option>                            <option value='3'>3</option>                            <option value='4'>4</option>                            <option value='5'>5</option>                            <option value='6'>6</option>                            <option value='7'>7</option>                            <option value='8'>8</option>                            <option value='9'>9</option>                        </select>                        <select name='second'>                            <option value='0'>0</option>                            <option value='1'>1</option>                            <option value='2'>2</option>                            <option value='3'>3</option>                            <option value='4'>4</option>                            <option value='5'>5</option>                            <option value='6'>6</option>                            <option value='7'>7</option>                            <option value='8'>8</option>                            <option value='9'>9</option>                        </select>                        <select name='third'>                            <option value='0'>0</option>                            <option value='1'>1</option>                            <option value='2'>2</option>                            <option value='3'>3</option>                            <option value='4'>4</option>                            <option value='5'>5</option>                            <option value='6'>6</option>                            <option value='7'>7</option>                            <option value='8'>8</option>                            <option value='9'>9</option>                        </select>                        <select name='fourth'>                            <option value='0'>0</option>                            <option value='1'>1</option>                            <option value='2'>2</option>                            <option value='3'>3</option>                            <option value='4'>4</option>                            <option value='5'>5</option>                            <option value='6'>6</option>                            <option value='7'>7</option>                            <option value='8'>8</option>                            <option value='9'>9</option>                        </select><br />                        <input type='submit' name='staff_key' value='Go' />                    </form>                                        <?php                    exit;                }                        }else            {                            die("Sorry, something went wrong with your account, apparently you do not exist, please try logging in.");                            }                ?>

---

This box will appear for anyone who is rank 4 or over.

Then create a new PHP file and name is spk.php

PHP Code:

---

<?php
    session_start();    $username = strip_tags(stripslashes(mysql_real_escape_string($_SESSION["user"]["username"])));        $connect = mysql_connect("localhost", "root", "database_passwrd");    mysql_select_db("database_name", $connect);        $first = strip_tags(stripslashes(mysql_real_escape_string($_POST["first"])));    $second = strip_tags(stripslashes(mysql_real_escape_string($_POST["second"])));    $third = strip_tags(stripslashes(mysql_real_escape_string($_POST["third"])));    $fourth = strip_tags(stripslashes(mysql_real_escape_string($_POST["fourth"])));    $key = $first."".$second."".$third."".$fourth;    if(is_numeric($key))    {            $query = mysql_query("SELECT * FROM `users` WHERE `username` = '$username'");        $row = mysql_fetch_assoc($query);        $valid_key = $row["staff_pin"];        if($key == $valid_key)        {                    session_start();            $_SESSION["correct_key"] = $key;                }else{                    die("Incorrect Key!");                }        }else    {            die("Key must be 4 numbers...");        }
?>

---

You will also need to create the field staff_pin in your users table, make it an integer of 4 and a default of 0, then it should work, if you have any problems feel free to PM me.

Note: Remember to replace database_passwrd with your database password and database_name with your database name.

This is also for RevCMS. It works great on my hotel. If you guys want working proof I will take screenshots!

Quote:

---

Originally Posted by iTzScronnie

This is also for RevCMS. It works great on my hotel. If you guys want working proof I will take screenshots!

---

It will work on any CMS if you know the session variables. (:

Lol why making a new connection ... Thats horrible for your mysql server lol.
And why a pin system :o .
Just make great passwords on all staff accounts and make your hotel CMS sql exploit free (and shit like the forgotten function).
But i think its a nice release but it isnt my thing and you are also not filtering the username.. So you need to hope that it is filtered before.
Also this is a to long reaction lol. But is it not more handyr to bind the user to a IP or more IP'S.
Gr Spot Ify

Edit also a tip dont use sql for it because if they mysql inject your hotel they can still get the pin why not just do it with a switch?

Quote:

---

Originally Posted by Spot Ify

Lol why making a new connection ... Thats horrible for your mysql server lol.
And why a pin system :o .
Just make great passwords on all staff accounts and make your hotel CMS sql exploit free (and shit like the forgotten function).
But i think its a nice release but it isnt my thing and you are also not filtering the username.. So you need to hope that it is filtered before.
Also this is a to long reaction lol. But is it not more handyr to bind the user to a IP or more IP'S.
Gr Spot Ify

---

I had originally filtered the username, but I didn't think it was necessary, and I made a new connection out of habit. I'll filter the usernames now and update the post.

Default password for script?

Quote:

---

Originally Posted by Spot Ify

Edit also a tip dont use sql for it because if they mysql inject your hotel they can still get the pin why not just do it with a switch?

---

By a switch I assume you mean a switch statement? If the hotel gets a new staff member you have to edit the code in that case, (Get it in that 'case' :P) I would check the IP's but if a staff member is using a proxy/VPN, or their IP changes it is not very helpful, it would be rare that something does happen to the IP but for example, if a staff member goes to someone elses house, they can no longer access the client due to an incorrect IP address. Thanks for the tips though, I am not super advanced in editing RevCMS so I am not 100% sure how it works, but I have been doing PHP for a few years now, so I understand what you're saying. Anyway, if anything does happen that causes me to rethink the methods of how the pin system works I will change it completely to be more efficient.

I tried to add default key 1000 at staff_pin and i typed 1000 in client it says wrong key..

Quote:

---

Originally Posted by GrateZ4

I tried to add default key 1000 at staff_pin and i typed 1000 in client it says wrong key..

---

Make sure it's in your users table, your database is connected properly, and that that is the correct key for the user.

well it's the correct key, and i did fix the db details, default 1000, db details fixed in spk & client

Quote:

---

Originally Posted by GrateZ4

well it's the correct key, and i did fix the db details, default 1000, db details fixed in spk & client

---

Do you have TeamViewer so I can connect to you to help you out?

I think i found the prob, i had int instead of integer :). no still doesnt work, i have join.me

Quote:

---

Originally Posted by Spot Ify

Lol why making a new connection ... Thats horrible for your mysql server lol.
And why a pin system :o .
Just make great passwords on all staff accounts and make your hotel CMS sql exploit free (and shit like the forgotten function).
But i think its a nice release but it isnt my thing and you are also not filtering the username.. So you need to hope that it is filtered before.
Also this is a to long reaction lol. But is it not more handyr to bind the user to a IP or more IP'S.
Gr Spot Ify

Edit also a tip dont use sql for it because if they mysql inject your hotel they can still get the pin why not just do it with a switch?

---

Does the username actually have to been filtered, since it's a session?
As I understand it, sessions are handled by the server and unchangeable by the user.

Quote:

---

Originally Posted by Matata

Does the username actually have to been filtered, since it's a session?
As I understand it, sessions are handled by the server and unchangeable by the user.

---

If a user manages to register with something like '; DROP TABLE users; I guess it could cause problems, it's best to be on the safe side.

Quote:

---

Originally Posted by VOID3D

If a user manages to register with something like '; DROP TABLE users; I guess it could cause problems, it's best to be on the safe side.

---

If a user is able to register with such name, you have some serious security problems.

Quote:

---

Originally Posted by Matata

If a user is able to register with such name, you have some serious security problems.

---

Well done, that made me laugh pretty hard, idek why x'D

And other... I'll pick from database, will help?
To make more secure, don't make an new connection with MySQL and the PIN CODE must be on archive, and the system with $_SESSION...
My Hotel have this, and is secure, i have sure.

I think the Staff IP list is much better. You make a table with username and ip and when a user try to acces the remote_addr and session username must be the same as the database records in the table. Or you can make that you only can acces staff accounts from a specified network.

Quote:

---

Originally Posted by streamhotel

I think the Staff IP list is much better. You make a table with username and ip and when a user try to acces the remote_addr and session username must be the same as the database records in the table. Or you can make that you only can acces staff accounts from a specified network.

---

Terrible to Dynamic IP.. I guess?

Stop using the MySQL extension. Bad bad bad.

Quote:

---

Originally Posted by Nathan

Stop using the MySQL extension. Bad bad bad.

---

You are right, it's deprecated but at east tell him what to use instead. Tell him to replace the mysql with mysqli which stands for MySQL improved.

Just use this solution, so much better and you only need to add this into one file. No database requirements etc.

PHP Code:

---

<?php
 
$mod_pw = 'passwordhere';
 
if (isset($_SESSION['user']))
{
    $sql = mysql_query("SELECT rank FROM users WHERE id = ".intval($_SESSION['user']['id']));
    $r = mysql_fetch_assoc($sql);
 
    if (@$r['rank'] >= 8 && (!isset($_POST['mod_pw']) || $_POST['mod_pw'] != $mod_pw))
    {
        echo '<form method="post" action="">
    <p>MOD Password.

<br><br>    <input type="password" name="mod_pw" value="" /></p>
    <p><input type="submit" value="Log in" /></p>
</form>';
 
        die;
    }
}
?>

---

This will require a extra password from everyone over rank 8. You can change both password and rank in the script. Works with RevCMS.

Not bad idea, I am personally more in favor of using either Mysqli or PDO, you could adapt it to allow extra security on paid membership accounts as part of the package allow them to set a personal pin number to access the accounts. Great start though

Quote:

---

Originally Posted by Exonize

Just use this solution, so much better and you only need to add this into one file. No database requirements etc.
This will require a extra password from everyone over rank 8. You can change both password and rank in the script. Works with RevCMS.

---

Exactly what I said... Use only the MySQL to pick the rank, more secure in my opinion...

I personally would do key via database instead of same key for every staff member.

Code:

---

<?php
if (isset($_SESSION['user']))
{
    $sql = mysql_query("SELECT * FROM users WHERE id = ".intval($_SESSION['user']['id']));
    $r = mysql_fetch_assoc($sql);
 
    if (@$r['rank'] >= 8 && (!isset($_POST['mod_pw']) || $_POST['mod_pw'] == md5($r['pin'])))
    {  ?>
                <style>
                        body{
                                background-image:url('<?php echo $_CONFIG['hotel']['url']; ?>/app/tpl/skins/Habbo/images/bg.png');
                        }
                       
                        input[type='password']{
                                border-radius:3px;
                                border:1px solid lightgrey;
                                height:25px;
                                text-align:center;
                        }
                       
                        input[type='submit']{
                                border-radius:3px;
                                border:1px solid lightgrey;
                                background-color:#fff;
                                height:25px;
                                width:100px;
                                font-weight:700;
                                margin-top:5px;
                        }
                       
                        input[type='submit']:hover{
                                background-color:lightgrey;
                        }
                </style>
        <form method="post" align = "center">
                                  <p>Pin Information<br></p><br>
                                  <input type="password" name="mod_pw" placeholder = "Your client pin!"><br>
                                  <input type="submit" value="Enter Pin">
                </form>
<?php
        die;
    }
}
?>

---

PS - Key is encrypted with md5 use a MD5 encrypter to create the key
http://www.miraclesalad.com/webtools/md5.php

Tested it should work I just used the one @Exonize posted and got it selecting keys via database.

SQL

Code:

---

ALTER TABLE `users` ADD `pin` VARCHAR(255)

---

Woops tapatalk bug.

But why not making a dicyonary (array in php dicyonary in .net xd) with the usernames of all staffs so you dont have any mysql query??

Dont get why peaple use so much querys i have there in my cms recache staffpage, recache news, login ,register, bancheck client,bancheck login, auth ticket

The recach of the news is manually and staffpage recach can only ve done one time in the 45 minuts (only when someone enters the page)

So why not a dictonairy?
That is much much better stop using mysql for evrything lol. Yeahh and then crying as mysql is using much memory lol.

Hhh just cache shit :p
I give tomorrow a simple sample

@Lewislol All staff don't have the same key if you are referring to the original thread, you just have to change it for each user.

I don't realy get the point for this feature.

Quote:

---

Originally Posted by Mextur

I don't realy get the point for this feature.

---

It's just extra security, so if a staff account gets hacked, they also have to know the staff members pin.

Don't like the way you coded this, what's the point of connecting to mysql when the CMS already does that?

if you're using RevCMS, you should use $a = $engine->query("");
etc..

It is a failing matter why do you need spk.php

Quote:

---

Originally Posted by RichBro123

It is a failing matter why do you need spk.php

---

It's just to process the users input, so it is safer than putting it all in the client.

First here is my response...
Why are you reconnecting to the database? When using a CMS, it's normally connected itself, so you don't need to connect it.
Re-connecting would have to kill the current database session = which would take longer for a reply.
------
You should always filter your $_POST / $_GET variables, because that's just for extra security, specially if you're releasing it on RaGEZONE or another forum (to public). You could have made this better.

Quote:

---

Originally Posted by AliDABOSS

First here is my response...
Why are you reconnecting to the database? When using a CMS, it's normally connected itself, so you don't need to connect it.
Re-connecting would have to kill the current database session = which would take longer for a reply.
------
You should always filter your $_POST / $_GET variables, because that's just for extra security, specially if you're releasing it on RaGEZONE or another forum (to public). You could have made this better.

---

The data is filtered, like this, strip_tags(stripslashes(mysql_real_escape_string($_POST["first"])));

I'm developing one for a private cms: 4 letter PIN for Client/6 letter PIN for Housekeeping.
Anyway, nice release!

Why does it ban my Proxy IP everytime i use this? Gold Tree Emulator ban the IP from Anti-DDoS.... And its not enable in server settings?

Quote:

---

Originally Posted by UartigZone

Why does it ban my Proxy IP everytime i use this? Gold Tree Emulator ban the IP from Anti-DDoS.... And its not enable in server settings?

---

I just tested it on my Phoenix Emulator and ''GTE''

It works for both for me, so you maked a mistake.

Quote:

---

Originally Posted by Nicolajhansen97

I just tested it on my Phoenix Emulator and ''GTE''

It works for both for me, so you maked a mistake.

---

Yeah. Can you please upload your Staff Pin, if you have it? If you want, so i can see the mistake.