Free Limit Windows Application Login to Specific IPs

[craigbrass]

Open /winapp/index.php and right after the copyright information, add the following :-

$listofauthorizedips = array('222.222.222.222','222.222.222.222');
if (!in_array($_SERVER['REMOTE_ADDR'], $listofauthorizedips)) {
	die('You are not authorized to use the windows application.');
}

Simply replace the IPs with the ones you wish to authorize.

[jnet]

thanks I will try that

[Siora]

How does this mod work regarding agents connected to a router or those that don't know the main IP address, they only know their local IP address.

[John Haugeland]

It would be far more appropriate to implement something like this in a .htaccess rule, which will correctly handle resolving rDNS, alternate network identity encodings, alternate IP address encodings and so forth, rather than to alter the application.

We do not recommend this modification.

[John Haugeland]

Ryan says I should clarify why I'm asking customers to do things in a different way than the application does.

1) We can't put stuff in .htaccess for several reasons. First off, some webservers don't support .htaccess, or have it turned off, or limit how it can be used, or etc. We also can't be certain that any given webserver is using them, and it's not really acceptable for our code to make security assumptions about driving webservers. End users know what webserver they're using and how it's configured, and as such do not have this limitation.

2) We don't want people modding their desks if it's not necessary, especially for security stuff, for several reasons. Besides that we can't check the work, it also means that every time the desk is updated, the change goes away. Especially for security related topics, things should not need to be remembered.

3) It's a lot easier for an end user to check if .htaccess is correct.

4) .htaccess will be a lot faster.

Craig's fix is generally correct, but users can't do the same things that staff do, particularly because upgrading wipes out changes you make that aren't in the main tree.

We continue to recommend a .htaccess driven solution.

[GoneShootin]

John

Do you have an example htaccess file that can be used as a base to implement such a task? I raised a similar question here and was pointed to this thread.

[craigbrass]

htaccess way is as follows.

Order Deny,Allow
Deny From All
Allow From 1.2.3.4
Allow From 1.2.3.4

Add additional lines for additional IPs.

[John Haugeland]

Craig posted a correct answer, but it looks like vBulletin may have mangled it slightly.

Here's a manpage.

[GoneShootin]

Thanks craig et al.

[craigbrass]

Your welcome. Glad I could be of help.