<%@ Page Language="VB" MasterPageFile="~/Anonymous.master"
AutoEventWireup="false"
CodeFile="Login.aspx.vb"
Inherits="_Default"
EnableEventValidation="true"
title="Untitled Page" %>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.SqlClient" %>
<%@ Import Namespace="System.Threading" %>
<asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">
<script runat="server">
Dim conMyData As SqlConnection
Dim conUserData As SqlConnection
Dim cmdSelect As SqlCommand
Dim cmdSelectRoles As SqlCommand
Dim parmReturnValue As SqlParameter
Dim intResult As Integer
Dim strLinkPath As String
Dim objTicket As FormsAuthenticationTicket
Dim objCookie As HttpCookie
Dim strReturnURL As String
Sub Button_Click(ByVal a As Object, ByVal e As EventArgs)
If IsValid Then
'load stored procedure DBAuthenticate
If DBAuthenticate(txtUsername.Text, txtPassword.Text) > 0 Then
'run query to get user role for forms based authentication
Dim conRoles As SqlConnection
Dim cmdSelectRoles As SqlCommand
Dim dtrRoles As String
conRoles = New SqlConnection("Server=INTRANET;uid=sa;database=safety_training")
conRoles.Open()
cmdSelectRoles = New SqlCommand("SELECT r.role_name FROM dbo.Roles r WHERE r.role_id IN (SELECT ui.role_id FROM dbo.User_Info ui WHERE ui.user_name=@username AND ui.password=@password)", conRoles)
cmdSelectRoles.Parameters.AddWithValue("@username", txtUsername.Text)
cmdSelectRoles.Parameters.AddWithValue("@password", txtPassword.Text)
dtrRoles = cmdSelectRoles.ExecuteScalar
'run query to get users company
Dim conCompany As SqlConnection
Dim cmdSelectCompany As SqlCommand
Dim dtrCompany As String
conCompany = New SqlConnection("Server=INTRANET;uid=sa;database=safety_training")
conCompany.Open()
cmdSelectCompany = New SqlCommand("SELECT ui.company_id FROM dbo.User_Info ui WHERE ui.user_name=@username", conCompany)
cmdSelectCompany.Parameters.AddWithValue("@username", txtUsername.Text)
dtrCompany = cmdSelectCompany.ExecuteScalar
'create authentication ticket
objTicket = New FormsAuthenticationTicket(2, txtUsername.Text, DateTime.Now, DateTime.Now.AddMinutes(30), False, dtrRoles)
conRoles.Close()
conCompany.Close()
'create cookie Company
Response.Cookies("Company").Value = dtrCompany
'create cookie UserName
Response.Cookies("UserName").Value = txtUsername.Text
objCookie = New HttpCookie(".ASPXAUTH")
objCookie.Value = FormsAuthentication.Encrypt(objTicket)
Response.Cookies.Add(objCookie)
strReturnURL = Request.Params("ReturnURL")
If strReturnURL <> Nothing Then
'returns user to previous page if greater authorization was required
Response.Redirect(strReturnURL)
Else
'forwards user after login
Response.Redirect("Default.aspx")
End If
End If
End If
End Sub
'check failed login attempt count and if greater than 3 pauses for 2 hours
Sub Page_Load()
Dim objCounter As Object = Session("counter")
If Session("counter") > 3 Then
Thread.Sleep(7200000)
Response.Redirect("anonymous/deny.aspx")
End If
End Sub
'stored procedure, returns 1 if successful login, -1 it not
Function DBAuthenticate(ByVal strUsername As String, ByVal strPassword As String) As Integer
conMyData = New SqlConnection("Server=INTRANET;UID=sa;Database=safety_training")
cmdSelect = New SqlCommand("DBAuthenticate", conMyData)
cmdSelect.CommandType = CommandType.StoredProcedure
parmReturnValue = cmdSelect.Parameters.Add("RETURN_VALUE", SqlDbType.Int)
parmReturnValue.Direction = ParameterDirection.ReturnValue
cmdSelect.Parameters.AddWithValue("@Username", strUsername)
cmdSelect.Parameters.AddWithValue("@Password", strPassword)
conMyData.Open()
cmdSelect.ExecuteNonQuery()
intResult = cmdSelect.Parameters("RETURN_VALUE").Value
conMyData.Close()
'if unsuccessful login display message and increase failed attempt count by 1 then
'pauses for 10, then 20, then 30 seconds if user keeps failign
If intResult = -1 Then
lblMessage.Text = "Your Username or Password is incorrect. Please try again."
Dim objCounter As Object = Session("counter")
If objCounter Is Nothing Then objCounter = 0
Session("counter") = CInt(objCounter) + 1
Thread.Sleep(10000 * (CInt(objCounter)))
End If
Return intResult
End Function
</script>
<form id="Form1" action="Login.aspx" >
<table style="width: 41%; border-right: #b5c7de 1px solid; border-top: #b5c7de 1px solid; border-left: #b5c7de 1px solid; border-bottom: #b5c7de 1px solid; height: 1px;">
<tr align="center" valign="top">
<td bgcolor="#eff3fb" style="text-align: center; width: 843px; height: 175px;">
<table>
<tr>
<td colspan="2"
style="text-align: center">
<strong><span style="font-weight: bold;
color: black;
background-color: transparent; font-family: Verdana;">Log In</span></strong></td>
</tr>
<tr align="center">
<td colspan="2">
<asp:Label
ID="lblMessage"
ForeColor="Red"
Runat="server" /></td>
</tr>
<tr valign="top">
<td style="width: 85px">
<asp:Label ID="UserNameLabel"
runat="server" Font-Names="Verdana" Font-Size="0.8em">User Name:</asp:Label>
</td>
<td style="width: 173px">
<asp:TextBox ID="txtUsername"
runat="server"
Width="160px" TabIndex="1" /><br />
<asp:RequiredFieldValidator ID="RequiredFieldValidator1"
runat="server"
ControlToValidate="txtUsername"
Text="You must enter a User Name." Width="186px" EnableViewState="False" Font-Names="Verdana" Font-Size="0.7em" /></td>
</tr>
<tr valign="top">
<td style="width: 85px">
<asp:Label ID="PasswordLabel"
runat="server" Font-Names="Verdana" Font-Size="0.8em">Password:</asp:Label>
</td>
<td style="width: 173px">
<asp:TextBox ID="txtPassword"
runat="server"
TextMode="Password"
Width="160px" TabIndex="2" /><br />
<asp:RequiredFieldValidator ID="RequiredFieldValidator2"
runat="server"
ControlToValidate="txtPassword"
Text="You must enter a Password." Width="235px" EnableViewState="False" Font-Names="Verdana" Font-Size="0.7em" /></td>
</tr>
<tr align="center">
<td colspan="2" style="height: 32px; text-align: right">
<asp:Button ID="Button1"
runat="server"
BackColor="White"
BorderColor="#507CD1"
BorderStyle="Solid"
BorderWidth="1px"
OnClick="Button_Click"
Font-Names="Verdana"
Font-Size="0.8em"
ForeColor="#284E98"
Text="Log In" TabIndex="3" /></td>
</tr>
</table>
<span style="font-size: 0.8em; color: red"></span></td>
</tr>
</table>
</form>
</asp:Content>