()
| 11300 | if _too_many_attempts(ip, username): |
| 11301 | log_security_event("login_rate_limited", detail=f"user={username or '-'} ip={ip}", level="warning") |
| 11302 | flash("Too many attempts. Try again later.") |
| 11303 | return render_template("login.html", title=_("Login")) |
| 11304 | if _rate_limit_hit("login_post", ip, limit=20, window_sec=300): |
| 11305 | flash("Too many attempts. Try again later.") |
| 11306 | return render_template("login.html", title=_("Login")) |
| 11307 | |
| 11308 | conn = db_connect() |
| 11309 | row = conn.execute("SELECT pw_hash, is_admin, admin_device_id FROM users WHERE username=?", (username,)).fetchone() |
| 11310 | conn.close() |
| 11311 | if row and check_password_hash(row["pw_hash"], password): |
| 11312 | # Block admin login from any non-local link/device to prevent remote takeovers. |
| 11313 | try: |
| 11314 | is_admin = bool(int(row["is_admin"]) == 1) |
| 11315 | except Exception: |
| 11316 | is_admin = False |
| 11317 | if is_admin: |
| 11318 | bound = (row["admin_device_id"] or "").strip() |
| 11319 | if bound and bound != DEVICE_ID: |
| 11320 | _mark_fail(ip, username) |
nothing calls this directly
no test coverage detected