<br />
<b>Warning</b>:  session_start(): open(/var/lib/php/sessions/sess_bll4k26toqvjuhhqka74mgvd7p, O_RDWR) failed: No space left on device (28) in <b>/var/www/tb-usercake/models/config.php</b> on line <b>51</b><br />
<br />
<b>Warning</b>:  session_start(): Failed to read session data: files (path: /var/lib/php/sessions) in <b>/var/www/tb-usercake/models/config.php</b> on line <b>51</b><br />
!7

sclass IPInfo {
  S ip;
  Timestamp firstSeen, lastSeen, blockUntil;
  long passwordFails, passwordSuccesses;
  long blockedRequests;
  Bool allowed;
  
  bool isEvil() { ret blockUntil != null; }
}

cm SalterService > DynPrintLogAndEnabled {
  !include early #1029545 // API for Eleu
  
  switchable S password = aGlobalID();
  switchable int badPWBlockSeconds = 30;

  Map<S, IPInfo> ipsSeen = syncLinkedHashMap();
  
  start {  // to show warnings early
    canServe();
    for (IPInfo info : cloneValues(ipsSeen))
      print("Known client IP: " + info.ip
        + appendBracketed_comma(
          info.isEvil() ? "evil" : "good",
          n2(info.passwordSuccesses, "normal request"),
          n2UnlessZero(info.passwordFails, "password failures"),
          n2UnlessZero(info.passwordFails, "blocked requests")));
  }
  
  O html(IWebRequest req) ctex {
    if (!canServe()) ret "Can't serve";

    S ip = req.clientIP();
    IPInfo ipInfo = getOrCreate(ipsSeen, ip, () -> {
      print("New client IP!! " + ip);
      new IPInfo info;
      info.ip = ip;
      info.lastSeen = new Timestamp;
      if (info.firstSeen == null) info.firstSeen = info.lastSeen;
      change();
      ret info;
    });
    
    // Don't allow brute-force password checking
    
    if (ipInfo.blockUntil != null && cmp(ipInfo.blockUntil, new Timestamp) > 0) {
      print("Request from blocked IP: " + ip);
      ipInfo.blockedRequests++;
      change();
      ret print("Not allowed (evil IP)");
    }

    S uri = req.uri();
    print("Serving to IP " + ip + ": " + uri);
    
    if (isFalse(ipInfo.allowed))
      ret print("Not allowed (bad IP)");
      
    S suppliedPW = req.get("password");
    if (empty(suppliedPW)) ret "Need password";
    
    if (!eq(password, suppliedPW)) {
      ++ipInfo.passwordFails;
      change();
      print("Password FAIL from " + ip + " OK");
      if ((ipInfo.passwordFails % 10) == 0) {
        infoMessage(n2(ipInfo.passwordFails) + " password fails from " + ip + "!!!!");
        print("Blocking " + ip + " for " + badPWBlockSeconds + " seconds");
        ipInfo.blockUntil = new Timestamp(nowPlusSeconds(badPWBlockSeconds));
        change();
      }
      ret "Bad PW";
    }
    
    ++ipInfo.passwordSuccesses;
    change();
    print("Password from " + ip + " OK");

    ret subBot_serveJPEG(shootScreen2());
  }
  
  bool canServe() {
    if (l(password) < 4) ret false with warn("Not starting - password too short!!");
    true;
  }
}