From 852f236bb5c34d173177e20bd2f083d8bc0d3b19 Mon Sep 17 00:00:00 2001
From: midoks <midoks@163.com>
Date: Tue, 1 Nov 2022 11:47:13 +0800
Subject: [PATCH] =?UTF-8?q?=E4=B8=BA=E4=BA=86=E4=B8=A5=E6=A0=BC=E7=99=BB?=
 =?UTF-8?q?=E5=BD=95=EF=BC=8C=E9=AA=8C=E8=AF=81=E7=A0=81=E8=BE=93=E5=85=A5?=
 =?UTF-8?q?=E9=94=99=E8=AF=AF4=E6=AC=A1=EF=BC=8C=E4=B9=9F=E7=9B=B4?=
 =?UTF-8?q?=E6=8E=A5=E5=85=B3=E9=97=AD=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 route/__init__.py | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/route/__init__.py b/route/__init__.py
index 4df89dee4..57efed4fb 100755
--- a/route/__init__.py
+++ b/route/__init__.py
@@ -182,30 +182,42 @@ def checkLogin():
 
 @app.route("/do_login", methods=['POST'])
 def doLogin():
+    login_cache_count = 5
+    login_cache_limit = cache.get('login_cache_limit')
+
+    filename = 'data/close.pl'
+    if os.path.exists(filename):
+        return mw.returnJson(False, '面板已经关闭!')
+
     username = request.form.get('username', '').strip()
     password = request.form.get('password', '').strip()
     code = request.form.get('code', '').strip()
     # print(session)
     if 'code' in session:
         if session['code'] != mw.md5(code):
-            return mw.returnJson(False, '验证码错误,请重新输入!')
+            if login_cache_limit == None:
+                login_cache_limit = 1
+            else:
+                login_cache_limit = int(login_cache_limit) + 1
+
+            if login_cache_limit >= login_cache_count:
+                mw.writeFile(filename, 'True')
+                return mw.returnJson(False, '面板已经关闭!')
+
+            cache.set('login_cache_limit', login_cache_limit, timeout=10000)
+            login_cache_limit = cache.get('login_cache_limit')
+            code_msg = mw.getInfo("验证码错误,您还可以尝试[{1}]次!", (str(
+                login_cache_count - login_cache_limit)))
+            return mw.returnJson(False, code_msg)
 
     userInfo = mw.M('users').where(
         "id=?", (1,)).field('id,username,password').find()
 
     # print(userInfo)
     # print(password)
-
     password = mw.md5(password)
-
     # print('md5-pass', password)
 
-    login_cache_count = 5
-    login_cache_limit = cache.get('login_cache_limit')
-    filename = 'data/close.pl'
-    if os.path.exists(filename):
-        return mw.returnJson(False, '面板已经关闭!')
-
     if userInfo['username'] != username or userInfo['password'] != password:
         msg = "<a style='color: red'>密码错误</a>,帐号:{1},密码:{2},登录IP:{3}", ((
             '****', '******', request.remote_addr))