From 0c77843ea71230a4b5913478fa97b5a206ced009 Mon Sep 17 00:00:00 2001
From: Mike Koch <mkoch227@gmail.com>
Date: Fri, 30 Sep 2016 21:28:26 -0400
Subject: [PATCH] Slight changes, fix lockout vuln

---
 admin/index.php    |  5 ++++-
 admin/password.php | 11 +++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/admin/index.php b/admin/index.php
index 822e3de4..8709a501 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -287,7 +287,7 @@ function print_login()
 	?>
 <div class="login-box">
     <div class="login-logo">
-        <?php echo $hesklang['staff_login_title']; ?>
+        <?php echo $hesk_settings['hesk_title']; ?>
     </div>
     <div class="login-box-body">
         <div class="loginError">
@@ -296,6 +296,9 @@ function print_login()
             hesk_handle_messages();
             ?>
         </div>
+        <h4 class="login-box-msg">
+            <?php echo $hesklang['staff_login_title']; ?>
+        </h4>
         <form class="form-horizontal" role="form" action="index.php" method="post" name="form1">
             <?php
             $has_error = '';
diff --git a/admin/password.php b/admin/password.php
index 49e9ee60..eabb235b 100644
--- a/admin/password.php
+++ b/admin/password.php
@@ -39,7 +39,6 @@ require(HESK_PATH . 'inc/common.inc.php');
 // Connect to database and check for brute force attempts
 hesk_load_database_functions();
 hesk_dbConnect();
-hesk_limitBfAttempts();
 
 $modsForHesk_settings = mfh_getSettings();
 
@@ -113,6 +112,7 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             }
         }
     }
+    hesk_limitBfAttempts();
 
     // Get email
     $email = hesk_validateEmail(hesk_POST('email'), 'ERR', 0) or $hesk_error_buffer['email'] = $hesklang['enter_valid_email'];
@@ -241,9 +241,12 @@ require_once(HESK_PATH . 'inc/headerAdmin.inc.php');
 ?>
 <div class="login-box">
     <div class="login-logo">
-        <?php echo $hesklang['passr']; ?>
+        <?php echo $hesk_settings['hesk_title']; ?>
     </div>
     <div class="login-box-body">
+        <h4 class="login-box-msg">
+            <?php echo $hesklang['passr']; ?>
+        </h4>
         <form action="password.php" method="post" name="form1" class="form-horizontal" role="form">
             <?php
             /* This will handle error, success and notice messages */
@@ -291,8 +294,8 @@ require_once(HESK_PATH . 'inc/headerAdmin.inc.php');
                                         play_again: "<?php echo hesk_slashJS($hesklang['play_again']); ?>",
                                         cant_hear_this: "<?php echo hesk_slashJS($hesklang['cant_hear_this']); ?>",
                                         incorrect_try_again: "<?php echo hesk_slashJS($hesklang['incorrect_try_again']); ?>",
-                                        image_alt_text: "<?php echo hesk_slashJS($hesklang['image_alt_text']); ?>",
-                                    },
+                                        image_alt_text: "<?php echo hesk_slashJS($hesklang['image_alt_text']); ?>"
+                                    }
                                 };
                             </script>
                         <?php