04/28 Fixed some security issues

routes/auth.py

@@ -28,6 +28,8 @@ def index():
     return redirect(url_for('auth.login'))
 
 @bp.route('/register', methods=['GET', 'POST'], endpoint='register')
+@login_required
+@admin_required
 @log_user_activity('user_registration')
 def register():
     """User registration endpoint"""
@@ -84,6 +86,18 @@ def login():
             flash('Please enter both username and password.', 'error')
             return render_template('login.html')
 
+        # Rate-limit check — blocks IPs with 5+ failed attempts in 15 minutes
+        from flask import current_app
+        sec_mgr = getattr(current_app, 'security_manager', None)
+        if sec_mgr and sec_mgr.is_auth_rate_limited():
+            logger_handler.log_security_event(
+                event_type="login_rate_limited",
+                description=f"Login blocked by rate limiter for username: {username}",
+                severity="HIGH"
+            )
+            flash('Too many failed attempts. Please wait 15 minutes before trying again.', 'error')
+            return render_template('login.html')
+
         # Verify Turnstile if enabled
         if turnstile_utils.is_enabled():
             if not turnstile_utils.verify_turnstile(turnstile_response):
@@ -126,6 +140,10 @@ def login():
                 session['full_name'] = user.full_name
                 session['login_time'] = datetime.now().isoformat()
 
+                # Create a secure session token (also clears failed attempts for this IP)
+                if sec_mgr:
+                    sec_mgr.create_secure_session(user.id)
+
                 # Update last login date
                 user.last_login_date = datetime.utcnow()
                 db.session.commit()
@@ -162,7 +180,10 @@ def login():
                 return redirect(url_for('attendance.attendance_report'))
 
             else:
-                # Invalid credentials - log failed attempt
+                # Invalid credentials — record failed attempt for rate limiting
+                if sec_mgr:
+                    sec_mgr.record_failed_attempt(username)
+
                 user_id = user.id if user else None
                 logger_handler.log_user_login(
                     user_id=user_id,