[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Phpgroupware-tracker] [bug #5313] "blocked, too many attempts" and site
From: |
nobody |
Subject: |
[Phpgroupware-tracker] [bug #5313] "blocked, too many attempts" and sitemgr |
Date: |
Mon, 15 Sep 2003 12:29:27 -0400 |
User-agent: |
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030827 Mozilla Firebird/0.6 StumbleUpon/1.73 |
=================== BUG #5313: LATEST MODIFICATIONS ==================
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=5313&group_id=509
Changes by: Hsing-Foo Wang <address@hidden>
Date: Mon 09/15/2003 at 16:29 (GMT)
------------------ Additional Follow-up Comments ----------------------------
Just as a reminder:
This bug is in the same 'area' of interest: bug #5311
=================== BUG #5313: FULL BUG SNAPSHOT ===================
Submitted by: None Project: phpGroupWare
Submitted on: Mon 09/15/2003 at 15:56
Category: sitemgr Bug Group: 0.9.16RC1
Severity: 5 - Major Priority: High
Resolution: None Assigned to: None
Status: Open Component Version: None
Platform Version: None Reproducibility: Every Time
Summary: "blocked, too many attempts" and sitemgr
Original Submission: came across this on the phpgw site itself. If someone
attampts to login to phpgw as teh user that sitemrg is using too many times
with the wrong password it manages to efficively lock out the site forever on a
busy site. Nice little DoS bug. added a hard coded "hack" to prevent the user
from ever being blocked to get site up again.
would the proper fix be to change login_blocked() to look only for "bad login
or password" records when checking for # login attempts? This would still
cause the user to be blocked, and the site to be down, for 30 minutes, or
whatever the Admin sets as the "blocked time". Or even a change to the session
class to say "sitemgr calling, don't block me"?
Follow-up Comments
*******************
-------------------------------------------------------
Date: Mon 09/15/2003 at 16:29 By: pooh_
Just as a reminder:
This bug is in the same 'area' of interest: bug #5311
-------------------------------------------------------
Date: Mon 09/15/2003 at 15:58 By: cw
woops, forgot to login before submiting.. I sent in this one.
CC list is empty
No files currently attached
For detailed info, follow this link:
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=5313&group_id=509
_______________________________________________
Message sent via/by Savannah
http://savannah.gnu.org/