bugphpGroupWare - Bugs: bug #5313, "blocked, too many...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #5313: "blocked, too many attempts" and sitemgr

Submitted by:  None
Submitted on:  Mon 15 Sep 2003 03:56:15 PM UTC  
 
Item Group: 0.9.16RC1Category: sitemgr
Severity: 3 - NormalPriority: 5 - Normal
Status: FixedPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: NoneOperating System: None
Reproducibility: Every TimePlanned Release: None
Fixed Release: 

Wed 07 Dec 2005 10:53:33 AM UTC, comment #4:

This has been fixed in the stable branch of CVS, please update to grab the fix.

No if an account is marked as anonymous wrong password attempts will not block the account. IP addresses are still checked and blocked regardless of which account is being used.

I also fixed a bug I found while fixing this one which meant that 1 extra attempt was being permitted.

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Fri 31 Oct 2003 02:35:48 AM UTC, comment #3:

assing this to skwashd cause it's a security issue and looks to be forgotten. I don't know who it should go to otherwise.

Chris Weiss <cw>
Project Administrator
Mon 15 Sep 2003 04:29:26 PM UTC, comment #2:

Just as a reminder:

This bug is in the same 'area' of interest: bug #5311

Hsing-Foo Wang <pooh_>
Mon 15 Sep 2003 03:58:34 PM UTC, comment #1:

woops, forgot to login before submiting.. I sent in this one.

Chris Weiss <cw>
Project Administrator
Mon 15 Sep 2003 03:56:15 PM UTC, original submission:

came across this on the phpgw site itself. If someone attampts to login to phpgw as teh user that sitemrg is using too many times with the wrong password it manages to efficively lock out the site forever on a busy site. Nice little DoS bug. added a hard coded "hack" to prevent the user from ever being blocked to get site up again.

would the proper fix be to change login_blocked() to look only for "bad login or password" records when checking for # login attempts? This would still cause the user to be blocked, and the site to be down, for 30 minutes, or whatever the Admin sets as the "blocked time". Or even a change to the session class to say "sitemgr calling, don't block me"?

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 5 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Wed 07 Dec 2005 10:53:33 AM UTCskwashdStatusNone=>Fixed
  Open/ClosedOpen=>Closed
Fri 31 Oct 2003 02:35:48 AM UTCcwAssigned toNone=>NA
Mon 15 Sep 2003 03:58:34 PM UTCcwPriority100(Error - Not Found)=>(Error - Not Found)
  ReproducibilityNone=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1