Originally Posted by Delphiprogrammi (Post 2163932)

hi,

I just noticed the plugin author is using values directly from $_POST[] superglobal array.This is a bad programming attitude certainly without any form of sanitization this could lead to XSS security holes he should use

at least this way you're sure the values being submitted are clean

Originally Posted by Christian_ (Post 2233304)

Thank you very much for the plugin, however I do have a question. Is it only my impression or does this plugin bypass the 5 strikes protection feature? If I try to login with wrong admin credentials at the top bar of the forum, I was able to enter passwords more than 5 times. I was always shown the predefined website that says my IP address was logged and sent to the admins, which is perfectly OK. I also received a mail every time the login attempt failed. But I'm not sure whether the 5 strikes protection mechanism is still in effect, since I wasn't shown this page.

Originally Posted by Orfalopi (Post 2351316)

Hi Ali

No problem and thanks for the response.
Meanwhile, I've managed to install the plugin.
(Just a small oversight on my part, which made that it didn't worked at first.)
Now it works perfectly on 4.1.12



I've noticed this too.
If I, lets say, enter 7 times in succession a wrong password for the Admin,
then I receive 7 messages in my mailbox.
So far so good.
But, when I look at the _strikes table in my database, I see no record of this event,
which means that the waiting time of 15 minutes after 5 incorrect login attempts is circumvented.
When a cracker tries to break in with password-cracking software,
the mailbox will be flooded with messages.
Because there is no restriction on the number of login attempts, the cracker can continue to enter passwords without delay.
Maybe you can implement something, with which the 5 times (failed) login limit is preserved.

Otherwise, a great plugin :)
Good work :up:

Orfalopi