Details

    • Type: Improvement
    • Status: Open
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 3.0.0
    • Fix Version/s: Long Term
    • Component/s: None
    • Labels:
      None

      Description

      Currently the system only logs login attempts with a valid username. Instead, the system should log all login attempts whether the username exists or not.

      The system currently limits login attempts to 10 per hour per IP, however this only applies to existing usernames. Attempts to log in with usernames that do not exist are not bound by this restriction, thus an attacker could potentially gain information about which username is valid by receiving the appropriate (blocked) error message after attempting a username 10 times.

      To correct the issue, the log_users table should be updated to record the username of the user attempted, and set user_id to '0' to indicate not match on user ID. Then Users::login() must be updated to log the attempt if validation values with the appropriate data. Next, Users::validateLoginAttempts must be updated to leftJoin from log_users with users as opposed to inner join.

        Issue Links

          Activity

          cody Cody Phillips (Inactive) created issue -
          cody Cody Phillips (Inactive) made changes -
          Field Original Value New Value
          Link This issue blocks CORE-977 [ CORE-977 ]
          admin Paul Phillips made changes -
          Security Private [ 10000 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.2.0-b2 [ 10501 ]
          Fix Version/s 3.2.0-b1 [ 10002 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.2.0-b3 [ 10503 ]
          Fix Version/s 3.2.0-b2 [ 10501 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.2.0 [ 10502 ]
          Fix Version/s 3.2.0-b3 [ 10503 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.3.0 [ 10100 ]
          Fix Version/s 3.2.0 [ 10502 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.3.0-b2 [ 10507 ]
          Fix Version/s 3.3.0-b1 [ 10100 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.4.0 [ 10400 ]
          Fix Version/s 3.3.0-b2 [ 10507 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.5.0 [ 10401 ]
          Fix Version/s 3.4.0-b1 [ 10400 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.5.0-b2 [ 10701 ]
          Fix Version/s 3.5.0-b1 [ 10401 ]
          admin Paul Phillips made changes -
          Fix Version/s 3.5.0-b2 [ 10701 ]
          admin Paul Phillips made changes -
          Assignee Cody Phillips [ cody ]
          admin Paul Phillips made changes -
          Fix Version/s Long Term [ 10801 ]
          tyson Tyson Phillips (Inactive) made changes -
          Story Points 3

            People

            • Assignee:
              Unassigned
              Reporter:
              cody Cody Phillips (Inactive)
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated: