Re: 1 cset was pushed to core/stable: fixed bug 3420 potential security enhanc...

John Cox wrote:
> Changes were applied by John.Cox to core/stable level 10.
>     The following cset was applied:
>     
>     ChangeSet
>       1.2041 05/02/27 19:00:47 John.Cox@mcnabb. +1 -0
>       fixed bug 3420 potential security enhancement.  used session vars, so original user is not screwed by hacker.
>     
>       html/modules/roles/xaruser/login.php
>         1.28 05/02/27 19:00:40 John.Cox@mcnabb. +23 -6
>         fixed bug 3420 potential security enhancement.  used session vars, so original user is not screwed by hacker.
>     
> Links for the differences:
> http://xaraya.com:15000/core/stable/[email protected]


I would suggest switching to the use of a moduservar - otherwise, all 
one would have to (potentially) do is login from another ip, or maybe 
even just switch browsers to retry. While that also prevents the user 
from logging in if someone has tried to hack their account, I think the 
extra safety is worth that risk. Also, you might want to change the line:

     if ($attempts == 3) {

to
     if ($attempts >= 3) {

just to catch any potential (albeit) small loopholes in the logic.

all in all, a good addition :-)

Cheers,

--
Carl