[serendipity-cvs] [s9y/Serendipity] 55a49a: Brute force protection for serendipity login (#927)

onli via php-blog-cvs <[email protected]> Tue, 21 Oct 2025 12:24:10 -0700

Newsgroups	gmane.comp.serendipity.cvs
Message-ID	<s9y/Serendipity/push/refs/heads/master/[email protected]>

  Branch: refs/heads/master
  Home:   https://github.com/s9y/Serendipity
  Commit: 55a49a78b2769cdb974f1a982db5f2da0ff19845
      https://github.com/s9y/Serendipity/commit/55a49a78b2769cdb974f1a982db5f2da0ff19845
  Author: onli <[email protected]>
  Date:   2025-10-21 (Tue, 21 Oct 2025)

  Changed paths:
    M docs/NEWS
    M include/functions.inc.php
    M include/functions_config.inc.php

  Log Message:
  -----------
  Brute force protection for serendipity login (#927)

* Store cache ttl with cache item
This enables us to use the cache on other scenarios than just the entries cache (with its fixed duration). Also disables the redundant check for the cache option, since the code in functions_entries already checks this.

* Brute force protection for user accounts
Allow 5 login tries a minute, block for a minute

* Rate limit logins by IP
Prevent a potential attack where futile login attempts make it impossible for the real user to log in.

* document changes

* minor: adjust function comment

* Fix: Browsing the backend was counted as failed log-in



To unsubscribe from these emails, change your notification settings at https://github.com/s9y/Serendipity/settings/notifications