I can fix it (freely), it's an easy needed fix

A fix for "Brute-force attack with tokens to enter survey" is already provided and there is a delay when the token is entered incorrectly several times.
Or maybe I misunderstand the fix you want to provide?

We use same time for Admin user and token user. BUT : it's a totally different attack.

yes : there are a Brute force : but it use the same time and try than admin user.

Admin user brute force attack can use

• "social attack" : birthday, childrens name
• other powned password for same user
• password rainbow table

Token user can only be automatic caracters : randomly chooisen

Else : the right give are really more dangerous

• Admin user : All database of all user of all survey
• token user : one user information on one survey

The 1st issue is to use the same system for a totally different concept. If you can not understand this : i can not explain more.

I understand this absolutely fine but this sounds like a feature request and not a bug. Please create a PR and I will take it up from there

But : this issue was introduced in a https://github.com/LimeSurvey/LimeSurvey/blob/0b24642017090b0a16f867ab7c10c9d73f5629d7/docs/release_notes.txt#L214

in 3.X when new feature is forbidden … then ?

Can i fix it for 3.X or not ?

yes, you can.

I'm using 3.x version behind a reverse proxy and behind kubernetes.
The feature is blacklisting the proxy's address. If you're simply using $_SERVER['REMOTE_HOST'] that's not enough.
You should have care of the address $_SERVER['HTTP_X_FORWARDED_FOR'] also.
My blocked IP is the kubernetes service.

https://github.com/LimeSurvey/LimeSurvey/blob/1e90f0c83afdc803d57bd24d6f51c70683459869/application/helpers/common_helper.php#L4631

Indeed, Denis.

HTTP_X_FORWARDED_FOR can be a comma separated list of IPv4 addresses.
The least forwarded should be on the left.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For

Maybe I can post a patch on this. Do you accept github Pull requests?

More, on this, I would say the IP address can be easily faked with crafted http requests from an attacker. I wouldn't pay so much attention on this.

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=33284

Fixed in Release 5.3.0+220228