Hi,
Currently stay in IP block seems the only solution (except with big big update).

See feature https://bugs.limesurvey.org/view.php?id=17322

token : bot access : 1 seconds after 3 try is the best
admin : 10 minutes is really better

Do you think it's OK ?

Need the " that survey only" part more.

I totally agree Denis, it should block from the specific IP only.
This is a big problem as anybody can hack the survey by entering a wrong token few times and Voila, nobody will be able to participate!!

@medhat : we can not block "THIS" token only .

My opinion

1. different time and count for lock out access for token VS admin user : IP block
2. Add survey id for token user (disable access for this IP for this survey, not other survey) : ?
3. Add admin user block by username

I'm using 3.x version behind a reverse proxy and behind kubernetes.
The feature is blacklisting the proxy's address. If you're simply using $_SERVER['REMOTE_HOST'] that's not enough.
You should have care of the address $_SERVER['HTTP_X_FORWARDED_FOR'] also.
My blocked IP is the kubernetes service.

HTTP_X_FORWARDED_FOR can be a comma separated list of IPv4 addresses.
The least forwarded should be on the left.

https://github.com/LimeSurvey/LimeSurvey/blob/7b9e6711e1e673522247905f4d1d3fa199e57da1/application/helpers/common_helper.php#L4646

Maybe I can post a patch on this. Do you accept github Pull requests?

More, on this, I would say the IP address can be easily faked with crafted http requests from an attacker. I wouldn't pay so much attention on this.

I'm going to file my issues inside 17322
(sorry for cross-posting)

Maybe I can post a patch on this. Do you accept github Pull requests?

Yes, always

More, on this, I would say the IP address can be easily faked with crafted http requests from an attacker.

yes complex solution, but even solution based on fail2ban have such issue …

As per the comments, will be closing the ticket.
Seems it was already fixed on 17322.

Please add any comments in case it should be reopened.
Thanks

@gabrieljenik the the fix is applied for LS version 3, but we are facing the issue on LS version 5. any commendations?

please ignore my last comment. i have version 5.3.8+220404 and I can see the new features under Global settings to control the behavior. will check on that.
Thanks

a user just reported this same bug.
Survey's users get blocked for 10min after entering a wrong code 3 or 5 times. Even admin is blocked
survey URL: https://graz.limequery.com/618972?lang=de
LimeSurvey cloud version:5.6.4

10min.png (14,208 bytes)   

10min.png (14,208 bytes)   

@MSouad : please contact support@limesurvey.org too.