View Issue Details

Related ChangesetsJump to NotesJump to History
This issue affects 1 person(s).
 8
IDProjectCategoryView StatusDate SubmittedLast Update
19228Bug reportsAuthenticationpublic2023-11-09 10:012023-11-27 09:51
Reporterc_schmitz Assigned ToDenisChenu  
PriorityurgentSeverityblock 
Status closedResolutionfixed 
Summary19228: Setting Bruteforce timeout values to empty string causes the administrator to be locked out
Description

Setting Bruteforce timeout values to empty string causes the administrator to be locked out

Steps To Reproduce

Steps to reproduce

In general settings remove the timeout & retry values for administration/survey participants and save.

Expected result

You should not be able to save, you should be forced to give a positive integer number >=0.

Actual result

You can save. After logging out you are unable to log in, anymore.

TagsNo tags attached.
Bug heat8
Complete LimeSurvey version number (& build)Latest 5.x version
I will donate to the project if issue is resolvedNo
Browser
Database type & versionMySQL
Server OS (if known)
Webserver software & version (if known)
PHP Version8.x

Users monitoring this issue

There are no users monitoring this issue.

Activities

DenisChenu

DenisChenu

2023-11-09 10:12

developer   ~78351

0 or "" can just disable ?

Maybe adding a placeholder ? With min=1

<input placeholder="disable" class="form-control" min="1" type="number" name="maxLoginAttemptParticipants" value="3">

Something like this

Capture d’écran du 2023-11-09 10-11-23.png (20,638 bytes)   
Capture d’écran du 2023-11-09 10-11-23.png (20,638 bytes)   
DenisChenu

DenisChenu

2023-11-09 16:22

developer   ~78353

I can not reproduce on last 5 and 6 ?
DenisChenu

DenisChenu

2023-11-09 16:22

developer   ~78354

Peek 09-11-2023 16-17.gif (1,141,791 bytes)
Peek 09-11-2023 16-19.gif (1,241,640 bytes)
Peek 09-11-2023 16-21.gif (1,822,693 bytes)
gabrieljenik

gabrieljenik

2023-11-13 14:15

manager   ~78412

@DenisChenu seems you have already been digging on this.
Are you taking it or prefer me to take it?
DenisChenu

DenisChenu

2023-11-13 15:07

developer   ~78418

@gabrieljenik : i just can not reproduce …
gabrieljenik

gabrieljenik

2023-11-13 20:32

manager   ~78439

I couldn't reproduce it either.

We can still add those validations using the html5 attribute min=0
DenisChenu

DenisChenu

2023-11-14 08:33

developer   ~78442

We can still add those validations using the html5 attribute min=0

0 for time in second (then reset each time)
1 for max number + integer
and disable for placeholder : i take it.
DenisChenu

DenisChenu

2023-11-14 10:03

developer   ~78447

Last edited: 2023-11-14 10:10

I can reproduce for Token part (debug = 2)
5.X

PHP warning.html (21,740 bytes)    
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>PHP warning</title>

<style type="text/css">
/*<![CDATA[*/
html,body,div,span,applet,object,iframe,h1,h2,h3,h4,h5,h6,p,blockquote,pre,a,abbr,acronym,address,big,cite,code,del,dfn,em,font,img,ins,kbd,q,s,samp,small,strike,strong,sub,sup,tt,var,b,u,i,center,dl,dt,dd,ol,ul,li,fieldset,form,label,legend,table,caption,tbody,tfoot,thead,tr,th,td{border:0;outline:0;font-size:100%;vertical-align:baseline;background:transparent;margin:0;padding:0;}
body{line-height:1;}
ol,ul{list-style:none;}
blockquote,q{quotes:none;}
blockquote:before,blockquote:after,q:before,q:after{content:none;}
:focus{outline:0;}
ins{text-decoration:none;}
del{text-decoration:line-through;}
table{border-collapse:collapse;border-spacing:0;}

body {
	font: normal 9pt "Verdana";
	color: #000;
	background: #fff;
}

h1 {
	font: normal 18pt "Verdana";
	color: #f00;
	margin-bottom: .5em;
}

h2 {
	font: normal 14pt "Verdana";
	color: #800000;
	margin-bottom: .5em;
}

h3 {
	font: bold 11pt "Verdana";
}

pre {
	font: normal 11pt Menlo, Consolas, "Lucida Console", Monospace;
}

pre span.error {
	display: block;
	background: #fce3e3;
}

pre span.ln {
	color: #999;
	padding-right: 0.5em;
	border-right: 1px solid #ccc;
}

pre span.error-ln {
	font-weight: bold;
}

.container {
	margin: 1em 4em;
}

.version {
	color: gray;
	font-size: 8pt;
	border-top: 1px solid #aaa;
	padding-top: 1em;
	margin-bottom: 1em;
}

.message {
	color: #000;
	padding: 1em;
	font-size: 11pt;
	background: #f3f3f3;
	-webkit-border-radius: 10px;
	-moz-border-radius: 10px;
	border-radius: 10px;
	margin-bottom: 1em;
	line-height: 160%;
}

.source {
	margin-bottom: 1em;
}

.code pre {
	background-color: #ffe;
	margin: 0.5em 0;
	padding: 0.5em;
	line-height: 125%;
	border: 1px solid #eee;
}

.source .file {
	margin-bottom: 1em;
	font-weight: bold;
}

.traces {
	margin: 2em 0;
}

.trace {
	margin: 0.5em 0;
	padding: 0.5em;
}

.trace.app {
	border: 1px dashed #c00;
}

.trace .number {
	text-align: right;
	width: 2em;
	padding: 0.5em;
}

.trace .content {
	padding: 0.5em;
}

.trace .plus,
.trace .minus {
	display:inline;
	vertical-align:middle;
	text-align:center;
	border:1px solid #000;
	color:#000;
	font-size:10px;
	line-height:10px;
	margin:0;
	padding:0 1px;
	width:10px;
	height:10px;
}

.trace.collapsed .minus,
.trace.expanded .plus,
.trace.collapsed pre {
	display: none;
}

.trace-file {
	cursor: pointer;
	padding: 0.2em;
}

.trace-file:hover {
	background: #f0ffff;
}
/*]]>*/
</style>
</head>

<body>
<div class="container">
	<h1>PHP warning</h1>

	<p class="message">
		A non-numeric value encountered	</p>

	<div class="source">
		<p class="file">/media/shnoulle/data/webdev/ls5/application/models/FailedLoginAttempt.php(126)</p>
		<div class="code"><pre><span class="ln">114</span>             $criteria = new CDbCriteria();
<span class="ln">115</span>             $criteria-&gt;condition = 'number_attempts &gt;= :attempts AND ip = :ip AND is_frontend = :is_frontend';
<span class="ln">116</span>             $criteria-&gt;params = array(
<span class="ln">117</span>                 ':attempts' =&gt; $maxLoginAttempt,
<span class="ln">118</span>                 ':ip' =&gt; $ip,
<span class="ln">119</span>                 ':is_frontend' =&gt; ($attemptType === FailedLoginAttempt::TYPE_TOKEN)
<span class="ln">120</span>             );
<span class="ln">121</span>             $row = $this-&gt;find($criteria);
<span class="ln">122</span>         }
<span class="ln">123</span> 
<span class="ln">124</span>         if ($row != null) {
<span class="ln">125</span>             $lastattempt = strtotime($row-&gt;last_attempt);
<span class="error"><span class="ln error-ln">126</span>             if (time() &gt; $lastattempt + $timeOut) {
</span><span class="ln">127</span>                 $this-&gt;deleteAttempts($attemptType);
<span class="ln">128</span>             } else {
<span class="ln">129</span>                 $isLockedOut = true;
<span class="ln">130</span>             }
<span class="ln">131</span>         }
<span class="ln">132</span>         return $isLockedOut;
<span class="ln">133</span>     }
<span class="ln">134</span> 
<span class="ln">135</span>     /**
<span class="ln">136</span>      * Records a failed login-attempt if IP is not already locked out
<span class="ln">137</span>      *
<span class="ln">138</span>      * @param string attempt type ('login' or 'token')
</pre></div>	</div>

	<div class="traces">
		<h2>Stack Trace</h2>
				<table style="width:100%;">
						<tbody><tr class="trace app expanded">
			<td class="number">
				#0			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/application/helpers/frontend_helper.php(1257): <strong>FailedLoginAttempt</strong>-&gt;<strong>isLockedOut</strong>("token")				</div>

				<div class="code"><pre><span class="ln">1252</span>  * @return string[] ($renderToken, $FlashError)
<span class="ln">1253</span>  */
<span class="ln">1254</span> function testIfTokenIsValid(array $subscenarios, array $thissurvey, array $aEnterTokenData, $clienttoken)
<span class="ln">1255</span> {
<span class="ln">1256</span>     $FlashError = '';
<span class="error"><span class="ln error-ln">1257</span>     if (FailedLoginAttempt::model()-&gt;isLockedOut(FailedLoginAttempt::TYPE_TOKEN)) {
</span><span class="ln">1258</span>         $FlashError = sprintf(gT('You have exceeded the number of maximum access code validation attempts. Please wait %d minutes before trying again.'), App()-&gt;getConfig('timeOutParticipants') / 60);
<span class="ln">1259</span>         $renderToken = 'main';
<span class="ln">1260</span>     } else {
<span class="ln">1261</span>         if (!$subscenarios['tokenValid']) {
<span class="ln">1262</span>             //Check if there is a clienttoken set
</pre></div>			</td>
		</tr>
						<tr class="trace app expanded">
			<td class="number">
				#1			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/application/helpers/SurveyRuntimeHelper.php(1677): <strong>testIfTokenIsValid</strong>(array("captchaCorrect"
 =&gt; true, "tokenValid" =&gt; true), array("htmlemail" =&gt; "Y", 
"format" =&gt; "G", "tokenencryptionoptions" =&gt; "{ 
"enabled":"Y","columns":{ "firstname":"N","lastname":"N","emai...", 
"template" =&gt; "vanilla", ...), array("bNewTest" =&gt; false, 
"bDirectReload" =&gt; false, "iSurveyId" =&gt; "845743", "sLangCode" 
=&gt; "fr"), "sezvaezrzer")				</div>

				<div class="code"><pre><span class="ln">1672</span>         }
<span class="ln">1673</span> 
<span class="ln">1674</span>         // Scenario =&gt; Token required
<span class="ln">1675</span>         if ($scenarios['tokenRequired'] &amp;&amp; !$preview) {
<span class="ln">1676</span>             //Test if token is valid
<span class="error"><span class="ln error-ln">1677</span>             list($renderToken, $FlashError, $aEnterTokenData) = testIfTokenIsValid($subscenarios, $this-&gt;aSurveyInfo, $aEnterTokenData, $clienttoken);
</span><span class="ln">1678</span>         }
<span class="ln">1679</span> 
<span class="ln">1680</span>         if ($FlashError) {
<span class="ln">1681</span>             $aEnterErrors['flash'] = $FlashError;
<span class="ln">1682</span>         }
</pre></div>			</td>
		</tr>
						<tr class="trace app expanded">
			<td class="number">
				#2			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/application/helpers/SurveyRuntimeHelper.php(200): <strong>SurveyRuntimeHelper</strong>-&gt;<strong>showTokenOrCaptchaFormsIfNeeded</strong>()				</div>

				<div class="code"><pre><span class="ln">195</span>         extract($args);
<span class="ln">196</span> 
<span class="ln">197</span>         ///////////////////////////////////////////////////////////
<span class="ln">198</span>         // 1: We check if token and/or captcha form shouls be shown
<span class="ln">199</span>         if (!isset($_SESSION[$this-&gt;LEMsessid]['step'])) {
<span class="error"><span class="ln error-ln">200</span>             $this-&gt;showTokenOrCaptchaFormsIfNeeded();
</span><span class="ln">201</span>         }
<span class="ln">202</span>         if (!$this-&gt;previewgrp &amp;&amp; !$this-&gt;previewquestion) {
<span class="ln">203</span>             $this-&gt;initMove(); // main methods to init session, LEM, moves, errors, etc
<span class="ln">204</span>             $this-&gt;checkForDataSecurityAccepted(); // must be called after initMove to allow LEM to be initialized
<span class="ln">205</span>             if (EmCacheHelper::useCache()) {
</pre></div>			</td>
		</tr>
						<tr class="trace app collapsed">
			<td class="number">
				#3			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/application/controllers/survey/index.php(636): <strong>SurveyRuntimeHelper</strong>-&gt;<strong>run</strong>(845743,
 array("surveyid" =&gt; 845743, "thissurvey" =&gt; array("htmlemail" 
=&gt; "Y", "format" =&gt; "G", "tokenencryptionoptions" =&gt; "{ 
"enabled":"Y","columns":{ "firstname":"N","lastname":"N","emai...", 
"template" =&gt; "vanilla", ...), "thisstep" =&gt; 0, "clienttoken" 
=&gt; "sezvaezrzer", ...))				</div>

				<div class="code"><pre><span class="ln">631</span>         unset($redata);
<span class="ln">632</span>         $redata = compact(array_keys(get_defined_vars()));
<span class="ln">633</span>         Yii::import('application.helpers.SurveyRuntimeHelper');
<span class="ln">634</span>         $tmp = new SurveyRuntimeHelper();
<span class="ln">635</span>         // try {
<span class="error"><span class="ln error-ln">636</span>             $tmp-&gt;run($surveyid, $redata);
</span><span class="ln">637</span>         // } catch (WrongTemplateVersionException $ex) {
<span class="ln">638</span>         //     echo $ex-&gt;getMessage();
<span class="ln">639</span>         // }
<span class="ln">640</span>     }
<span class="ln">641</span> 
</pre></div>			</td>
		</tr>
						<tr class="trace app collapsed">
			<td class="number">
				#4			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/application/controllers/survey/index.php(22): <strong>Index</strong>-&gt;<strong>action</strong>()				</div>

				<div class="code"><pre><span class="ln">17</span>     public $oTemplate;
<span class="ln">18</span> 
<span class="ln">19</span>     public function run()
<span class="ln">20</span>     {
<span class="ln">21</span>         useFirebug();
<span class="error"><span class="ln error-ln">22</span>         $this-&gt;action();
</span><span class="ln">23</span>     }
<span class="ln">24</span> 
<span class="ln">25</span>     /**
<span class="ln">26</span>      *
<span class="ln">27</span>      * todo: this function is toooo long, to many things happening here. Should be refactored asap!
</pre></div>			</td>
		</tr>
						<tr class="trace core collapsed">
			<td class="number">
				#5			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/vendor/yiisoft/yii/framework/web/actions/CAction.php(76): <strong>Index</strong>-&gt;<strong>run</strong>()				</div>

				<div class="code"><pre><span class="ln">71</span>     {
<span class="ln">72</span>         $method=new ReflectionMethod($this, 'run');
<span class="ln">73</span>         if($method-&gt;getNumberOfParameters()&gt;0)
<span class="ln">74</span>             return $this-&gt;runWithParamsInternal($this, $method, $params);
<span class="ln">75</span> 
<span class="error"><span class="ln error-ln">76</span>         $this-&gt;run();
</span><span class="ln">77</span>         return true;
<span class="ln">78</span>     }
<span class="ln">79</span> 
<span class="ln">80</span>     /**
<span class="ln">81</span>      * Executes a method of an object with the supplied named parameters.
</pre></div>			</td>
		</tr>
						<tr class="trace core collapsed">
			<td class="number">
				#6			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/vendor/yiisoft/yii/framework/web/CController.php(308): <strong>CAction</strong>-&gt;<strong>runWithParams</strong>(array("r" =&gt; "survey/index", "sid" =&gt; "845743", "token" =&gt; "sezvaezrzer", "newtest" =&gt; "Y"))				</div>

				<div class="code"><pre><span class="ln">303</span>     {
<span class="ln">304</span>         $priorAction=$this-&gt;_action;
<span class="ln">305</span>         $this-&gt;_action=$action;
<span class="ln">306</span>         if($this-&gt;beforeAction($action))
<span class="ln">307</span>         {
<span class="error"><span class="ln error-ln">308</span>             if($action-&gt;runWithParams($this-&gt;getActionParams())===false)
</span><span class="ln">309</span>                 $this-&gt;invalidActionParams($action);
<span class="ln">310</span>             else
<span class="ln">311</span>                 $this-&gt;afterAction($action);
<span class="ln">312</span>         }
<span class="ln">313</span>         $this-&gt;_action=$priorAction;
</pre></div>			</td>
		</tr>
						<tr class="trace core collapsed">
			<td class="number">
				#7			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/vendor/yiisoft/yii/framework/web/CController.php(286): <strong>CController</strong>-&gt;<strong>runAction</strong>(Index)				</div>

				<div class="code"><pre><span class="ln">281</span>      * @see runAction
<span class="ln">282</span>      */
<span class="ln">283</span>     public function runActionWithFilters($action,$filters)
<span class="ln">284</span>     {
<span class="ln">285</span>         if(empty($filters))
<span class="error"><span class="ln error-ln">286</span>             $this-&gt;runAction($action);
</span><span class="ln">287</span>         else
<span class="ln">288</span>         {
<span class="ln">289</span>             $priorAction=$this-&gt;_action;
<span class="ln">290</span>             $this-&gt;_action=$action;
<span class="ln">291</span>             CFilterChain::create($this,$action,$filters)-&gt;run();
</pre></div>			</td>
		</tr>
						<tr class="trace core collapsed">
			<td class="number">
				#8			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/vendor/yiisoft/yii/framework/web/CController.php(265): <strong>CController</strong>-&gt;<strong>runActionWithFilters</strong>(Index, array())				</div>

				<div class="code"><pre><span class="ln">260</span>         {
<span class="ln">261</span>             if(($parent=$this-&gt;getModule())===null)
<span class="ln">262</span>                 $parent=Yii::app();
<span class="ln">263</span>             if($parent-&gt;beforeControllerAction($this,$action))
<span class="ln">264</span>             {
<span class="error"><span class="ln error-ln">265</span>                 $this-&gt;runActionWithFilters($action,$this-&gt;filters());
</span><span class="ln">266</span>                 $parent-&gt;afterControllerAction($this,$action);
<span class="ln">267</span>             }
<span class="ln">268</span>         }
<span class="ln">269</span>         else
<span class="ln">270</span>             $this-&gt;missingAction($actionID);
</pre></div>			</td>
		</tr>
						<tr class="trace core collapsed">
			<td class="number">
				#9			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/vendor/yiisoft/yii/framework/web/CWebApplication.php(282): <strong>CController</strong>-&gt;<strong>run</strong>("index")				</div>

				<div class="code"><pre><span class="ln">277</span>         {
<span class="ln">278</span>             list($controller,$actionID)=$ca;
<span class="ln">279</span>             $oldController=$this-&gt;_controller;
<span class="ln">280</span>             $this-&gt;_controller=$controller;
<span class="ln">281</span>             $controller-&gt;init();
<span class="error"><span class="ln error-ln">282</span>             $controller-&gt;run($actionID);
</span><span class="ln">283</span>             $this-&gt;_controller=$oldController;
<span class="ln">284</span>         }
<span class="ln">285</span>         else
<span class="ln">286</span>             throw new CHttpException(404,Yii::t('yii','Unable to resolve the request "{route}".',
<span class="ln">287</span>                 array('{route}'=&gt;$route===''?$this-&gt;defaultController:$route)));
</pre></div>			</td>
		</tr>
						<tr class="trace core collapsed">
			<td class="number">
				#10			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/vendor/yiisoft/yii/framework/web/CWebApplication.php(141): <strong>CWebApplication</strong>-&gt;<strong>runController</strong>("survey/index")				</div>

				<div class="code"><pre><span class="ln">136</span>             foreach(array_splice($this-&gt;catchAllRequest,1) as $name=&gt;$value)
<span class="ln">137</span>                 $_GET[$name]=$value;
<span class="ln">138</span>         }
<span class="ln">139</span>         else
<span class="ln">140</span>             $route=$this-&gt;getUrlManager()-&gt;parseUrl($this-&gt;getRequest());
<span class="error"><span class="ln error-ln">141</span>         $this-&gt;runController($route);
</span><span class="ln">142</span>     }
<span class="ln">143</span> 
<span class="ln">144</span>     /**
<span class="ln">145</span>      * Registers the core application components.
<span class="ln">146</span>      * This method overrides the parent implementation by registering additional core components.
</pre></div>			</td>
		</tr>
						<tr class="trace core collapsed">
			<td class="number">
				#11			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/vendor/yiisoft/yii/framework/base/CApplication.php(185): <strong>CWebApplication</strong>-&gt;<strong>processRequest</strong>()				</div>

				<div class="code"><pre><span class="ln">180</span>     public function run()
<span class="ln">181</span>     {
<span class="ln">182</span>         if($this-&gt;hasEventHandler('onBeginRequest'))
<span class="ln">183</span>             $this-&gt;onBeginRequest(new CEvent($this));
<span class="ln">184</span>         register_shutdown_function(array($this,'end'),0,false);
<span class="error"><span class="ln error-ln">185</span>         $this-&gt;processRequest();
</span><span class="ln">186</span>         if($this-&gt;hasEventHandler('onEndRequest'))
<span class="ln">187</span>             $this-&gt;onEndRequest(new CEvent($this));
<span class="ln">188</span>     }
<span class="ln">189</span> 
<span class="ln">190</span>     /**
</pre></div>			</td>
		</tr>
						<tr class="trace app collapsed">
			<td class="number">
				#12			</td>
			<td class="content">
				<div class="trace-file">
											<div class="plus">+</div>
						<div class="minus">–</div>
										&nbsp;/media/shnoulle/data/webdev/ls5/index.php(161): <strong>CApplication</strong>-&gt;<strong>run</strong>()				</div>

				<div class="code"><pre><span class="ln">156</span> require_once APPPATH . 'core/LSYii_Application' . EXT;
<span class="ln">157</span> 
<span class="ln">158</span> $config = require_once(APPPATH . 'config/internal' . EXT);
<span class="ln">159</span> 
<span class="ln">160</span> Yii::$enableIncludePath = false;
<span class="error"><span class="ln error-ln">161</span> Yii::createApplication('LSYii_Application', $config)-&gt;run();
</span><span class="ln">162</span> 
<span class="ln">163</span> /* End of file index.php */
<span class="ln">164</span> /* Location: ./index.php */
</pre></div>			</td>
		</tr>
				</tbody></table>
	</div>

	<div class="version">
		2023-11-14 10:00:39 nginx/1.22.1 <a href="https://www.yiiframework.com/">Yii Framework</a>/1.1.28	</div>
</div>

<script type="text/javascript">
/*<![CDATA[*/
var traceReg = new RegExp("(^|\\s)trace-file(\\s|$)");
var collapsedReg = new RegExp("(^|\\s)collapsed(\\s|$)");

var e = document.getElementsByTagName("div");
for(var j=0,len=e.length;j<len;j++){
	if(traceReg.test(e[j].className)){
		e[j].onclick = function(){
			var trace = this.parentNode.parentNode;
			if(collapsedReg.test(trace.className))
				trace.className = trace.className.replace("collapsed", "expanded");
			else
				trace.className = trace.className.replace("expanded", "collapsed");
		}
	}
}
/*]]>*/
</script>



<div id="grammalecte_menu_main_button_shadow_host" style="width: 0px; height: 0px;"></div></body><script src="PHP%20warning_fichiers/api.js"></script></html>
PHP warning.html (21,740 bytes)   
DenisChenu

DenisChenu

2023-11-14 10:52

developer   ~78448

This commit https://github.com/LimeSurvey/LimeSurvey/pull/3617/commits/8056689943a65d4824bf3c1c49b993cda534b50f

Fix an XSS by superadmin to other superadmin
DenisChenu

DenisChenu

2023-11-14 12:32

developer   ~78451

5.X : https://github.com/LimeSurvey/LimeSurvey/pull/3617
master : https://github.com/LimeSurvey/LimeSurvey/pull/3618
tibor.pacalat

tibor.pacalat

2023-11-20 13:35

administrator   ~78536

@DenisChenu There is an issue on master and 5.x. When I type in some values and save, the values become 1.

Screenshot 2023-11-20 at 13.25.56.png (62,870 bytes)   
Screenshot 2023-11-20 at 13.25.56.png (62,870 bytes)   
DenisChenu

DenisChenu

2023-11-20 16:34

developer   ~78548

Oups … sorry … really sorry …

Must be fixed now …
DenisChenu

DenisChenu

2023-11-23 16:39

developer   ~78689

Fix committed to 5.x branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=35772
DenisChenu

DenisChenu

2023-11-23 16:41

developer   ~78691

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=35773
LimeBot

LimeBot

2023-11-27 09:51

administrator   ~78719

Fixed in Release 6.3.7+231127

Related Changesets

LimeSurvey: 5.x e4f78cc0

2023-11-23 17:38

DenisChenu

Committer: GitHub


Details Diff		 Fixed issue 19228: Setting Bruteforce timeout values to empty string causes the administrator to be locked out (03617) Affected Issues
19228
mod - application/models/FailedLoginAttempt.php Diff File
mod - application/views/admin/globalsettings/_security.php Diff File

LimeSurvey: master 6c969566

2023-11-23 17:39

DenisChenu

Committer: GitHub


Details Diff		 Fixed issue 19228: Setting Bruteforce timeout values to empty string causes the administrator to be locked out (03618) Affected Issues
19228
mod - application/models/FailedLoginAttempt.php Diff File
mod - application/views/admin/globalsettings/_security.php Diff File

Issue History

Date Modified Username Field Change
2023-11-09 10:01 c_schmitz New Issue
2023-11-09 10:08 c_schmitz Priority none => urgent
2023-11-09 10:08 c_schmitz Severity minor => block
2023-11-09 10:12 DenisChenu Note Added: 78351
2023-11-09 10:12 DenisChenu File Added: Capture d’écran du 2023-11-09 10-11-23.png
2023-11-09 10:12 DenisChenu Bug heat 0 => 2
2023-11-09 16:08 DenisChenu Assigned To => DenisChenu
2023-11-09 16:08 DenisChenu Status new => assigned
2023-11-09 16:19 DenisChenu Assigned To DenisChenu =>
2023-11-09 16:22 DenisChenu Assigned To => DenisChenu
2023-11-09 16:22 DenisChenu Status assigned => new
2023-11-09 16:22 DenisChenu Note Added: 78353
2023-11-09 16:22 DenisChenu Note Added: 78354
2023-11-09 16:22 DenisChenu File Added: Peek 09-11-2023 16-17.gif
2023-11-09 16:22 DenisChenu File Added: Peek 09-11-2023 16-19.gif
2023-11-09 16:22 DenisChenu File Added: Peek 09-11-2023 16-21.gif
2023-11-09 16:24 DenisChenu Assigned To DenisChenu =>
2023-11-13 14:15 gabrieljenik Note Added: 78412
2023-11-13 14:15 gabrieljenik Bug heat 2 => 4
2023-11-13 14:15 gabrieljenik Status new => acknowledged
2023-11-13 15:07 DenisChenu Note Added: 78418
2023-11-13 20:32 gabrieljenik Note Added: 78439
2023-11-14 08:33 DenisChenu Note Added: 78442
2023-11-14 08:33 DenisChenu Assigned To => DenisChenu
2023-11-14 08:33 DenisChenu Status acknowledged => assigned
2023-11-14 10:03 DenisChenu Note Added: 78447
2023-11-14 10:03 DenisChenu File Added: PHP warning.html
2023-11-14 10:10 DenisChenu Note Edited: 78447
2023-11-14 10:52 DenisChenu Note Added: 78448
2023-11-14 12:32 DenisChenu Note Added: 78451
2023-11-14 12:32 DenisChenu Assigned To DenisChenu => gabrieljenik
2023-11-14 12:32 DenisChenu Status assigned => ready for code review
2023-11-20 13:35 tibor.pacalat Note Added: 78536
2023-11-20 13:35 tibor.pacalat File Added: Screenshot 2023-11-20 at 13.25.56.png
2023-11-20 13:35 tibor.pacalat Bug heat 4 => 6
2023-11-20 16:34 DenisChenu Note Added: 78548
2023-11-22 14:29 gabrieljenik Assigned To gabrieljenik => tibor.pacalat
2023-11-22 14:29 gabrieljenik Status ready for code review => ready for testing
2023-11-23 16:39 DenisChenu Changeset attached => LimeSurvey 5.x e4f78cc0
2023-11-23 16:39 DenisChenu Note Added: 78689
2023-11-23 16:39 DenisChenu Assigned To tibor.pacalat => DenisChenu
2023-11-23 16:39 DenisChenu Resolution open => fixed
2023-11-23 16:39 tibor.pacalat Status ready for testing => resolved
2023-11-23 16:41 DenisChenu Changeset attached => LimeSurvey master 6c969566
2023-11-23 16:41 DenisChenu Note Added: 78691
2023-11-27 09:51 LimeBot Note Added: 78719
2023-11-27 09:51 LimeBot Status resolved => closed
2023-11-27 09:51 LimeBot Bug heat 6 => 8