i found my few 0.9.6.3 setups don’t block users on failed login count to the manager section. after some investigation i found my failedlogin counter always 0.
it’s because of line 213 in login.processor.php
if(!isset($_SESSION['mgrValidated'])) {
$sql = "update $dbase.`".$table_prefix."user_attributes` SET failedlogincount=0, logincount=logincount+1, lastlogin=thislogin, thislogin=".time().", sessionid='$currentsessionid' where internalKey=$internalKey";
$rs = mysql_query($sql);
}
the idea was to reset failedlogincount and increment counters after _successfull_ manager login, but here is the opposite (!isset..) situation, please, fix that in next release (just remove ! is enough ;-)
MODX Staff