waiting 16 days for a serious bug fix
is there a fix coming for this? i posted this bug issue 16 days ago, and its a pretty fundamental issue... our community members cannot log in:
Have you considered sending a ticket? They always answer within 24-48h thoroughly
Shahjahan Jewel I might see the problem. In the handleMagicLoginAjax function, this line of code gets the value of the date and time to look back for previous logins.
$dateTime = date('Y-m-d H:i:s', current_time('timestamp') - $timingMinutes * 86400);I believe the 86400 value should be 60. With the current value, it is checking for the last 30 days, not 30 minutes (assuming default setting of 30 minutes).
The same logic is used inside the checkLoginAttempt function but it does use 60.
$dateTime = date('Y-m-d H:i:s', current_time('timestamp') - $minutes * 60);Shahjahan Jewel Additionally, isn't the handleMagicLoginAjax function counting existing logins, not just existing blocked or failed logins?
$existingCount = flsDb()->table('fls_login_hashes')
->where('ip_address', Helper::getIp())
->where('created_at', '>', $dateTime)
->count();The checkLoginAttempt function does appear to check for blocked or failed logins, not all logins.
$count = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}fls_auth_logs WHERE `ip` = %s AND `created_at` > %s AND `status` IN ('failed','blocked')", $ip, $dateTime));
Thomas Oates That's a valid point and makes a lot of sense. We will include the fix in the upcoming release. Thanks for sharing your perspective!
Doug Dennison Doug, assuming my theory is correct, until an official fix is made, have you tried increasing the login try limit from the default 5? Given that is it looking at 30 days instead of 30 minutes (or whatever the setting is set to), increasing the try limit and decreasing the time limit to 1 (1 day) should minimize the chances of it happening.
Doug Dennison We were unable to reproduce the issue on our end. Could you please create a ticket with your staging site access so we can investigate further? https://wpmanageninja.com/support-tickets/
Raiyan Marzan Does the info I posted above make any sense or am I misreading the code?
Thomas Oates Sorry I didn't notice your comment. Checking now
Thomas Oates thanks for your effort with all this. the weird thing is, the failed attempts aren't being logged in fluentauth, so i'm not sure this would make much difference
Doug Dennison We have identified the issue and will be releasing a fix soon.
Doug Dennison Are lots of your users connecting from a central location (office, etc.) behind a firewall? Also, are they getting the error when initiating a magic login or after clicking the link to login?
Raiyan Marzan amazing, thank you
Raiyan Marzan any update on the fix?
Doug Dennison We will release the fluentAuth update soon. Sorry for the inconvenient
Raiyan Marzan is this update now live or not yet?
You can set the number of login attempts and the time-out period, but if you then disable these settings, the system doesn't forget and still forbids login attempts that seem to be too many. And the duration setting doesn't matter. It will still forbid subsequent logins. It is most apparent when using magic login or when a user requests a new password and they've received the link via email.
Raiyan Marzan is this update now live?
Doug Dennison Yeah, please update the FluentAuth plugin and check. Let me know if you’re still facing any issues https://wordpress.org/plugins/fluent-security/