From f730d7bb0ac691153eacd80844bb530dca04e3cc Mon Sep 17 00:00:00 2001 From: Andrew Dolgov Date: Tue, 16 Oct 2018 09:11:32 +0300 Subject: another attempt to enforce session ID regeneration on login --- classes/handler/public.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'classes/handler') diff --git a/classes/handler/public.php b/classes/handler/public.php index 7cce7d71b..de9c9684a 100755 --- a/classes/handler/public.php +++ b/classes/handler/public.php @@ -503,7 +503,9 @@ class Handler_Public extends Handler { // start an empty session to deliver login error message @session_start(); - $_SESSION["login_error_msg"] = __("Incorrect username or password"); + if (!isset($_SESSION["login_error_msg"])) + $_SESSION["login_error_msg"] = __("Incorrect username or password"); + user_error("Failed login attempt for $login from {$_SERVER['REMOTE_ADDR']}", E_USER_WARNING); } -- cgit v1.2.3