Support

Admin Tools

#11983 Admin Tools failed login alert - striping characters?

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by nicholas on Friday, 13 April 2012 16:55 CDT

zott
Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? No
Have I searched the tickets before posting? No
Have I read the documentation before posting (which pages?)? No
Joomla! version: 2,5,4
PHP version: 5.3.10
MySQL version: 5.1.61
Host: A dedicated server on Softlayer
Admin Tools version: 2.2.2

Description of my issue:

Hi Nicholas.

When I receive a "login failure" (on frontend) alert by e-mail, it shows the IP, username, and password used to do that.

But I'm using LoginByEmail extension, and it seems that AdminTools remove the @ from the username. Is that correct?

What I'm trying to know here is if the user is forgetting to insert @ at login, or if the login form is for some reason removing the @ as a cleanup proccess (me and several other users can login normally), or if AdminTools is removing the @ when sending the e-mail.

Here is a sample message:
I edited the password and IP out, and redacted e-mail (aaa = name 1, bbb = name 2, ccc = domain name), for security reasons:
=======================================================
Hello,

We would like to notify you that a security exception was detected on your site, NAME OF MY SITE, with the following details:

IP Address: XXX.XX.XX.XX (IP Lookup: http://ip-lookup.net/index.php?ip=XXX.XX.XX.XX)
Reason: Login failure (Username: aaaaaaaaa.bbbbbbcccccccccccccccc.com -- Password: XXXXXXXXXX)

If this kind of security exception repeats itself, please log in to your site's back-end and add this IP address to your Admin Tools's Web Application Firewall feature in order to completely block the misbehaving user.

Best regards,
The NAME OF MY SITE team
============================================================
If you see the username structure, is was supposed to have an @ between bbbbb and cccccc. I know this specific error because it is mine (testing user, forget password). And I know I put the @ there.

I don't need the @ (if you remove that for security), just need to know if the @ is being removed by AdminTools, because I need to help the users with any login troubles.

Thank's, and best regards.

Jonathan Roza www.zott.com.br

nicholas
Akeeba Staff
Manager
> I'm using LoginByEmail extension, and it seems that AdminTools remove the @ from the username. Is that correct?
Yes, Admin Tools sanitises the username in order to avoid sending you potentially malicious stuff by email. Technically speaking, we're using the JRequest::getCmd() method which removes all characters except unaccented letters (a-z, a-Z), numbers, dashes, dots and underscores. Everything else is stripped off.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

zott
Hi Nicholas.

Thank's for the answer.

Best regards.

Jonathan

Jonathan Roza www.zott.com.br

nicholas
Akeeba Staff
Manager
You're welcome, Jonathan!

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!