Login Strikes From Other Users Affecting Me

[Brad Padgett]

Hello,

On my forum my account is now locked due to failed login strikes but I was not the one who attempted the failed logins.

I am using cloudflare.

Do you believe somehow their is a cookie issue where someone elses failed logins could have affected me. I don't understand why this has happened.

How could their be an identical cookie to mine? The strike system is duplicating someone elses login attempts.

What does this mean. Please let me know right away.

Regards,

- Bradley

[Brad Padgett]

To add, it's not letting me login to any of my other accounts.

Also it gives an error when registering a new account.

[Zachery]

I'm guessing you didn't take the time to modify the vbulletin files, or to setup the proxy support to work with cloudflare did you?

[Brad Padgett]

I'm guessing you didn't take the time to modify the vbulletin files, or to setup the proxy support to work with cloudflare did you?

I'm definitely willing to if you want to point me in the right direction.

I believe the cause is cloudflare as well.

If you would tell me what I need to do to fix it. I've had to disable the login strike system momentarily until I find a solution.

[Wayne Luke]

Should start with:
https://support.cloudflare.com/hc/en...ulletin-forums

[Brad Padgett]

Should start with:
https://support.cloudflare.com/hc/en...ulletin-forums

Not sure if the code they provided will work with vbulletin version 5 or not.

You can enlighten me though so if it will work I can go ahead and make the changes. I believe you hit the nail on the head with the login strike system being affected by everyone having the same ip address.

I need to get this to work with vbulletin 5 though. The mod link is for vbulletin 4.

[Wayne Luke]

Did you do steps 2-5?

The easiest way to workaround the login strikes is to turn it off in the Settings of your AdminCP.

[Brad Padgett]

Did you do steps 2-5?

The easiest way to workaround the login strikes is to turn it off in the Settings of your AdminCP.

Yes I did that as their was no other way around it.

I have had page rules for a while now because of the constant caching that does not seem to work well with vbulletin 5.

The steps have been made but if I was to add login strikes back in I would encounter the same problem unless you have a way. If not, I will have to find another method for ip addresses.

Doesn't seem logical to run my site without different ips. Any help is appreciated.

[Zachery]

In /core/includes/class_core.php, find this:

function fetch_ip()
{
return $_SERVER['REMOTE_ADDR'];
} 

then change to this:
function fetch_ip()

{
// return $_SERVER['REMOTE_ADDR'];
return $_SERVER['HTTP_X_REAL_IP'];
} 

and in core/vb/request.php (around line 204), I changed this:

//These are set from the web page bot not from CLI
if (!isset($_SERVER['REMOTE_ADDR']))
{
$_SERVER['REMOTE_ADDR'] = ;
}
return $_SERVER['REMOTE_ADDR'];
} 

to this:
//These are set from the web page bot not from CLI

if (!isset($_SERVER['REMOTE_ADDR']))
{
$_SERVER['REMOTE_ADDR'] = ;
}
// return $_SERVER['REMOTE_ADDR'];
return $_SERVER['HTTP_X_REAL_IP'];
} 

and then a few lines below that, see this:

if (isset($_SERVER['REMOTE_ADDR']))
{
$alt_ip = $_SERVER['REMOTE_ADDR'];
} 

and below it I added this:

if ($_SERVER['REMOTE_ADDR'] == $_SERVER["SERVER_ADDR"])
{
$alt_ip = $_SERVER["HTTP_X_REAL_IP"];
} 

You may need to change $_SERVER["HTTP_X_REAL_IP"] to whatever cloudflare is passing to you, which seems to be $_SERVER['HTTP_CLIENT_IP']

[Brad Padgett]

In /core/includes/class_core.php, find this:

function fetch_ip()
{
return $_SERVER['REMOTE_ADDR'];
} 

then change to this:
function fetch_ip()

{
// return $_SERVER['REMOTE_ADDR'];
return $_SERVER['HTTP_X_REAL_IP'];
} 

and in core/vb/request.php (around line 204), I changed this:

//These are set from the web page bot not from CLI
if (!isset($_SERVER['REMOTE_ADDR']))
{
$_SERVER['REMOTE_ADDR'] = ;
}
return $_SERVER['REMOTE_ADDR'];
} 

to this:
//These are set from the web page bot not from CLI

if (!isset($_SERVER['REMOTE_ADDR']))
{
$_SERVER['REMOTE_ADDR'] = ;
}
// return $_SERVER['REMOTE_ADDR'];
return $_SERVER['HTTP_X_REAL_IP'];
} 

and then a few lines below that, see this:

if (isset($_SERVER['REMOTE_ADDR']))
{
$alt_ip = $_SERVER['REMOTE_ADDR'];
} 

and below it I added this:

if ($_SERVER['REMOTE_ADDR'] == $_SERVER["SERVER_ADDR"])
{
$alt_ip = $_SERVER["HTTP_X_REAL_IP"];
} 

You may need to change $_SERVER["HTTP_X_REAL_IP"] to whatever cloudflare is passing to you, which seems to be $_SERVER['HTTP_CLIENT_IP']

Thank you Zachary. I hope your taking a liking to me because I can tell you really helped me out a lot just there.

I hope to be a strong part of this community.

Thank you so much.



I will try this. I'm fixing to release my site to the homepage so that means a lot.

[Brad Padgett]

In /core/includes/class_core.php, find this:

function fetch_ip()
{
return $_SERVER['REMOTE_ADDR'];
} 

then change to this:
function fetch_ip()

{
// return $_SERVER['REMOTE_ADDR'];
return $_SERVER['HTTP_X_REAL_IP'];
} 

and in core/vb/request.php (around line 204), I changed this:

//These are set from the web page bot not from CLI
if (!isset($_SERVER['REMOTE_ADDR']))
{
$_SERVER['REMOTE_ADDR'] = ;
}
return $_SERVER['REMOTE_ADDR'];
} 

to this:
//These are set from the web page bot not from CLI

if (!isset($_SERVER['REMOTE_ADDR']))
{
$_SERVER['REMOTE_ADDR'] = ;
}
// return $_SERVER['REMOTE_ADDR'];
return $_SERVER['HTTP_X_REAL_IP'];
} 

and then a few lines below that, see this:

if (isset($_SERVER['REMOTE_ADDR']))
{
$alt_ip = $_SERVER['REMOTE_ADDR'];
} 

and below it I added this:

if ($_SERVER['REMOTE_ADDR'] == $_SERVER["SERVER_ADDR"])
{
$alt_ip = $_SERVER["HTTP_X_REAL_IP"];
} 

You may need to change $_SERVER["HTTP_X_REAL_IP"] to whatever cloudflare is passing to you, which seems to be $_SERVER['HTTP_CLIENT_IP']

Hello Zachary,

I changed the code as you described but it left me unable to login to my forum so I had to revert the changes.

Please give me a more accurate description of what I need to change. My forum wouldn't come up when I made these changes.

I made sure that I did it correctly. I made these changes in 5.1.5 so that may be the reason for it not working.

[Wayne Luke]

What do you mean by "wouldn't come up"?

[Brad Padgett]

What do you mean by "wouldn't come up"?

The entire website was down and did not appear when I typed the web address but gave no error.

Seems to be that put the code in correctly and I tried several times. I got the site back online of course when I replaced the 2 files (request, class_core) but still left without a solution to IPs showing on my forum and stopping the login strikes problem.

Though strange enough, a few minutes ago I noticed the ips were showing with only the standard version of those 2 files in place (I had reverted the changes) so I'm not sure how that was happening, nonetheless if it doesn't continue I will need to find a solution.

If there's anything I need to know on 5.1.5 having a different code for this let me know.

Thanks!

[Wayne Luke]

The code should be the same. A blank page typically signifies a PHP error though. Pretty sure it is this line causing the error though:
$_SERVER['REMOTE_ADDR'] = ;

It should probably be:
$_SERVER['REMOTE_ADDR'] = '';

[Brad Padgett]

The code should be the same. A blank page typically signifies a PHP error though. Pretty sure it is this line causing the error though:
$_SERVER['REMOTE_ADDR'] = ;

It should probably be:
$_SERVER['REMOTE_ADDR'] = '';

Thanks for the input.

Someone on your end must have helped me already though. Cloudflare is enabled and now the everyone's ip shows without an issue.

If not, it must be something cloudflare has changed.

I will try your version of the code if I experience any further issue. Thank you for your help.