ThreeWP Activity Monitor Version 2.3
Bug 1: WordPress tried to log in ..
Some people saw already the activity WordPress tried to log in .. in their log, with an empty ?user_id= in the url.
This happens if a non-existing username is entered at login.
ThreeWP Activity Monitor does not check if the username is valid or not. It always uses property ID of $user_data object (even if object does not exist) or assumes $current_user would always exist.
Lines 566, 578:
$user_data = get_userdatabylogin( $username );
...
$this->sql_stats_increment( $user_data->ID, 'login_failure' );Lines 997, 1001, 1021, ...
global $current_user;
...
$user_id = $current_user->ID; // Convenience
...
$replacements[ '%user_login%' ] = $current_user->user_login;The code should be enhanced with error-checking to detect invalid usernames...
Bug 2: Undefined index: REMOTE_HOST
The variable $_SERVER['REMOTE_HOST'] is used without error-checking. Many servers do not support this variable, see also notes at php.net: Note: Your web server must be configured to create this variable. For example in Apache you'll need HostnameLookups On inside httpd.conf for it to exist.
Line 1017:
'%server_http_remote_host%' => $_SERVER['REMOTE_HOST'],Suggested fix:
'%server_http_remote_host%' => (isset($_SERVER['REMOTE_HOST'])) ? $_SERVER['REMOTE_HOST'] : @gethostbyaddr($_SERVER['REMOTE_ADDR']),Same problem occurs in lines 1365, etc.
http://wordpress.org/extend/plugins/threewp-activity-monitor/
