• Started getting this error this morning: “This webpage has a redirect loop” when trying to login to my site. I erased the login-lock folder in my plugins directory and that fixed the issue. Just curious to know if anyone has seen this issue before with this plugin. I really like this plugin and would love to continue to use it.

    A little more background: I started getting the error randomly this morning. The plugin has worked fine up until this morning. It was the latest version of this plugin.

    Cheers!

    http://wordpress.org/extend/plugins/login-lock/

Viewing 14 replies - 16 through 29 (of 29 total)
  • Could everybody who didn’t report on the Compatibility box of this plugin that it is broken, please do so?

    Thanks 🙂

    I have run into this problem too many times on multiple wordpress installs, I have disabled this plugin.

    Also very surprised a website dedicated to security would let their SSL certificate expire.

    Amen, Douglas! I emailed them about that months ago and still no fix.

    Hi Everyone,

    I had to fix this recently for a client. The problem seems to be occurring because the plugin is trying to include wp-login.php in order to render the password reset box. There’s a redirect at the top of wp-login.php, so potentially once the redirect occurs the plugin is triggered again and therefore calls the wp-login.php file once more…

    This is just a theory, it might even be occurring later on in wp-login.php, but the point is, to fix it, I went into the [wordpress-root-folder]/wp-content/plugins/login-lock/loginlock.php and replaced the function ‘ll_login_header’ (starts on line 41) with the one below. Most of the code is already in the function but it’s commented out, though it works:

    function ll_login_header($title = 'Log In', $message = '', $wp_error = '') {
    		global $error, $is_iphone, $interim_login, $current_site;
    
    		/*if ( !function_exists( 'login_header' ) ) {
    
    			ob_start();
    			require_once( ABSPATH . '/wp-login.php' );
    			ob_end_clean(); 
    
    		}
    
    		login_header( $title, $message, $wp_error );*/
    
    		add_filter( 'pre_option_blog_public', '__return_zero' );
    		add_action( 'login_head', 'noindex' );
    
    		if ( empty($wp_error) )
    			$wp_error = new WP_Error();
    
    		$shake_error_codes = array( 'empty_password', 'empty_email', 'invalid_email', 'invalidcombo', 'empty_username', 'invalid_username', 'incorrect_password' );
    		$shake_error_codes = apply_filters( 'shake_error_codes', $shake_error_codes );
    
    		if ( $shake_error_codes && $wp_error->get_error_code() && in_array( $wp_error->get_error_code(), $shake_error_codes ) )
    			add_action( 'login_head', 'wp_shake_js', 12 );
    
    		?>
    
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
    <head>
    	<title><?php bloginfo('name'); ?> › <?php echo $title; ?></title>
    	<meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
    <?php
    	wp_admin_css( 'login', true );
    	wp_admin_css( 'colors-fresh', true );
    
    	if ( $is_iphone ) { ?>
    	<meta name="viewport" content="width=320; initial-scale=0.9; maximum-scale=1.0; user-scalable=0;" />
    	<style type="text/css" media="screen">
    	form { margin-left: 0px; }
    	#login { margin-top: 20px; }
    	</style>
    <?php
    	} elseif ( isset($interim_login) && $interim_login ) { ?>
    	<style type="text/css" media="all">
    	.login #login { margin: 20px auto; }
    	</style>
    <?php
    	}
    
    	do_action( 'login_enqueue_scripts' );
    	do_action( 'login_head' ); ?>
    </head>
    	<body class="login">
    	<?php   if ( !is_multisite() ) { ?>
    	<div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', 'http://wordpress.org/'); ?>" title="<?php echo apply_filters('login_head
    	ertitle', esc_attr__('Powered by WordPress')); ?>"><?php bloginfo('name'); ?></a></h1>
    	<?php   } else { ?>
    	<div id="login"><h1><a href="<?php echo apply_filters('login_headerurl', network_home_url() ); ?>" title="<?php echo apply_filters('login_headertitle', esc_attr($current_site->site_name) ); ?>"><span class="hide"><?php bloginfo('name'); ?></span></a></h1>
    	<?php   }
    
    		$message = apply_filters('login_message', $message);
    		if ( !empty( $message ) ) echo $message . "\n";
    
    		// Incase a plugin uses $error rather than the $errors object
    		if ( !empty( $error ) ) {
    			$wp_error->add('error', $error);
    			unset($error);
    		}
    
    		if ( $wp_error->get_error_code() ) {
    			$errors = '';
    			$messages = '';
    			foreach ( $wp_error->get_error_codes() as $code ) {
    				$severity = $wp_error->get_error_data($code);
    				foreach ( $wp_error->get_error_messages($code) as $error ) {
    					if ( 'message' == $severity )
    						$messages .= '  ' . $error . "<br />\n";
    					else
    						$errors .= '    ' . $error . "<br />\n";
    				}
    			}
    			if ( !empty($errors) )
    				echo '<div id="login_error">' . apply_filters('login_errors', $errors) . "</div>\n";
    			if ( !empty($messages) )
    				echo '<p class="message">' . apply_filters('login_messages', $messages) . "</p>\n";
    		}

    nixonvs:

    Funny thing is there’s a link to donate to the site on my page. Yeah, right. It’s gotta work to get my money (and I DO donate to some that work well).

    Let alone sticking a donation link onto end users’ websites, particularly without asking or providing a way to opt out, is tacky. When I tried to improve this plugin by contributing patches, the developer was put off by my taking those links out.

    So instead of forking and giving back, it was clear I needed to make a whole new plugin: Login Security Solution. It’s solid, has unit tests and a far better feature set.

    –Dan

    Let alone sticking a donation link onto end users’ websites, particularly without asking or providing a way to opt out, is tacky

    I’ve asked for the plugin to be investigated.

    Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    It’s not a donation link, that I can see, but a credit link on the login page. Which should be removed and made optional (it’s borderline ‘front facing’ but enough that it’s shady)

    Woah! Seems that investigation got the plugin yanked. Going to http://wordpress.org/extend/plugins/login-lock/ produces “Whoops! We couldn’t find that plugin…”

    Dan:

    Nice work with the plugin, after seeing your post I checked it out. I’ll be recommending my client switches to using Login Security Solution. It’s a pain being stuck with a plugin that’s no longer maintained.

    Thanks

    And good for us. It just goes to show you don’t have to raise a lot of hell to make a point. Just speak up.

    Even if a plugin is free, if it’s not maintained it’s not worth the platform it’s built on!

    Interesting result. Maybe this is a discussion for another part of the forum but I have been thinking about the ongoing support for plugins. A once great and maintained plugin that just rots. I wouldn’t have known it was dud unless I consulted here, seems potentially dangerous. Consider the case of a person writing a good and useful app, then once uptake is sufficient introducing a bug that allows hackers to own your website. To me it’s a case of when not if. I have a bad feeling about the long term future of WordPress from a security perspective. This plugin is a good example.

    Any way glad to see the plugin pulled and will investigate the alternate plugin to see if it is a workable alternative, I will report any bugs or questions there.

    I had to use ManageWP to remove Login Lock from the sites I manage. Sorry to see I wasn’t alone.

    Plugin Author Mark

    (@wpsec)

    A couple of points here:

    – The plugin put a link on the login page so that admins can find help when they lock themselves out of their site. Simple as that. This was BY REQUEST from plugin users.

    – To our knowledge no one ever contact us from WordPress.org regarding the link on the login page. Had they done so we could have readily explained that users ASKED for it – and of course we could remove it had anyone in authority asked us to do so.

    – We stopped supporting Login Lock some time ago because demand was high and “thanks” was nearly non-existent. A typical scenario is where someone calls our toll free number and says “Hi, I use your Login Lock plugin. Someone hacked my site. How soon can you clean it up?” – multiply that times many per month, with 99% of callers having zero funds to spend on clean up. Nevertheless, we cleaned up many, many sites for free. We can no longer do that.

    – Anyone is, and always has been, free to modify our GPL code anyway they see fit.

    – We let the SSL cert go on the site because as you may notice the site is now empty…

    – Apologies that we can’t continue providing people free support. It got to the point where it took to much time, which obviously distracts from earning money to get the bills paid.

    So sorry to hear that Mark, this is fantastic plugin. Please consider making this a premium plugin. I would gladly pay for this plugin to support your efforts.

Viewing 14 replies - 16 through 29 (of 29 total)
  • The topic ‘[Plugin: Login Lock] Getting error: This webpage has a redirect loop’ is closed to new replies.