• Resolved Adam Hulyksmith

    (@adamboxcarstudio)


    This issue took me a bit to figure out. The asenha_failed_logins table defines request_uri varchar(24), which is too short for logins on WP Engine. On WP Engine, every login POST is required to include ?wpe-login=true, making the actual request URI over 29+ characters which ends up being over the db limit before any other query args are even added. $wpdb->insert() in log_failed_login() silently fails on the length mismatch (returns false, no error surfaced anywhere) so no rows ever get logged, and since the lockout logic reads from this same table, lockouts never trigger either. The module looks “on” but provides zero real protection, with nothing in the UI to indicate anything’s wrong.

    I “fixed” this temporarily on a few of our sites by modifying the column with Alter Table wp_asenha_failed_logins MODIFY request_uri varchar(255). I also noticed that the ASE field for username is set to varchar(24) which could also be an issue as WP usernames can be up to 60 characters and would hit the same silent failure.

    Also it would be great if log_failed_login() dropped something in the error logs when it faild so this kind of thing is easier to track down in the future.

    I tested all this on version 9.0.0.

Viewing 1 replies (of 1 total)
  • Plugin Author Bowo

    (@qriouslad)

    @adamboxcarstudio thank you for reporting this. Good catch. In the next release, scheduled for next Monday, request_uri and username columns will be changed to varchar(255) with defensive truncation at write time. Error logging will also be performed when WP_DEBUG is true.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.