Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.
Latest post by nicholas on Thursday, 31 August 2023 04:52 CDT
Is there any way to show the attempted Username in the "loginfailure" email if the user forgets the password but gets the Username correctly?
I would like to be proactive helping my Users get signed into my website if they've just forgotten their password. I can search the USERS menu item in the backend for that specific User if I know the attempted Username.
Yes, you can log the username.
Components, Admin Tools for Joomla!, Web Application Firewall, Configure WAF, Hardening Options tab.
Set Log Usernames to Yes.
Click on Save & Close.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
Nicholas:
The "Set Log Usernames to Yes." option was already set but they aren't being display in the emails. And, I've got a line in the "Admin Tools: Blocked request" template for these fields:
IP Address: {IP} (IP Lookup: {LOOKUP})
Reason: {REASON}
Attempted UserID: {USER}
Do I need to put in a "UA" field?
I looked in the WAF Blocked Request Log and the Usernames are not showing there even though I have "Set Log Usernames to Yes" as you instructed. I must have something wrong or a conflict. See attached for my Block Request Log
When there is a login failure reported by Joomla (it calls the plugin event onUserLoginFailure) we collect the IP address from the request variable username. This will be displayed in the email you receive next to the blocking reason. That is to say, it would look like that (that's from a real email I received testing this just now):
Reason: Login failure (Username: nicholas)
However, please remember that Joomla will call the plugin event onUserLoginFailure when any login attempt fails, not just when an interactive login fails. For example, this will be issued when the Remember Me plugin fails to log the user into the site, or when a third party authentication plugin fails to authenticate the user. In those cases there will be no request variable called username, therefore no username will be logged.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.
Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!