[DragonByte Tech]

vBSecurity v2.2.2

New Features:

"Failed Logons" Watcher

• Option to send an alert to the user whose account has been triggered

Changed Features:

• "Failed Mass Logons" now only triggers if the user tries unique usernames

Bug Fixes:

• The "Failed Mass Non-Existent Logons" rule sets would not trigger correctly, instead the "Failed Mass Logons" ruleset was used

Fillip

[DragonByte Tech]

vBSecurity v2.2.3

New Features:

CLI Maintenance Script

• Ability to execute either of the two maintenance actions via the command line

Search IP Addresses: Find Potential Intruder IP Addresses

• Displays a list of IP addresses who have failed to login to valid member accounts more than once
• Also displays any successful logins from these IP addresses

Bug Fixes:

• A few phrases were accidentally created with the wrong phrase key, leading to blank emails being sent in some scenarios
• The "Password Rules" checkboxes would not update if the user pasted their password via the right click menu

vBSecurity v2.2.4

Changed Features:

Password Reset

• The created password is now based on the user’s password rule requirements
• The Mass Password Reset action now creates a random password based on the user’s password rule requirements

Fillip

[Darkside2012]

I can´t loging with my account on dragonbyte-tech.com
My password is. expired
I recive the email : New Account Access From xxx.xxx.xxx.xxx
If you recognise this IP address and would like to add it to the whitelist, please click here
but when i click the link nothing will be happen.
It is the same ......
i can´t edit my password

[DragonByte Tech]

Originally Posted by Darkside2012

I can´t loging with my account on dragonbyte-tech.com

Try it now, you should be able to confirm the IP before being asked for a new password now


Fillip

[rhody401]

I think I found a bug or conflict in version 2.2.4 lite

If a user tries to reset their lost password, they get the email from VB and click the link. But when clicked, it gives either a blank white page or sometimes an error 500.

If I disable this script, everything works well again. I can reproduce this reliably by enabling or disabling version 2.2.4

My info:
VB 4.2.3 pl2
Server Litespeed
PHP 5.5.38
MySQL 10.0.25-MariaDB-cll-lve

If you need anything else to help fix it, let me know.

Thanks
Mike

[DragonByte Tech]

You will need to check your error log for the real reason behind a 500 Internal Server Error.


Fillip

[civicf]

I have similar problem. User can't reset password. Error message was displayed after clik on reset link.

PHP Warning: require(........dbtech....vbsecurity_pro....hooks....reset_password.php): failed to open stream: No such file or directory in ....login.php(329) : eval()'d code on line 1

Fatal error: require(): Failed opening required '//dbtech/vbsecurity_pro/hooks/reset_password.php' (include_path='.:/usr/local/php/pear5') in /login.php(329) : eval()'d code on line 1

When I downgraded to 2.2.0 everything is ok.

[rhody401]

I had to disable it didnt have time to debug this time, but will re install next version.

[DragonByte Tech]

Originally Posted by civicf

I have similar problem. User can't reset password. Error message was displayed after clik on reset link.



When I downgraded to 2.2.0 everything is ok.

Sorry about that, I've updated the zip file with a fixed XML file


Fillip

[DragonByte Tech]

vBSecurity v3.3.0:
Feature: New option: Enable Account Breach Check
Feature: New option: Account Breach Check: Check Username

This mod has been updated to be brought in line with the XenForo version.


Fillip

[SteveG63]

I updated this today (overwriting the old install) without realizing that I needed PHP Ver 5.6. I have PHP 5.3.29. Can I get the latest version that works with 5.3.29 please?



Thanks.

[highlander29]

I'm really impressed with some of the features in the new version of this modification. Thanks for all the good work.

I notice you included instructions for using bcrypt for passwords. Do those instructions re-encrypt the entire password database? This is a huge issue that I've been concerned about for some time. I also would like to ask the impact of forum upgrades - so if you deploy it in 4.2.5 and then upgrade to 4.2.6, do you need to make those changes again?

[DragonByte Tech]

Originally Posted by highlander29

I'm really impressed with some of the features in the new version of this modification. Thanks for all the good work.

I notice you included instructions for using bcrypt for passwords. Do those instructions re-encrypt the entire password database? This is a huge issue that I've been concerned about for some time. I also would like to ask the impact of forum upgrades - so if you deploy it in 4.2.5 and then upgrade to 4.2.6, do you need to make those changes again?

Any file modifications will need to be reapplied in the event of a forum upgrade. Running the BCrypt action in the AdminCP does add additional BCrypt hashing to passwords in the database, yes.


Fillip

[DragonByte Tech]

The download package has been updated to address a minor security vulnerability that could allow an attacker to inject code for their own user only (not other users) when viewing their currently active login sessions.

This vulnerability cannot be used to exploit your forum, this is not a critical vulnerability.


Fillip

[brandon515]

If I do a mass password reset for all of my users, will they get an email saying that their password was reset? If so, can I customize that email?

Thanks