EXT: Improved Login¶

BE user FE all group¶

This feature allows a backend user (who has to be logged in) to see all pages in the frontend – even if they are restricted to different user groups. So far the user had to simulate one group after another – now, he sees them all right from the beginning.

This is very useful for administrators and backend users who are allowed to see all pages. Please note that this extension should be disabled if you have backend users which have access restrictions (i.e. a user in project X has BE restriced access to the pages belonging to project X. The pages are also access restriced in the frontend. With the feature turned on, the user would also see project z in the frontend!)

Domain and IP blacklist/whitelist¶

If you need to ban FE user login from specific domains or IP's (i.e someone tried to guess users's passwords) then you can use this feature.

The IP blacklist/whitelist allows the * as wildcard for IP Ranges, the domain blacklist/whitelist doesn't.

A whitelist entry overrules a blacklist entry!

Login logging¶

Each login attempt will be logged. The log doesn't only store success/failed information, it also stores the IP address and a login note if the IP was on the blacklist/whitelist. The log can be viewed in the backend and the entries can be exported as csv. In the log viewer you ca also select “inactive” users which only covers FE users who never attempted a login.

A limit for failed logins can be set after which a list of administrators is informed by e-mail. Another limit can be set that will disable the account after a number of failed logins.

Note : If a login fails for any reason the user doesn't get informed why the login failed! If someone tries to break into to system via password guessing (or a former employee who might want to damage something) he doesn't know why he fails. If they want to guess passwords all night long let them – after 5 (default) failures we don't care anymore since the user is locked anyway. The only threat in the disable feature: a person who knows the usernames can lock them all down (but then we still got his/hers IP). If a valid user fails the login for a couple of times he will call the admin anyway and he can take a look into the log (maybe the user was accidentally on the blacklist by IP range)

Note for the cleanup tool : The cleanup tool allows you to delete log entries older then a specified period. If you do the clean up please be aware that any information about “successful” or “unsuccessful” attempts also get deleted – which can result in incorrect display of “inactive users”. Example: If you delete log entries older then 1 month then every user that hasn't tried to login within the last month will be shown as “inactive”.

Redirect after login¶

This feature is not used anymore because the “felogin” handles this very good

Update¶

Version 2.0.0 of this extension is compatible to version 1.2.4 with this exceptions:

Of course felogin is now used instead of newloginbox. Update your login content elements and delete the newloginbox extension.

The field for the “ redirect on login ” in the fe_groups table, which was added in the earlier versions, does not exist anymore. Instead of it the according field from the felogin extension is used. So before you upgrade the extension, check your fe_groups table and move the data to the field belonging to the felogin extension.

Formerly there has been a Page TS option to define the login page. Now this configuration is located within the extension manager [ loginPid ]. If you have ever used this option, make sure to enter the right page ID. You can delete the Page TS option

Configuration¶

Step 1 : install and configure the felogin extension

Step 2 : install the beko_improved_login extension

After you installed the extension go to the Extension Manager and click on the extension. The next page shows you the following configuration:

plugin.tx_felogin_pi1._LOCAL_LANG.default {
        email_subject_inform = - FE User exceeded max. failed logins.
       email_subject_lock = - FE User locked due to failed logins.
    email_text (
Dear Administrator,
The user ###username### has made ###failurecount### login failures and exceeded the limit of ###maxfailures###.
      )
    email_text_lock = The user also exceeded the locking limit of ###maxfailures_lock### and the account will
                  be set to hidden.
}
plugin.tx_felogin_pi1._LOCAL_LANG.de {
  email_subject_inform = - zuviele fehlgeschlagene Loginversuche (FE User)
    email_subject_lock = - FE User gesperrt wegen zuvielen fehlgeschlagenen Logins
    email_text (
Sehr geehrter Administrator,
Der User ###username### hat ###failurecount### erfolglose Einlogversuche unternommen und damit das limit von ###maxfailures### ueberschritten.
    )
    email_text_lock = Der User hat auch das Account Sperr Limit von ###maxfailures_lock### ueberschritten und wird                  somit gesperrt (auf hidden gesetzt).
}

Tutorial¶

Enabling/Disabling the BE User FE all group function

All other features of this extension are as easy configurable as the BE user FE All groups.