View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 6004 | Composr alpha bug reports | securitylogging | public | 2024-10-12 03:39 | 2024-10-12 03:42 |
| Reporter | PDStig | Assigned To | PDStig | ||
| Priority | high | Severity | feature | ||
| Status | resolved | Resolution | fixed | ||
| Summary | 6004: Change security risk percentage to risk score + other improvements | ||||
| Description | This hotfix applies the following changes: * Change risk percentages in security logging / hackattack table to risk score; divide all current percentages by 10 to convert to scores (done when the module is upgraded) * Do not divide the sum of risk scores by 100 anymore when comparing to the threshold of banning; compare as-is * Hack-attack ban threshold renamed to Hack-attack risk score ban threshold (the actual internal name is the same); multiply current value by 10 when the security module is upgraded since we are no longer dividing the sum of scores by 100 when comparing against this value * advanced_banning.xml now defines all hack-attack codenames with some default risk scores based on severity. That way, users can easily configure them as they desire. * admin_lookup now shows the total risk score of each IP address listed for quick glancing at how close an IP is to getting auto-banned (or just general security assessment) * Security logging page lists security incidents first, failed logins second, as hack attacks are usually a more severe issue and demand more immediate attention. * Tables on security logging limited to 25 records per page opposed to previous 50 * Security logging page now lists all security incidences with at least a 1 risk score (it is implied based on wording in text that a user should be able to see all of them, not just ones that were, for example, >= 80. * Security incidents table can now be sorted by risk score. This is pretty important to be able to see the most critical issues first; not sure why this wasn't done before. * A small bug was fixed on the admin_lookup page where ipv6 lookups would have the title "by username" instead of "by IP address"... and there was a missing title case for e-mail addresses. | ||||
| Tags | Roadmap: v11 | ||||
| Attach Tags | |||||
| Attached Files | |||||
| Sponsorship open | |||||
|
|
Fixed in Git commit cefe58f034 (https://gitlab.com/composr-foundation/composr/commit/cefe58f034 - link will become active once code pushed to GitLab) |
|
|
A hotfix (a TAR of files to upload) has been uploaded to this issue. Only apply this hotfix if you absolutely need it and cannot wait until the next release of Composr (releases are more reliable and strictly tested). As of Composr version 11, the recommended way to apply a hotfix is by following the same steps as an upgrade (https://baseurl/upgrader.php, use the hotfix on the step “Transfer across new/updated files”). The upgrader will automatically skip files belonging to addons you do not have installed or that are newer on disk than in the hotfix. Otherwise, you can manually extract and replace these files (do not replace if your on-disk file is newer than the one in the hotfix). Always take backups of your site or at least files you are replacing before applying a hotfix. Not sure how to extract TAR files to your Windows computer? Try 7-zip (http://www.7-zip.org/). |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-10-12 03:42 | PDStig | Tag Attached: Roadmap: v11 |
