diff --git a/phpBB/login.php b/phpBB/login.php index c8a572d7a9..6008525cb4 100644 --- a/phpBB/login.php +++ b/phpBB/login.php @@ -82,7 +82,7 @@ if( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) || isset($ // Check to see if user is allowed to login again... if his tries are exceeded if ($row['user_last_login_try'] && $board_config['login_reset_time'] && $board_config['max_login_attempts'] && - $row['user_last_login_try'] >= (time() - ($board_config['login_reset_time'] * 60)) && $row['user_login_tries'] >= $board_config['max_login_attempts']) + $row['user_last_login_try'] >= (time() - ($board_config['login_reset_time'] * 60)) && $row['user_login_tries'] >= $board_config['max_login_attempts'] && $userdata['user_level'] == ADMIN) { message_die(GENERAL_MESSAGE, sprintf($lang['Login_attempts_exceeded'], $board_config['max_login_attempts'], $board_config['login_reset_time'])); } @@ -107,7 +107,8 @@ if( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) || isset($ message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__); } } - else + // Only store a failed login attempt for an active user - inactive users can't login even with a correct password + elseif( $row['user_active'] ) { // Save login tries and last login if ($row['user_id'] != ANONYMOUS)