{"action":"created","issue":{"url":"https://api.github.com/repos/jpkleemans/Brute-Force-Login-Protection/issues/4","repository_url":"https://api.github.com/repos/jpkleemans/Brute-Force-Login-Protection","labels_url":"https://api.github.com/repos/jpkleemans/Brute-Force-Login-Protection/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/jpkleemans/Brute-Force-Login-Protection/issues/4/comments","events_url":"https://api.github.com/repos/jpkleemans/Brute-Force-Login-Protection/issues/4/events","html_url":"https://github.com/jpkleemans/Brute-Force-Login-Protection/issues/4","id":120411773,"number":4,"title":".htaccess - FilesMatch was not closed","user":{"login":"wcc-neal","id":13148450,"avatar_url":"https://avatars.githubusercontent.com/u/13148450?v=3","gravatar_id":"","url":"https://api.github.com/users/wcc-neal","html_url":"https://github.com/wcc-neal","followers_url":"https://api.github.com/users/wcc-neal/followers","following_url":"https://api.github.com/users/wcc-neal/following{/other_user}","gists_url":"https://api.github.com/users/wcc-neal/gists{/gist_id}","starred_url":"https://api.github.com/users/wcc-neal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wcc-neal/subscriptions","organizations_url":"https://api.github.com/users/wcc-neal/orgs","repos_url":"https://api.github.com/users/wcc-neal/repos","events_url":"https://api.github.com/users/wcc-neal/events{/privacy}","received_events_url":"https://api.github.com/users/wcc-neal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-12-04T14:26:42Z","updated_at":"2016-02-22T09:12:45Z","closed_at":null,"body":"Bug:\r\n===\r\nSaving the plugin settings creates an invalid .htaccess file, resulting in a 500 server error for all future requests to the domain.\r\n\r\nSteps to Reproduce:\r\n---\r\n1. Use a WordPress install that hasn't had the Brute Force Login Protection (BFLP) plugin installed.\r\n2. Install the BFLP plugin\r\n3. Use the WordPress plugin interface to activate BFLP\r\n4.  Observe that the .htaccesss has the following lines added:\r\n\r\n.\r\n        # BEGIN Brute Force Login Protection\r\n        <&lt;FilesMatch \"\">&gt;\r\n        order deny,allow\r\n        <&lt;/FilesMatch>&gt;\r\n        # END Brute Force Login Protection\r\n5. in WordPress, go to Settings ->&gt; Brute Force Login Protection, and change the max number of login attempts (ex: to 12). Click Save.\r\n\r\nExpected Behaviour:\r\n-----\r\nThe settings are updated correctly, and the plugin and site continues to function, with a max number of logins set to 12.\r\n\r\nActual Behaviour:\r\n----------\r\n6. See a Server Error 500 page.\r\n7. Observe that the Apache error log states:\r\n\r\n.\r\n        [alert] [client 192.168.56.1] /var/www/.htaccess: /var/www/.htaccess:47: <&lt;FilesMatch>&gt; was not closed., referer: http://ubuntu.dev/wordpress/wp-admin/options-general.php?page=brute-force-login-protection&settings-updated=true\r\n8. Observe in .htaccess:\r\n\r\n.\r\n    # BEGIN Brute Force Login Protection\r\n    <&lt;FilesMatch \".*\\.(php|html?|css|js|jpe?g|png|gif)$\">&gt;\r\n        order deny,allow\r\n    <&lt;FilesMatch \"\">&gt;\r\n    <&lt;/FilesMatch>&gt;\r\n    # END Brute Force Login Protection\r\n9. All further http requests result in a 500 server error.\r\n\r\n\r\nDebugging I've performed:\r\n-----\r\n1. Observed that within Htaccess->&gt;setFilesMatch, the results of getLines(false, true) contains a single line: \r\n\r\n.\r\n        <&lt;FilesMatch \"\">&gt;\r\n2. Observed that when the .htaccess is updated after the first time, during the getHeader() call, $this->&gt;filesMatch equals  '.*\\.(php|html?|css|js|jpe?g|png|gif)$' (the default)\r\n3. Observed that when the plugin is activited, and htaccess->&gt;uncommentLines(); is called, htaccess->&gt;filesMatch is still empty.\r\n\r\nConclusion drawn:\r\n-----\r\nThe first time the .htaccess file is amended to add the BFLP rules, htaccess->&gt;setFilesMatch() has not been called, and so the FilesMatch directive is given an empty pattern, which causes subsequent updates to fail.\r\n\r\nSuggested Fix:\r\n-----\r\n1. In the activate() method, add a call to $this->&gt;setProtectedFiles();\r\n\r\nI could create a pull request if you like, but it's only a one-line fix:\r\n        /**\r\n        * Called When the plugin is activated\r\n        * \r\n        * @return boolean\r\n        */\r\n        public function activate()\r\n        {\r\n            $this->&gt;setHtaccessPath();\r\n            $this->&gt;setProtectedFiles();\r\n            $this->&gt;htaccess->&gt;uncommentLines();\r\n        }\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/jpkleemans/Brute-Force-Login-Protection/issues/comments/187082643","html_url":"https://github.com/jpkleemans/Brute-Force-Login-Protection/issues/4#issuecomment-187082643","issue_url":"https://api.github.com/repos/jpkleemans/Brute-Force-Login-Protection/issues/4","id":187082643,"user":{"login":"wcc-neal","id":13148450,"avatar_url":"https://avatars.githubusercontent.com/u/13148450?v=3","gravatar_id":"","url":"https://api.github.com/users/wcc-neal","html_url":"https://github.com/wcc-neal","followers_url":"https://api.github.com/users/wcc-neal/followers","following_url":"https://api.github.com/users/wcc-neal/following{/other_user}","gists_url":"https://api.github.com/users/wcc-neal/gists{/gist_id}","starred_url":"https://api.github.com/users/wcc-neal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wcc-neal/subscriptions","organizations_url":"https://api.github.com/users/wcc-neal/orgs","repos_url":"https://api.github.com/users/wcc-neal/repos","events_url":"https://api.github.com/users/wcc-neal/events{/privacy}","received_events_url":"https://api.github.com/users/wcc-neal/received_events","type":"User","site_admin":false},"created_at":"2016-02-22T09:12:45Z","updated_at":"2016-02-22T09:12:45Z","body":"Looks like I closed this issue a bit prematurely, since the fix hasn't been implemented yet."}}