{"action":"created","issue":{"url":"https://api.github.com/repos/Arsenal21/all-in-one-wordpress-security/issues/66","repository_url":"https://api.github.com/repos/Arsenal21/all-in-one-wordpress-security","labels_url":"https://api.github.com/repos/Arsenal21/all-in-one-wordpress-security/issues/66/labels{/name}","comments_url":"https://api.github.com/repos/Arsenal21/all-in-one-wordpress-security/issues/66/comments","events_url":"https://api.github.com/repos/Arsenal21/all-in-one-wordpress-security/issues/66/events","html_url":"https://github.com/Arsenal21/all-in-one-wordpress-security/issues/66","id":189457916,"number":66,"title":"Email logins cause IP lockout if \"Instantly Lockout Invalid Usernames\" feature is active","user":{"login":"chesio","id":2021167,"avatar_url":"https://avatars.githubusercontent.com/u/2021167?v=3","gravatar_id":"","url":"https://api.github.com/users/chesio","html_url":"https://github.com/chesio","followers_url":"https://api.github.com/users/chesio/followers","following_url":"https://api.github.com/users/chesio/following{/other_user}","gists_url":"https://api.github.com/users/chesio/gists{/gist_id}","starred_url":"https://api.github.com/users/chesio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chesio/subscriptions","organizations_url":"https://api.github.com/users/chesio/orgs","repos_url":"https://api.github.com/users/chesio/repos","events_url":"https://api.github.com/users/chesio/events{/privacy}","received_events_url":"https://api.github.com/users/chesio/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-15T17:38:17Z","updated_at":"2016-11-16T06:53:54Z","closed_at":"2016-11-16T06:53:54Z","body":"WordPress 4.5 introduced an option to log with email. This is basically done via an additional `authenticate` filter, see the [changeset](https://core.trac.wordpress.org/changeset/36617/trunk/src/wp-includes/default-filters.php).\r\n\r\nAIOWPSF [replaces](https://github.com/Arsenal21/all-in-one-wordpress-security/blob/master/all-in-one-wp-security/classes/wp-security-user-login.php#L13-L14) the default `authenticate` filter to perform its login-related functions, but fails to address the new filter that authenticates username as email. Therefore, if [someone tries to log in with email](https://wordpress.org/support/topic/email-logins-cause-ip-lockouts-with-specific-aio-setting/) and \"Instantly Lockout Invalid Usernames\" feature is active, the new filter logs him in, but still a new record is added to login lockdown table, because default re-implementation only [checks](https://github.com/Arsenal21/all-in-one-wordpress-security/blob/master/all-in-one-wp-security/classes/wp-security-user-login.php#L105) `$username` against username field, not email.\r\n\r\nTo be honest, I don't like the current solution at all. I don't think the default `authenticate` filter should be replaced, it makes the implementation error prone with respect to future changes (this issue is a nice example). In my opinion, the plugin should hook before and after default authentication filters to perform its checks. If you see it the same way and are fine with a more thorough refactorization of related code, I'd be happy to work on a fix - I have some time in coming days. If you don't, then I'll probably refactor the code anyway, but I'm not going to waste my time with a pull request.\r\n\r\nBtw. several other methods in `AIOWPSecurity_User_Login` class likely need to be updated as well."},"comment":{"url":"https://api.github.com/repos/Arsenal21/all-in-one-wordpress-security/issues/comments/260868559","html_url":"https://github.com/Arsenal21/all-in-one-wordpress-security/issues/66#issuecomment-260868559","issue_url":"https://api.github.com/repos/Arsenal21/all-in-one-wordpress-security/issues/66","id":260868559,"user":{"login":"Arsenal21","id":6433635,"avatar_url":"https://avatars.githubusercontent.com/u/6433635?v=3","gravatar_id":"","url":"https://api.github.com/users/Arsenal21","html_url":"https://github.com/Arsenal21","followers_url":"https://api.github.com/users/Arsenal21/followers","following_url":"https://api.github.com/users/Arsenal21/following{/other_user}","gists_url":"https://api.github.com/users/Arsenal21/gists{/gist_id}","starred_url":"https://api.github.com/users/Arsenal21/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Arsenal21/subscriptions","organizations_url":"https://api.github.com/users/Arsenal21/orgs","repos_url":"https://api.github.com/users/Arsenal21/repos","events_url":"https://api.github.com/users/Arsenal21/events{/privacy}","received_events_url":"https://api.github.com/users/Arsenal21/received_events","type":"User","site_admin":false},"created_at":"2016-11-16T06:53:54Z","updated_at":"2016-11-16T06:53:54Z","body":"The new version of the plugin has a fix for this."}}
{"actor":{"display_login":"Arsenal21"}}