From 82fff329a4bb1d44e0e3a8219e9e4fb27f93f5ab Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 1 Oct 2026 12:46:58 +0200 Subject: [PATCH] =?UTF-8?q?wger:=20a=20stranger=20locks=20only=20the=20nam?= =?UTF-8?q?e=20they=20try,=20for=205=20min=20=E2=80=94=20not=20every=20hou?= =?UTF-8?q?sehold=20member=20for=2030=20(R-752,=2009=20decision=2058=20?= =?UTF-8?q?=E2=80=94=20decided=20by=20CC=20unattended,=20operator=20may=20?= =?UTF-8?q?reverse)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit django-axes keyed on ip_address, and behind the tunnel every visitor has the tunnel container's address (R-753). Measured on 9202 (felhom.eu/documentation/audits/lockouts-2026-10-01/B/): live template — 10 wrong tries on admin locked the second member too; with AXES_LOCKOUT_PARAMETERS=username, AXES_COOLOFF_TIME=5 and the database handler — the second member unaffected, admin in again at 7.5 min after one retry during the lock, a wrong password still refused. Settings only: no image moves, no ladder entry (gates OK). Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- templates/wger/docker-compose.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/templates/wger/docker-compose.yml b/templates/wger/docker-compose.yml index 2bc88c0..e73cd9f 100644 --- a/templates/wger/docker-compose.yml +++ b/templates/wger/docker-compose.yml @@ -44,6 +44,14 @@ services: # R-738: the image runs `manage.py migrate` at start ONLY with this switch (entrypoint.sh). Without it an update # that brings migrations leaves wger serving its front page over an unmigrated database (login 500). - DJANGO_PERFORM_MIGRATIONS=True + # R-752 (decided by CC unattended 2026-10-01, `09` §3 decision 58 — operator may reverse): django-axes locked by + # ip_address, and behind the tunnel every visitor has the tunnel's address (R-753) — a stranger's 10 wrong tries + # locked out EVERY household member for 30 min. Now only the targeted name, for 5 min (each try during a lock + # restarts it — wger 2.7 hard-codes that — so short is kinder), counted in the database (the default cache + # handler warns axes.W001). Measured on 9202: the other member unaffected; the targeted one in again at 7.5 min. + - AXES_LOCKOUT_PARAMETERS=username + - AXES_COOLOFF_TIME=5 + - AXES_HANDLER=axes.handlers.database.AxesDatabaseHandler - DJANGO_DB_ENGINE=django.db.backends.sqlite3 - DJANGO_DB_DATABASE=/home/wger/db/database.sqlite - DJANGO_DB_USER=wger