starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-31068 (published 2022-06-28T18:15Z)

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Alexandre Delaunay
author_date: 2022-06-28 12:20:43+02:00
msg: Merge pull request from GHSA-g4hm-6vfr-q3wg
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: inventory.php
change_type: ModificationType.MODIFY
diff: @@ -44,6 +44,7 @@ $inventory_request->handleHeaders();
 
 $handle = true;
 if (isset($_GET['refused'])) {
+    Session::checkRight("config", READ);
     $refused = new RefusedEquipment();
     if ($refused->getFromDB($_GET['refused']) && ($inventory_file = $refused->getInventoryFileName()) !== null) {
         $contents = file_get_contents($inventory_file);

programming_language: PHP
CVE-2016-4797 (published 2017-02-03T16:59Z)

Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (application crash) via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/uclouvain/openjpeg
commit_details: repo_url: https://github.com/uclouvain/openjpeg
author: mayeut
author_date: 2016-05-08 18:40:12+02:00
msg: Fix division by zero

Fix uclouvain/openjpeg#733
repository: repo_url: https://github.com/uclouvain/openjpeg
repo_name: uclouvain/openjpeg
description: Official repository of the OpenJPEG project
repo_language: C
owner: uclouvain
file_changes: filename: tcd.c
change_type: ModificationType.MODIFY
diff: @@ -720,7 +720,8 @@ static INLINE OPJ_BOOL opj_tcd_init_tile(opj_tcd_t *p_tcd, OPJ_UINT32 p_tile_no,
 		
 		/* compute l_data_size with overflow check */
 		l_data_size = (OPJ_UINT32)(l_tilec->x1 - l_tilec->x0);
-		if ((((OPJ_UINT32)-1) / l_data_size) < (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0)) {
+		/* issue 733, l_data_size == 0U, probably something wrong should be checked before getting here */
+		if ((l_data_size > 0U) && ((((OPJ_UINT32)-1) / l_data_size) < (OPJ_UINT32)(l_tilec->y1 - l_tilec->y0))) {
 			opj_event_msg(manager, EVT_ERROR, "Not enough memory for tile data\n");
 			return OPJ_FALSE;
 		}

programming_language: C
filename: test_suite.ctest.in
change_type: ModificationType.MODIFY
diff: @@ -557,3 +557,5 @@ opj_decompress -i @INPUT_NR_PATH@/basn6a08.jp2 -o @TEMP_PATH@/basn6a08_tif-15.ti
 !opj_decompress -i @INPUT_NR_PATH@/issue725.jp2 -o @TEMP_PATH@/issue725.png
 # issue 726
 opj_decompress -i @INPUT_NR_PATH@/issue726.j2k -o @TEMP_PATH@/issue726.png
+# issue 733
+!opj_decompress -i @INPUT_NR_PATH@/issue733.jp2 -o @TEMP_PATH@/issue733.png

programming_language: Shell
CVE-2016-2543 (published 2016-04-27T17:59Z)

The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.

Severity: MEDIUM
CVSS v2 base score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 6.2, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Takashi Iwai
author_date: 2016-01-12 12:38:02+01:00
msg: ALSA: seq: Fix missing NULL check at remove_events ioctl

snd_seq_ioctl_remove_events() calls snd_seq_fifo_clear()
unconditionally even if there is no FIFO assigned, and this leads to
an Oops due to NULL dereference.  The fix is just to add a proper NULL
check.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: seq_clientmgr.c
change_type: ModificationType.MODIFY
diff: @@ -1962,7 +1962,7 @@ static int snd_seq_ioctl_remove_events(struct snd_seq_client *client,
 		 * No restrictions so for a user client we can clear
 		 * the whole fifo
 		 */
-		if (client->type == USER_CLIENT)
+		if (client->type == USER_CLIENT && client->data.user.fifo)
 			snd_seq_fifo_clear(client->data.user.fifo);
 	}
 

programming_language: C
CVE-2023-40022 (published 2023-08-24T23:15Z)

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/rizinorg/rz-libdemangle
commit_details: repo_url: https://github.com/rizinorg/rz-libdemangle
author: Giovanni
author_date: 2023-08-13 16:04:28+08:00
msg: [gnuv2] Fix multiplication overflow check due compiler optimizations (#54)

Vulnerability found by @ifyGecko
repository: repo_url: https://github.com/rizinorg/rz-libdemangle
repo_name: rizinorg/rz-libdemangle
description: Rizin Library to demangle symbols
repo_language: C
owner: rizinorg
file_changes: filename: cplus-dem.c
change_type: ModificationType.MODIFY
diff: @@ -420,7 +420,10 @@ static int
 	consume_count(type)
 		const char **type;
 {
-	int count = 0;
+	// Note by RizinOrg:
+	// to prevent the overflow check to be optimized out
+	// by the compiler, this variable needs to be volatile.
+	volatile int count = 0;
 
 	if (!isdigit((unsigned char)**type))
 		return -1;

programming_language: C
filename: test_cxx_gnu_v2.c
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,9 @@
 #include "minunit.h"
 
 mu_demangle_tests(gnu_v2,
+	// fuzzed strings
+	mu_demangle_test("_ITM_deregisterTMCCCCCCCCCCCCCCCCCCCtart__5555555555555555CloneTable", NULL),
+	// normal
 	mu_demangle_test("_vt.foo", "foo virtual table"),
 	mu_demangle_test("_vt$foo", "foo virtual table"),
 	mu_demangle_test("_vt$foo$bar", "foo::bar virtual table"),

programming_language: C++
CVE-2022-31508 (published 2022-07-11T01:15Z)

The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.3, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/idayrus/evoting
commit_details: repo_url: https://github.com/idayrus/evoting
author: adierebel
author_date: 2022-05-09 01:26:01+07:00
msg: Merge pull request #2 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
repository: repo_url: https://github.com/idayrus/evoting
repo_name: idayrus/evoting
description: E-Voting by Idayrus Studio
repo_language: Python
owner: idayrus
CVE-2022-3821 (published 2022-11-08T22:15Z)

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-193
cwe_name: Off-by-one Error
description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Yu Watanabe
author_date: 2022-07-07 18:27:02+09:00
msg: time-util: fix buffer-over-run

Fixes #23928.
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd
file_changes: filename: time-util.c
change_type: ModificationType.MODIFY
diff: @@ -591,7 +591,7 @@ char *format_timespan(char *buf, size_t l, usec_t t, usec_t accuracy) {
                         t = b;
                 }
 
-                n = MIN((size_t) k, l);
+                n = MIN((size_t) k, l-1);
 
                 l -= n;
                 p += n;

programming_language: C
filename: test-time-util.c
change_type: ModificationType.MODIFY
diff: @@ -238,6 +238,11 @@ TEST(format_timespan) {
         test_format_timespan_accuracy(1);
         test_format_timespan_accuracy(USEC_PER_MSEC);
         test_format_timespan_accuracy(USEC_PER_SEC);
+
+        /* See issue #23928. */
+        _cleanup_free_ char *buf;
+        assert_se(buf = new(char, 5));
+        assert_se(buf == format_timespan(buf, 5, 100005, 1000));
 }
 
 TEST(verify_timezone) {

programming_language: C
CVE-2014-6396 (published 2014-12-19T15:59Z)

The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/Ettercap/ettercap
commit_details: repo_url: https://github.com/Ettercap/ettercap
author: NickSampanis
author_date: 2014-09-03 13:59:51+03:00
msg: Fixed heap overflow caused by length
repository: repo_url: https://github.com/Ettercap/ettercap
repo_name: Ettercap/ettercap
description: Ettercap Project
repo_language: C
owner: Ettercap
file_changes: filename: ec_postgresql.c
change_type: ModificationType.MODIFY
diff: @@ -39,7 +39,7 @@ struct postgresql_status {
    u_char status;
    u_char user[65];
    u_char type;
-   u_char password[65];
+   u_char password[66];
    u_char hash[33];
    u_char salt[9];
    u_char database[65];
@@ -157,8 +157,12 @@ FUNC_DECODER(dissector_postgresql)
                int length;
                DEBUG_MSG("\tDissector_postgresql RESPONSE type is clear-text!");
                GET_ULONG_BE(length, ptr, 1);
-               strncpy((char*)conn_status->password, (char*)(ptr + 5), length - 4);
-               conn_status->password[length - 4] = 0;
+               length -= 4;
+               if (length < 0 || length > 65 || PACKET->DATA.len < length+5) {
+                   dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
+                   return NULL;
+               }
+               snprintf((char*)conn_status->password, length+1, "%s", (char*)(ptr + 5));
                DISSECT_MSG("PostgreSQL credentials:%s-%d:%s:%s\n", ip_addr_ntoa(&PACKET->L3.dst, tmp), ntohs(PACKET->L4.dst), conn_status->user, conn_status->password);
                dissect_wipe_session(PACKET, DISSECT_CODE(dissector_postgresql));
             }

programming_language: C
CVE-2021-33657 (published 2022-04-01T23:15Z)

There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libsdl-org/SDL
commit_details: repo_url: https://github.com/libsdl-org/SDL
author: Sam Lantinga
author_date: 2021-11-30 12:36:46-08:00
msg: Always create a full 256-entry map in case color values are out of range

Fixes https://github.com/libsdl-org/SDL/issues/5042
repository: repo_url: https://github.com/libsdl-org/SDL
repo_name: libsdl-org/SDL
description: Simple Directmedia Layer
repo_language: C
owner: libsdl-org
file_changes: filename: SDL_pixels.c
change_type: ModificationType.MODIFY
diff: @@ -947,7 +947,7 @@ Map1to1(SDL_Palette * src, SDL_Palette * dst, int *identical)
         }
         *identical = 0;
     }
-    map = (Uint8 *) SDL_malloc(src->ncolors);
+    map = (Uint8 *) SDL_calloc(256, sizeof(Uint8));
     if (map == NULL) {
         SDL_OutOfMemory();
         return (NULL);
@@ -971,7 +971,7 @@ Map1toN(SDL_PixelFormat * src, Uint8 Rmod, Uint8 Gmod, Uint8 Bmod, Uint8 Amod,
     SDL_Palette *pal = src->palette;
 
     bpp = ((dst->BytesPerPixel == 3) ? 4 : dst->BytesPerPixel);
-    map = (Uint8 *) SDL_malloc(pal->ncolors * bpp);
+    map = (Uint8 *) SDL_calloc(256, bpp);
     if (map == NULL) {
         SDL_OutOfMemory();
         return (NULL);

programming_language: C
CVE-2024-27914 (published 2024-03-18T17:15Z)

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS  vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/glpi-project/glpi
commit_details: repo_url: https://github.com/glpi-project/glpi
author: Cédric Anne
author_date: 2024-03-13 08:16:31+01:00
msg: Merge pull request from GHSA-rcxj-fqr4-q34r
repository: repo_url: https://github.com/glpi-project/glpi
repo_name: glpi-project/glpi
description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.
repo_language: PHP
owner: glpi-project
file_changes: filename: Debug.js
change_type: ModificationType.MODIFY
diff: @@ -307,7 +307,7 @@ window.GLPI.Debug = new class Debug {
         const post_newline_keywords = ['UNION'];
         let clean_query = '';
         window.CodeMirror.runMode(query, 'text/x-sql', (text, style) => {
-            text.replace('>', `&gt;`).replace('<', `&lt;`);
+            text = escapeMarkupText(text);
             if (style !== null && style !== undefined) {
                 if (newline_keywords.includes(text.toUpperCase())) {
                     clean_query += '</br>';

programming_language: TypeScript
CVE-2023-5227 (published 2023-09-30T01:15Z)

Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2023-09-01 19:49:28+02:00
msg: feat: added check for valid image MIME types
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: CategoryImage.php
change_type: ModificationType.MODIFY
diff: @@ -129,6 +129,19 @@ class CategoryImage
         return $mapping[$mimeType] ?? '';
     }
 
+    /**
+     * Checks for valid image MIME types, returns true if valid
+     * @param string $file
+     * @return bool
+     */
+    private function isValidMimeType(string $file): bool
+    {
+        $types = ['image/jpeg','image/gif','image/png'];
+        $type = mime_content_type($file);
+
+        return in_array($type, $types);
+    }
+
     /**
      * Uploads the current file and moves it into the images/ folder.
      *
@@ -140,14 +153,19 @@ class CategoryImage
             $this->isUpload && is_uploaded_file($this->uploadedFile['tmp_name'])
             && $this->uploadedFile['size'] < $this->config->get('records.maxAttachmentSize')
         ) {
-            if (false === getimagesize($this->uploadedFile['tmp_name'])) {
+            if (!getimagesize($this->uploadedFile['tmp_name'])) {
+                return false;
+            }
+
+            if (!$this->isValidMimeType($this->uploadedFile['tmp_name'])) {
                 return false;
             }
-            if (move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {
-                return true;
-            } else {
+
+            if (!move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {
                 return false;
             }
+
+            return true;
         } else {
             return false;
         }

programming_language: PHP
CVE-2022-2368 (published 2022-07-11T08:15Z)

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.\n\n

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-290
cwe_name: Authentication Bypass by Spoofing
description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Peter Ivanov
author_date: 2022-07-11 10:58:16+03:00
msg: update
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: UserManager.php
change_type: ModificationType.MODIFY
diff: @@ -188,6 +188,18 @@ class UserManager
             return array('error' => 'There are ' . $check2 . ' failed login attempts from your IP in the last 10 minutes. You are blocked for 10 minutes!');
         }
 
+
+
+        // third check by server REMOTE_ADDR , if the an atacker spoofs the user headers such as HTTP_X_FORWARDED or HTTP_CLIENT_IP
+        if (isset($_SERVER['REMOTE_ADDR'])) {
+            $check3 = $this->app->log_manager->get('no_cache=1&is_system=y&count=1&created_at=[mt]15 min ago&updated_at=[lt]15 min&rel_type=login_failed&user_ip=' . $_SERVER['REMOTE_ADDR']);
+            if ($check3 > 25) {
+                return array('error' => 'There are ' . $check3 . ' failed login attempts from your IP in the last 15 minutes. You are blocked for 15 minutes!');
+            }
+        }
+
+
+
         if (isset($params['code_login'])) {
             return $this->codeLogin($params['code_login']);
         }

programming_language: PHP