{"id":19640640,"url":"https://github.com/daniel-km/omeka-s-module-lockout","last_synced_at":"2026-05-14T17:33:01.803Z","repository":{"id":148008312,"uuid":"93736250","full_name":"Daniel-KM/Omeka-S-module-Lockout","owner":"Daniel-KM","description":"Module for Omeka S that limits the rate of login attempts for each IP (not by auth cookie) in order to avoid brute-force attacks.","archived":false,"fork":false,"pushed_at":"2026-04-13T13:28:01.000Z","size":519,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2026-04-13T15:25:47.633Z","etag":null,"topics":["login","omeka-s","omeka-s-module","security"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Daniel-KM.png","metadata":{"files":{"readme":"README.md","changelog":"Changelog.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2017-06-08T10:19:00.000Z","updated_at":"2026-04-13T13:28:07.000Z","dependencies_parsed_at":"2025-10-03T09:15:18.000Z","dependency_job_id":"d9cb2232-9b75-4d6e-b266-7afbce6d8505","html_url":"https://github.com/Daniel-KM/Omeka-S-module-Lockout","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/Daniel-KM/Omeka-S-module-Lockout","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Daniel-KM%2FOmeka-S-module-Lockout","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Daniel-KM%2FOmeka-S-module-Lockout/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Daniel-KM%2FOmeka-S-module-Lockout/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Daniel-KM%2FOmeka-S-module-Lockout/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Daniel-KM","download_url":"https://codeload.github.com/Daniel-KM/Omeka-S-module-Lockout/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Daniel-KM%2FOmeka-S-module-Lockout/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33035688,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-13T13:14:54.681Z","status":"online","status_checked_at":"2026-05-14T02:00:06.663Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["login","omeka-s","omeka-s-module","security"],"created_at":"2024-11-11T14:06:20.051Z","updated_at":"2026-05-14T17:33:01.798Z","avatar_url":"https://github.com/Daniel-KM.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"Lockout (module for Omeka S)\n============================\n\n\u003e __New versions of this module and support for Omeka S version 3.0 and above\n\u003e are available on [GitLab], which seems to respect users and privacy better\n\u003e than the previous repository.__\n\n[Lockout] is a module for [Omeka S] that limits the rate of login attempts for\neach IP (not by auth cookie) in order to avoid brute-force attacks.\n\n\nDescription\n-----------\n\nLimit the number of login attempts possible both through normal login.\n\nBy default Omeka S allows unlimited login attempts either through the login\npage. This allows passwords (or hashes) to be brute-force cracked with relative\nease.\n\nThe module blocks an Internet address from making further attempts after a\nspecified limit on retries is reached, making a brute-force attack difficult or\nimpossible.\n\n## Features\n\n* Limit the number of retry attempts when logging in (for each IP)\n* Fully customizable\n* Informs user about remaining retries or lockout time on login page\n* Optional logging and optional email notification\n* Handles server behind reverse proxy\n* It is possible to whitelist IPs, but you probably shouldn't. :-)\n\nTranslations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional),\nCzech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian,\nRussian, Spanish, Swedish, Turkish.\n\nThe module uses standard actions and filters only.\n\n## Screenshots\n\n1. Login screen after failed login with retries remaining.\n\n  ![Login screen after failed login](data/readme/lockout_attempt.png)\n\n2. Login screen during lockout.\n\n  ![Login screen during lockout](data/readme/lockout_blocked.png)\n\n3. Administration interface in Omeka S\n\n  ![administration interface](data/readme/lockout_config.png)\n\n\nInstallation\n------------\n\nThis module has no dependance.\n\n**Warning**: If your server is located behind a reverse proxy, make sure to set\nthe option after install.\n\n* From the zip\n\nDownload the last release [Lockout.zip] from the list of releases (the master\ndoes not contain the dependency), and uncompress it in the `modules` directory.\n\n* From the source and for development:\n\nIf the module was installed from the source, rename the name of the folder of\nthe module to `Lockout`, and go to the root module, and run:\n\n```sh\ncomposer install --no-dev\n```\n\nSee general end user documentation for [installing a module].\n\n- For test\n\nThe module includes a comprehensive test suite with unit and functional tests.\nRun them from the root of Omeka:\n\n```sh\nvendor/bin/phpunit -c modules/Lockout/phpunit.xml --testdox\n```\n\n\nFrequently Asked Questions\n--------------------------\n\n## Why not reset failed attempts on a successful login?\n\nThis is very much by design. Otherwise you could brute force the \"admin\"\npassword by logging in as your own user every 4th attempt.\n\n## What is this option about site connection and reverse proxy?\n\nA reverse proxy is a server in between the site and the Internet (perhaps\nhandling caching or load-balancing). This makes getting the correct client IP to\nblock slightly more complicated.\n\nThe option default to NOT being behind a proxy -- which should be by far the\ncommon case.\n\n## How do I know if my site is behind a reverse proxy?\n\nYou probably are not or you would know. We show a pretty good guess on the\noption page. Set the option using this unless you are sure you know better.\n\n## Can I whitelist my IP so I don't get locked out?\n\nFirst please consider if you really need this. Generally speaking it is not a\ngood idea to have exceptions to your security policies.\n\nNote that we still do notification and logging as usual. This is meant to allow\nyou to be aware of any suspicious activity from whitelisted IPs.\n\n## I locked myself out testing this thing, what do I do?\n\nEither wait, or:\n\nIf you know how to edit / add to PHP files you can use the IP whitelist\nfunctionality described above. You should then use the \"Restore Lockouts\" button\non the module settings page and remove the whitelist function again.\n\nIf you have ftp / ssh access to the site, remove the folder of the module or\nincrease the version number in the `config/module.ini`, so it will deactivate it.\n\nIf you have access to the database (for example through phpMyAdmin) you can clear\nthe lockout_lockouts option in the Omeka S `setting` table. The sql for a\nstandard install is: `UPDATE setting SET value = '' WHERE id = 'lockout_lockouts';`\nYou can disable the module too: `UPDATE module SET is_active = 0 WHERE id = 'Lockout';`.\n\n\nWarning\n-------\n\nUse it at your own risk.\n\nIt?s always recommended to backup your files and your databases and to check\nyour archives regularly so you can roll back if needed.\n\n\nTroubleshooting\n---------------\n\nSee online issues on the [module issues] page on GitLab.\n\n\nLicense\n-------\n\nThis module is published under the [GNU/GPL] license.\n\nThis program is free software; you can redistribute it and/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation; either version 3 of the License, or\n(at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program; if not, write to the Free Software\nFoundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA\n\n\nContacts\n--------\n\n* Daniel Berthereau (see [Daniel-KM] on GitLab)\n\n\nCopyright\n---------\n\n* Copyright Johan Eenfeldt, 2008-2012\n* Copyright Daniel Berthereau, 2017-2026\n* Translations: see the [WordPress page]\n\nThis module is a full rewrite of the plugin [Limit Login Attempts] for WordPress\ncreated by Johan Eenfeldt (johanee).\n\nThanks to Michael Skerwiderski for reverse proxy handling suggestions (WordPress).\n\n\n[Lockout]: https://gitlab.com/Daniel-KM/Omeka-S-module-Lockout\n[Omeka S]: https://omeka.org/s\n[Limit Login Attempts]: https://wordpress.org/plugins/limit-login-attempts\n[module issues]: https://gitlab.com/Daniel-KM/Omeka-S-module-Lockout/-/issues\n[GNU/GPL]: https://www.gnu.org/licenses/gpl-3.0.html\n[WordPress page]: https://translate.wordpress.org/projects/wp-plugins/limit-login-attempts/contributors\n[GitLab]: https://gitlab.com/Daniel-KM\n[Daniel-KM]: https://gitlab.com/Daniel-KM \"Daniel Berthereau\"\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdaniel-km%2Fomeka-s-module-lockout","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdaniel-km%2Fomeka-s-module-lockout","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdaniel-km%2Fomeka-s-module-lockout/lists"}