codeling/bfstop

Brute Force Stop Plugin (plg_system_bfstop) Joomla System Plugin

This is the plugin part of the Brute Force Stop Joomla! Extension package.

For detailed information, as well as instructions on how to download, install and configure it, please browse to https://github.com/codeling/bfstop/wiki

For information on what changed in recent versions, see the CHANGELOG file

If you find any issues, please report them at https://github.com/codeling/bfstop/issues

If you are interested in the source code, or want to contribute, the repository can be found under https://github.com/codeling/bfstop

For any further questions, don't hesitate to contact me under [email protected]

GeoIP reader (third-party code, keep it up to date!)

The optional GeoIP features (country risk score, "Information for IP Address") use a copy of the MaxMind DB reader (maxmind-db/reader, Apache-2.0), shipped in src/Helper/Geo, because a Joomla! extension cannot rely on composer at install time. It parses a database file with untrusted-format binary data, so it has to be updated whenever MaxMind publishes a new release - releases of this plugin should never ship an outdated copy.

• Which version is shipped: composer.lock (package maxmind-db/reader); the header of src/Helper/Geo/Reader.php names it too.
• How it is kept current: Dependabot and a weekly GitHub Actions job (.github/workflows/dependencies.yml) report new releases and security advisories; CI fails if src/Helper/Geo is not exactly the locked version.
• How to update: composer update maxmind-db/reader && composer vendor-geoip, review the diff, run the tests, release plugin and component.
• The GeoLite2/GeoIP2 database (.mmdb) is separate: you download it and configure its path in the component's settings. MaxMind publishes new versions of GeoLite2 twice a week (Tuesdays and Fridays), and the addresses of the internet move around, so an old file gets less and less accurate - it only feeds the risk score and the address information, it is not a security boundary. Update it regularly (geoipupdate can do that from cron), and check the licence terms of the database you use: they may require you to keep it current.