Dear Forum,

I'm implementing a private survey with token (user/password) before accessing the questions.
We have added the LimeSurvey captcha to avoid brute-force attack.

After some testing, we have noticed that token are requested to the database and, once the response is correct, LimeSurvey checks against the captcha.

Thus, a brute-force attack would be possible as a list of valid token can be obtained without captcha intervention.

How could we enforce to check the captcha before checking the token against the database, so we can avoid a brute-force attack?

Thanks for your support.

Regards,

Open a feature request. LimeSurvey should saving token access with wrong tokens into a logfile (e.g. failedtoken.log), which than could be access via fail2ban or other blocking tools (CSF/LFD) to block on IP-level.

A tool inside LimeSurvey would be fine too. The auditlog might be included too.

johnmoore wrote: After some testing, we have noticed that token are requested to the database and, once the response is correct, LimeSurvey checks against the captcha.

This must be reported as a bug , not a feature request.

My answer was for a different thread. Sorry.
www.limesurvey.org/forum/design-issues/1...lt-in-captcha#182599

But still an issue : catpcha check must happen before token check : this is the issue.