Jam Balaya 988c678634 Fever API: log the client IP address on authentication failure (#8981) ...

A failed Fever API auth returns {"auth":0} with HTTP 200, so from the web
server log a failure is indistinguishable from a success and fail2ban
cannot act. The failure was already logged to API_LOG, but without the
client IP. Append the remote IP (Minz_Request::connectionRemoteAddress())
so a fail2ban filter watching data/users/_/log_api.txt can ban repeated
attempts.

For https://github.com/FreshRSS/FreshRSS/issues/6814

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-04 21:33:09 +02:00

..

.htaccess

Add remote user in Apache logs, also for API (#8392)

2026-01-03 17:48:33 +01:00

fever.php

Fever API: log the client IP address on authentication failure (#8981)

2026-07-04 21:33:09 +02:00

greader.php

Use timing safe comparison for tokens everywhere (#8945)

2026-06-27 14:02:20 +02:00

index.php

Add option for CSP frame-ancestors (#7857)

2025-09-21 13:29:58 +02:00

misc.php

Misc API: better REST semantics (#8232)

2025-11-20 22:16:02 +01:00

pshb.php

Housekeeping lib_rss.php (#8193)

2025-11-11 08:17:12 +01:00

query.php

Use timing safe comparison for tokens everywhere (#8945)

2026-06-27 14:02:20 +02:00