DirectAdmin 1.704

@fln, regarding the CSF dovecot log parser change in /usr/local/csf/lib/ConfigServer/RegexMain.pm, could you please double-check this change?

It looks like the updated regex introduced additional capturing groups, but the assigned capture indexes were not adjusted accordingly.

For example, with the relevant part of a log line like:

imap-login: Login aborted: Logged out (auth failed, 1 attempts in 8 secs) (auth_failed): user=<test>, method=PLAIN, rip=1.1.1.1, lip=...

The new pattern appears to capture:
$10 = " in 8 secs"
$12 = <test>
$14 = 1.1.1.1

However, the code still uses the previous capture groups:
my $ip = $12;
my $acc = $10;


Wouldn’t the minimal correction be:
my $ip = $14;
my $acc = $12;


Otherwise, it seems the IP check may be receiving the username instead of the remote IP.
 
  • Like
Reactions: fln
Back
Top