First off, any information on if the period before the equals should be on line 34 of jsecure.php ?
$path .= $params->get_______
Below is still not something that needs fixing as it probably has nothing to do with jsecure code itself.
But is something that people trying to test it, should be aware of.
In short jsecure works perfectly fine in this regards as it only effects people that "already know" the correct login key. It will always block unwanted attempts.
Had a bit of time to do some testing again and after trying 4 different computers with differing settings from more secure to default browser settings. The same things happen with either v1.08 I had previously used and v.2.
I found that on the odd occasion when the website is running on a *windows IIS server*,firefox 3+ would for some reason continue to show the correct admin login page when trying to use a ?wrongkey or on firefox 3+,IE 7-8, safari when trying direct yoursite.com/administrator/ "IF" you had previously used your correct key in the current browser session (on 1 computer it would do it even after clearing all caches and restarting the browser half the time).
Now on my 'nix' *xammp server*; firefox 3+, IE7-8 and Safari would never allow ?wrongkey to work but using direct yoursite.com/administrator/ would often work AFTER you have successfully loaded the admin login page during the -current browser session only-.
But closing the browser and clearing caches, history etc. and re-opening the browser to test trying to load the admin page without the correct method and key would always block the attempt if done before a correct ?key is used.
Even simpler for either type of server (IIS or *Nix) when testing, just use your browsers Private Mode for a minute and you can always find if you have jsecure working correctly.
Lastly, I am glad to hear that a future version will show the intruders IP so I can deal with them if needed and not have to go searching through raw logs.
have a nice day everyone,
