[Security Feature] Login Fail trace / Detect Brute Force Attacks

[ivanooov]

Hi,

When i try to login on dokuwiki, i can brute-force login/password without any trace in apache2's logs, juste code 200 OK all right's :))
Without trace to detect login fail it's more difficult to detect Brute-Force's attacks.

After line 223 (if(!$silent) msg($lang['badlogin'], -1);) in inc/auth.php file add the following:

{ header('HTTP/1.0 404 Not Found'); }
After this, if you use ossec on your dokuwiki/apache2 server , ossec can detect multiple 400 code error on apache and so any brute force on your dokuwiki :))

Tchuss les néné !

Ivanov