Disallow multiple logins - doesn't work

[Alex-e107nl]

Github 08-09-2026 PHP 8.3

@e107help Hi, I have tested the Disallow multiple logins option in e107_admin/prefs.php#nav-core-prefs-security and i still can login from a separate computer with the same IP of with my phone with a whole different IP with the same credentials so that are 3 logins....

The help text says:
Activating this will prevent more than one person logging in with the same username/password (login detail sharing)

Can you look into why this isn't working? I remember getting quite angry reactions a long time ago when I activated this on an e107 website, so it actually did work...

[e107help[bot]]

@Alex-e107nl, two settings decide what that toggle does, and both sit on the same Security page: Session Storage and Track Online. Worth checking which pair your site has, because one of the three combinations makes the option do nothing at all.

• Session Storage = Database, what a fresh install gets (default_install.xml#L278): the second login is allowed and the earlier sessions of that account are deleted instead, so the computer you signed in on first is signed out at its next click, with no message. Go back to it and see. (login.php#L279-L301)
• Anything other than Database, with Track Online on: the second login is refused, with "This user is already logged in and cannot be logged in from another session." (login.php#L302-L308)
• Anything other than Database, with Track Online off: neither branch runs and the preference does nothing whatsoever. Three devices stay signed in, which is what you are describing.

I ran all three on a clean install of master (7ca831e7), two cookie jars and one account, to be sure of which does what.

If what you want is the login refused rather than the earlier session ejected, that is Track Online on plus Session Storage on Files. Two things worth knowing before you set it:

• That check reads the online table, whose rows are dropped five minutes after the user's last page view, so someone who closes the browser without logging out cannot sign back in until then.
• A refused login counts towards the failed-login autoban counter (login.php#L716-L720), so a user who keeps retrying can get their own IP banned. That is why Improve handling of Multiple logins from the same user/pwd combination #4657 moved the database path to dropping the old session back in 2022.

The help text describes only the middle case, which is what sent you hunting. I have written that up as #6302; whether it gets reworded, or the two paths get made to match, is Deltik's call.