I have a client who has found that when one user is locked out of the CP, all others are locked out too. This makes me think that this is based on IP address alone rather than username.

Anybody got any experience with this issue?

Thanks

I have a client who has found that when one user is locked out of the CP, all others are locked out too. This makes me think that this is based on IP address alone rather than username.

Anybody got any experience with this issue?

Thanks

EDIT IN RESPONSE TO QUESTIONS:

This happened over a weekend so I wasn't online to check the database at the time. However the message received was 'You are only permitted to make four login attempts every 30 minute(s)'. So one user locked triggered this lockout but it affected all other users in his company.

Looking at the check_password_lockout() method in Session.php it looks like the check is based on username OR useragent. So it would appear that if he locked himself out in a particular browser, all other users on that IP would be locked out if they were using the same browser.

I'm not a security expert in any way, but shouldn't that SQL check be AND not OR? Any thoughts?