2

The reason for this question is that I was running EE v2.3 which did not have ipv6 support. So users with those ip address where given the ip address of 0.0.0.0

I have now upgraded to EE v2.5 which has ipv6 support.

So I want to know are those members with ip addresses of 0.0.0.0 going to be able to use the site as a member now? Is their ip address going to be updated?

If not, what are my options? Would see strange if a users IP address is set once and never updated?

1 Answer 1

1

No, the IP Address won't be updated, generally speaking. If you are using a different membership module besides the one built in to ExpressionEngine, then maybe. But generally speaking, ExpressionEngine (EE) logs the IP Address the user was at when they created their account or when they are logged in, but it doesn't require the same IP Address.

I can or you can log-in from any ip_address, unless you've put blockers in place to restrict to specific IPs. The control panel option for tracking ip_addresses reads:

Require IP Address and User Agent for Login? Prevents users from logging in unless their browser generates IP Address and User Agent data. This keeps hackers from logging in using direct socket connections.

As it states, it prevents socket use, and while it does log current IPs, it doesn't do member matching. At least not to my knowledge. Checking my Control Panel logs, I can see that I've logged in from at least 7 different ip_address, though the IP Address on my account profile, remains my home ip_address.

Now, if you are using Forums, this maybe different. We've never used EE Forums for clients, so I can't comment. But generally speaking, the ip_address is used for basic security, like you could ban a country or a block of IPs, that have been problematic.

So you should be fine, unless you have other restrictions by ip_address in place.

4
  • Thanks for the reply. I want to leave the setting Require IP Address and User Agent for Login for security reasons. If EE has logged a member to have the ip address 0.0.0.0 because they initially signed up from an invalid or no ip address. What happens if they try and log in after this using a valid ip address? Apr 12, 2013 at 1:17
  • Actually does EE even use this logged ip address when doing it's ip validation? Or does it validate the current ip address of the user? Apr 12, 2013 at 1:24
  • The IP Address isn't part of a validation at all, which is what I was saying. It's just logged, so you can ban off it, if you need to do so. It basically just requires that an IP address exists, so that hackers CAN'T mask their IP. It is NOT a requirement that it is the one IP address attached to a particular user. Apr 12, 2013 at 4:25
  • I'm not encouraging you to turn off. It should definitely be used. I'm saying it doesn't do what you believe it does. If they were able to register with 0.0.0.0 as an IP address, then they will be able to use the site without a problem, unless they try to mask their IP. Any ip_address can be used, when logging in. Their is NO check that the user uses the same ip_address they registered with. Apr 12, 2013 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.