Doug Stewart

You just need to add a stub file in wp-content/mu-plugins in order for this to work, Marcio. Install the plugin itself in wp-content/mu-plugins/limit-login-attempts-reloaded/ and then create a file called wp-content/mu-plugins/limit-login-attempts-reloaded.php containing:

<?php
/**
 * Plugin Name:  Limit Login Attempts Reloaded Loader
 * Plugin URI:   https://www.ads-software.com/plugins/limit-login-attempts-reloaded/
 * Description:  Loads LLAR
 * Version:      2.0.0
 * Author:       wpchef
 * Author URI:   https://www.www.ads-software.com
 * License:      GPLv2 or later
 */

require_once __DIR__ . '/limit-login-attempts-reloaded/limit-login-attempts-reloaded.php';

nlsun:
Is this PHP 7 by any chance? We’re seeing the same thing.

Yeah, switch_to_blog() will always return 1/true:

Return Values
(bool)
true is returned even when no blog exists with a Blog ID of $new_blog, or when “switching” to the current blog.

From https://codex.www.ads-software.com/Function_Reference/switch_to_blog

See https://wordpress.stackexchange.com/questions/44509/the-https-local-ssl-verify-filter, and the WP references for https://developer.www.ads-software.com/reference/hooks/https_local_ssl_verify/ and https://developer.www.ads-software.com/reference/hooks/https_ssl_verify/ for more info on how to best filter and make cURL ignore the self-signed cert.

Dan:
Yes. cURL tries to verify the integrity of SSL certs and will error out unless told to ignore verification.

See, e.g. https://www.ads-software.com/support/topic/server-self-connect-error-nss-client-cert-not-found?replies=6

Basically, you need to run the equivalent of curl -k:

-k, –insecure

(SSL) This option explicitly allows curl to perform “insecure” SSL connections and transfers. All SSL connections are attempted to be made secure by using the CA certificate bundle installed by default. This makes all connections considered “insecure” fail unless -k, –insecure is used.

See this online resource for further details: https://curl.haxx.se/docs/sslcerts.html

Otto:
If he hasn’t enabled underscores in headers, Nginx will flag the header as invalid and ignore.

https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers

Right, I’m saying he’s matching against an invalid header in his if() check, not that he doesn’t want to force it.

Also what Otto said there — you won’t ever force $_SERVER[‘https’] to ‘on’ because it’s matching against a header that’s not being sent.

Do you see any of the hits ever make it to the Apache logs?

Are you terminating SSL at the Nginx layer or at the Apache layer? A Gist or Pastebin of your exact Nginx configs, stripped of sensitive info, would be very helpful.

Self-signed cert?

i18n support is due for inclusion in the next update. Thanks!

calpoly:
First off: wow! The site looks great! Definitely one of my favorite implementations thus far.

Specificity is weird in version 1.3.x. I’m working hard to fix this in 1.4, but the crux of your issue is that you’ll need to out-specify ng.css in order to make your changes “take”.

It looks like, though, you figured it out.

Andrius:
Glad that it’s working out for you!

Adam:
Were you having problems with BuddyPress version 1.7?