Merge "Allow more fine-grained throttling of login attempts"

[lhc/web/wiklou.git] / includes / DefaultSettings.php

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 1e713e5..41bf42b 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -2294,6 +2294,14 @@ $wgSessionHandler = null;
 
 /**
  * Whether to use PHP session handling ($_SESSION and session_*() functions)
+ *
+ * If the constant MW_NO_SESSION is defined, this is forced to 'disable'.
+ *
+ * If the constant MW_NO_SESSION_HANDLER is defined, this is ignored and PHP
+ * session handling will function independently of SessionHandler.
+ * SessionHandler and PHP's session handling may attempt to override each
+ * others' cookies.
+ *
  * @since 1.27
  * @var string
  *  - 'enable': Integrate with PHP's session handling as much as possible.
@@ -2302,28 +2310,6 @@ $wgSessionHandler = null;
  */
 $wgPHPSessionHandling = 'enable';
 
-/**
- * The number of different IPs in the same session within a period of $wgSuspiciousIpExpiry
- * that should cause warnings to be logged. This is meant more for debugging errors in the
- * authentication system than for detecting abuse.
- * @since 1.27
- */
-$wgSuspiciousIpPerSessionLimit = 2;
-
-/**
- * Like $wgSuspiciousIpPerSessionLimit but over all requests from the same user within
- * $wgSuspiciousIpExpiry, whether they are in the same session or not.
- * @since 1.27
- */
-$wgSuspiciousIpPerUserLimit = 5;
-
-/**
- * Time in seconds to remember IPs for, for the purposes of $wgSuspiciousIpPerSessionLimit and
- * $wgSuspiciousIpPerUserLimit.
- * @since 1.27
- */
-$wgSuspiciousIpExpiry = 600;
-
 /**
  * If enabled, will send MemCached debugging information to $wgDebugLogFile
  */