You have used 0 out of 5 attempts. Count is always in "0"

Hi,

I am also getting this issue. I don't know why and have nothing to add but wanted to let you know it is not an isolated case.

Thanks,
Paul.

The only way I was able to reproduce this issue was to use a username that doesn't exist. Do you perhaps use logintoboggan or another alternative login module?

I'll just link this back to #1440536: Track username or email user inputs. until you say otherwise.

Hi,

Yes! This is the same issue as shown (logintoboggan). Would you consider a bounty to make that a 7 patch? I don't have the skills and I think this would be quite important.

paul at totallytechy dot com

Thanks,
Paul.

Hi, same problem over here. I've done a bit of research and part of the problem is that, no matter how many times I try to log in using a valid account name but fake password the login_security_track table is always empty, so the corresponding variables (@ip_current_count and @user_current_count) are always equal to 0.

This is a severe issue since it renders the module absolutely useless. I can perform as many attemps I want and the ip/account never gets blocked.

I'll keep investigating if I can get some spare time this weekend.

BTW, I'm using PostgreSQL, this may be the cause?

Well, here's something crazy. I enabled a CAPTCHA challenge for the login form and suddenly the module started to work fine. I can see that the login_security_track table is populated every time I tried a wrong password, the message has the correct number of failed retries and most important, the offending account gets blocked after the correct number of failed attempts.

What is even crazier, is that after disabling the CAPTCHA challenge in the login form, the module still works just fine. WTF?

linking parent issue