Allow users to unblock their account once they used "request new password link"

Hi Lehlohonolo,

Update login hook for clear the flood table for logged user.

Thanks,
Talla.

I think ideally this would be behind a feature flag, but there's also some issues.

  $results = $database->select('flood', 'f')
    ->fields('f', ['identifier', 'timestamp', 'fid'])
    ->condition('identifier', "%" . $database->escapeLike(\Drupal::currentUser()->id()) . "%", 'LIKE')
    ->execute()
    ->fetchAll();

This would mean a user with ID 15 would clear the flood control for user 150, 215, 4156 etc. The query needs tightening.
It's also worth noting a lot of this code already exists in FloodUnblockManager so could be reused.

@Driskell,

Updated the condition, instead of like, using equal condition, of course code available in FloodUnblockManager , it won't usable for after reset the password to clear the flood info.

Thanks,
Talla.

There are changes in this patch that are out of scope like

+/**
+ * @file
+ */
+

and

-  if(empty($value)){
+  if (empty($value)) {

If it doesnt exists yet, please create an issue for code styling issues instead.

This creates a log notice with only the url as message? Can you expand this, so it includes better information?:

+    \Drupal::logger('flood_control')->notice($request_uri);

Same here: instead of just printing some IDs, add a bit more information:

+  \Drupal::logger('flood_control')->notice(json_encode($results));

We already have a function to clear flood events: floodUnblockClearEvent. Can you re-use that instead of a new custom function _flood_control_clear_log ?

If I do not want this functionality on my website (because I really want this visitor to wait a couple of weeks before he can login in again), there should be a way to disable it. So, we would need a setting to enable/disable this functionality. Make it disabled by default.

If I do not want this functionality on my website (because I really want this visitor to wait a couple of weeks before he can login in again), there is now a way to disable it. And removed the code style fixes.

This is improving.

But there is still a couple of issue with this patch:

1. This creates a log notice with only the url as message:

\Drupal::logger('flood_control')->notice($request_uri);

Can you expand this, so it includes better information?:

2. Same here: instead of just printing some IDs, add a bit more information:

\Drupal::logger('flood_control')->notice(json_encode($results));

3. We already have a function to clear flood events: floodUnblockClearEvent. Can you re-use that instead of a new custom function _flood_control_clear_log ?

+/**
+ * Custom function for clear the flood.
+ */
+function _flood_control_clear_log() {
+  $database = \Drupal::database();
+  $results = $database->select('flood', 'f')
+    ->fields('f', ['identifier', 'timestamp', 'fid'])
+    ->condition('identifier', $database->escapeLike(\Drupal::currentUser()->id()), '=')
+    ->execute()
+    ->fetchAll();
+  foreach ($results as $key => $value) {
+    $parts = explode('-', $value->identifier);
+
+    if (!empty($parts[0])) {
+      $query_delete = $database->delete('flood')->condition('fid', $value->fid);
+      $success = $query_delete->execute();
+    }
+  }
+
+  \Drupal::logger('flood_control')->notice(json_encode($results));
+}

I am working on it.

Hi @batigolix,

I have removed log notices code as it looks like added for testing purpose only, as you mentioned in Point 1 and 2.

For point 3, i have updated the delete query code with the function floodUnblockClearEvent of flood_control.flood_unblock_manager service.

Thnaks
Samit K.

After some testing your patch a bit more I realised this must be a Drupal core issue that someone must have ran into before
I found this issue, which addresses the same problem:
#992540: Nothing clears the "5 failed login attempts" security message when a user resets their own password

I suppose we don't need to solve this in Flood Control, agree?

I am postponing this issue as it might be solved in Drupal core #992540: Nothing clears the "5 failed login attempts" security message when a user resets their own password