Problem/Motivation

When I test the rather too complicated Mailsystem/Mimemail/HTMLmail I use
https://mydrupaltestsite.com/user/password to see if I can get Drupal to part with a beautifully formatted HTML mail.

Steps to reproduce

Go to your equivalent of https://mydrupaltestsite.com/user/password while logged in and ask it to send you a reset password mail 10 times in a row.

All those ten times the cheery message will be something like "If ss@vertikal.dk is a valid account, an email will be sent with instructions to reset your password."

This is, pretty quickly, a lie. It will NOT send an e-mail with instructions to reset your password.

Then go to admin/reports/dblog and watch Drupal log another FAULTY error message:
"Password reset form was submitted with an unknown or inactive account: ss@vertikal.dk."

The account is not in any way unknown or inactive. It's just in the flood table in the database. There is a big difference.

It's rather confusing.

Proposed resolution

1. If the user requesting a password reset is logged in, they should NEVER end up in the flood table. With users having little patience and spam filters being overly zealous, expect people to try more than a few times.

2. If the user for some good reason ends up it the flood table, tell them, on requesting the password reset mail (or when they're desperately trying to log in). "You have tried to log in or requested the password reset mail a few too many times. Wait for 24 hours (or days) before trying again."

3. In the recent log messages (/admin/reports/dblog) write "Someone has tried a few too many times to log in as user ss@vertikal.dk. Or maybe they have tried to get a password reset mail a few too many times. Install the Flood Control module, solve the problem and have your site work way better: https://www.drupal.org/project/flood_control"

User interface changes

Mostly better error messages. Messages that can be seen and are... correct.

Comments

Steven Snedker created an issue. See original summary.

steven snedker’s picture

steven snedker commented
Issue summary: View changes
steven snedker’s picture

steven snedker commented
Version: 9.4.x-dev » 9.5.x-dev
Issue summary: View changes

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

steven snedker’s picture

steven snedker commented

I still think correct error messages would benefit Drupal.

steven snedker’s picture

steven snedker commented
Issue summary: View changes

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

poker10’s picture

poker10 commented
Related issues: +#3353185: Password reset form error makes no sense when the account is locked

Thanks for reporting this! This is probably a duplicate of #3353185: Password reset form error makes no sense when the account is locked. I see this issue was created first, but in the other issue there is a broader discussion, so I propose to close one of the issues and continue in the other one. Thanks!

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.