When logging in if an incorrect password is entered it it sent to API to check if it has been compromised.
There should be a setting to allow only sending the password to the API if the login attempt was successful.
Login with a correct username and a wrong password, but that wrong password appears on the pwned list.
E.g. admin and password.
A warning is shown even though the user supplied a incorrect password and has not been logged in.
Add setting for "Check failed login attempts?"
Help text to read "Should the password be checked when the login attempt fails? (Default: True)"
Implement the suggested changes.
Update admin page with new setting.
None.
None.
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | 3330749-6.patch | 5.53 KB | mcdruid |
| #6 | interdiff-3330749-5-6.txt | 2.21 KB | mcdruid |
| #5 | 3330749-5.patch | 3.24 KB | mcdruid |
| #5 | interdiff-3330749-4-5.txt | 2.36 KB | mcdruid |
| #4 | only-validate-password-for-successful-login-attempts-3330749-4.patch | 2.91 KB | dahousecat |
Comments
Comment #2
dahousecat commentedComment #3
dahousecat commentedComment #4
dahousecat commentedUpdated patch to delete the `password_haveibeenpwned_check_failed_login` variable during uninstall.
Comment #5
mcdruid commentedThanks, this is a good idea.
I've tweaked the patch slightly; I think this should default to no/false/off, and the other boolean option in the admin form uses a checkbox rather than radios.
I'd also like tests before this is committed; with any luck they shouldn't be too hard to add based on those we already have.
Comment #6
mcdruid commentedHere's a couple of basic tests.
These reveal the fact that with the "check_failed_login" option enabled, the module may emit messages saying:
...when it wasn't really the current, stored password that was checked.
I don't think this is an especially big deal, but we could tweak that wording.
Comment #8
mcdruid commentedTweaked the wording of messages a little depending on whether this new option is set.
Thanks for the patch; definitely an improvement!