Problem/Motivation

This is a follow-up from #2847708: RPC endpoint to reset user password. We need to implement flood protection for password reset forms: \Drupal\user\Form\UserPasswordForm::buildForm() and \Drupal\user\Controller\UserController::getResetPassForm().

Proposed resolution

Remaining tasks

  1. Write patch
  2. Write tests

User interface changes

API changes

Data model changes

Comments

arshadcn created an issue. See original summary.

shadcn’s picture

shadcn commented
Related issues: +#2847708: RPC endpoint to reset user password
cilefen’s picture

cilefen commented
Related issues: +#2431357: Extract a reusable UserAuthFlood service and reuse it in UserLoginForm and BasicAuth and UserAuthenticationController
clemens.tolboom’s picture

clemens.tolboom
Primary language Dutch
Location Groningen, 🇳🇱/🇪🇺
commented
Related issues: +#2856929: Add flood protections to password reset

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

idebr’s picture

idebr commented
Status: Active » Closed (duplicate)

Let's close this as a duplicate of #2856929: Add flood protections to password reset, so we can focus our efforts in the related issue.

cilefen’s picture

cilefen commented
Status: Closed (duplicate) » Active

@idebr You've made this a duplicate of itself. ☹️

rob c’s picture

rob c commented
Status: Active » Closed (duplicate)

Then let's close it as a duplicate of #1681832: Password reset form has no flood protection