API page: https://api.drupal.org/api/drupal/core%21modules%21user%21src%21Form%21U...
The form validation functions work independently of each other. And if the user has not filled the captcha. He can still see the following message
'The username %name has not been activated or is blocked.'
And this message indicates to the attacker that this account exists and that he can use it to launch brute force attacks.
I want to prevent this message from being displayed when the user has not yet filled in the captcha.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | prevent-display-username(right path).patch | 916 bytes | amir jamshidi |
| #3 | prevent-display-username.patch | 900 bytes | amir jamshidi |
Comments
Comment #2
amir jamshidi commentedComment #3
amir jamshidi commentedI prevented the error message from appearing by using a patch.
Comment #4
amir jamshidi commentedI had a problem running the patch and I checked and found that the problem was with "depth": 2 in the patches.lock.json file, which specifies the start of the path to apply the patch, and I couldn't change this value, so I created a new patch with the path modified.
Comment #5
amir jamshidi commentedComment #6
cilefen commented