Entering an email address to login wouldn't result in a blocked user account when the failed attempt limit was reached. Attached is a patch that will handle both.

CommentFileSizeAuthor
#4 login_security-email_or_username_input-1440536-4.patch2.15 KBDelphine Lepers
login_security_-_email_or_username_input.patch1.77 KBbreathingrock

Comments

deekayen’s picture

deekayen commented
Status: Active » Postponed (maintainer needs more info)

What's the use case here? LoginToboggan?

deekayen’s picture

deekayen commented
Category: bug » feature

Category change to feature.

Delphine Lepers’s picture

Delphine Lepers commented
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Reviewed & tested by the community

Hi
Indeed when logintoboggan is installed, the module's behaviour is incorrect on attempts made on the email address, since it does not collate tries on the user name and tries on the email address.
It also never blocks attempts made using the email address, therefore open to bruteforce attacks.
The patch does the trick just fine as it sums up tries on email address and tries on username, blocking after 3.

Delphine Lepers’s picture

Delphine Lepers commented
Version: 6.x-1.1 » 6.x-1.4
Status: Reviewed & tested by the community » Needs review
StatusFileSize
new login_security-email_or_username_input-1440536-4.patch2.15 KB

Here is a better patch that cleans the table for username and emails when the user is unblocked by an admin or has successfully logged in once.

deekayen’s picture

deekayen commented
Status: Needs review » Needs work

I'm not real thrilled about considering functionality changes that don't come with a 7.x patch, too.

aaronbauman’s picture

aaronbauman
he/him
commented
Version: 6.x-1.4 » 7.x-1.x-dev
Category: Feature request » Bug report
Related issues: +#184487: Message containing remaining login attempts

necro-post:
1. this persists into 7.x
2. at least some portion of this issue is a bug, per #184487: Message containing remaining login attempts, because the existing messaging doesn't make sense for users trying to login to nonexistent accounts.