I think would be great to allow the administrator to choose how to block the user. Will it be blocking completely or blocking with automatic unlocking after a certain time.

CommentFileSizeAuthor
#2 login_security-3013602-2-user-soft-blocking.patch6.13 KBknyshuk.vova

Issue fork login_security-3013602

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

knyshuk.vova created an issue. See original summary.

knyshuk.vova’s picture

knyshuk.vova commented
StatusFileSize
new login_security-3013602-2-user-soft-blocking.patch6.13 KB
knyshuk.vova’s picture

knyshuk.vova commented

Added checkbox "Enable soft user blocking"

If this checked than the user will not be able to submit the log in form again if specified number of login failures reached.
This protection is effective during the time indicated at track time option. When the track time is passed, the expired records with unsuccessful login attempts will be removed based on their creation time and the user will be able to reuse their login attempts. The user will not be blocked completely. The user still can use reset password form to recover their password and login with one-time login link.

knyshuk.vova’s picture

knyshuk.vova commented
Status: Active » Needs review

Status: Needs review » Needs work

The last submitted patch, 2: login_security-3013602-2-user-soft-blocking.patch, failed testing. View results

knyshuk.vova’s picture

knyshuk.vova commented

Important

To use soft user blocking you need to configure Drupal's flood system.
Drupal don't allow login if the failed attempts limit (flood limit) for this user has been reached. The flood system by default allow 5 failed attempts every 6 hours and cleansed expired attempts after cron execution. The flood limit should be increased to avoid conflicts between similar functionality. For example it may be increased to 500. Otherwise, the user will be blocked by default flood system.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Version: 8.x-1.x-dev » 2.x-dev
Issue tags: +Needs reroll

@knyshuk.vova could you reroll this against 2.x?

As MR please.

rpayanm made their first commit to this issue’s fork.

rpayanm opened merge request !13

rpayanm’s picture

rpayanm
he/him
Primary language Spanish
commented
Status: Needs work » Needs review
Issue tags: -Needs reroll
anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Status: Needs review » Needs work

@rpayanm sorry the tests are failing, could you have another look?

rpayanm’s picture

rpayanm
he/him
Primary language Spanish
commented

Trying to fix the failure.

rpayanm’s picture

rpayanm
he/him
Primary language Spanish
commented

I fixed the email test and I added a new one testBlockedAccountWithSoftBlocking, it is failing, and I don't know why. I tested it manually in a Drupal 10.0.1 site on my end and it worked.