If a site uses or allows user email as the login username AND this email is different from the account "name" field, the module does not allow login when using a working password.
To recreate:
name column in the user table so it does not match the mail value for a user with a known passwordname value back to matching the mail column. Login Security will now allow the login using the same password.Maintainer note: That would be expected behavior and is correct, but we guess you mean there are issues with modules like
This is due to lines 404-408 of login_security.module - the module attempts to load the user by name using user_load_by_name() and if this fails loading user 0. Preferably the module should attempt to load a user with user_load_by_mail() if $account is empty and only load user 0 if it is still empty after that.
| Comment | File | Size | Author |
|---|---|---|---|
| #10 | login_security-3019769.patch | 1.9 KB | jvizcarrondo |
| #2 | checks_user_by_mail-3019769-2.patch | 541 bytes | mojiferous |
Comments
Comment #2
mojiferousComment #3
baikho commentedComment #4
anybodyIs this still an issue with 2.x?
Comment #5
anybody@Mojiferous could you please prepare the patch as MR against 2.x?
Comment #6
anybodyComment #7
anybodyThe fix isn't that simple. We can't simply use the email address as username alternative here.
This module is based on the regular core behavior to login by "Username". If the username equals the eMail address, that will also work, but it's not intended to work with something different and also shouldn't.
Instead, we should have a look, how modules like
implement this and how we can act upon, provide a hook or whatever. Still this needs further investigation and work.
Comment #8
anybodyIn a first step, someone has to check, if it's really broken with both or one of these modules. The issue summary described expected behavior and sounds untypical.
Comment #9
anybodyComment #10
jvizcarrondo commentedI have created a patch that seems to work with the module Mail Login, not yet tested with Login Email or Username.
unfortunately, it is made for version 2.x-dev, I think that taking it to version 2.0.1 will not be very complicated
Comment #11
rohan-sinha commentedYeah sure @jvizcarrondo , will try and test the patch for both Mail Login and Login Email or Username, thanks for contributing.
Comment #12
anybodyPlease do not only test manually, but also add testing submodules for both integrations to have automated tests. Otherwise we can't be sure it will work in the future.
These tests should be separated as they introduce specific dependencies.
Comment #13
jackg102 commentedEarlier this week, I attempted to apply either patch (#2 and #10) to the develop branch of the Login Security module. Unfortunately, each failed to apply. I am curious if others are having a similar issue? I suppose the patch might need to be rerolled? We are using the Mail Login module. When we uninstall the Mail Login module, the Login Security module works perfectly!
Comment #14
anybodyPlease create a MR instead of proceeding with patches. Thank you!