Problem/Motivation
Upon login, `_protected_forms_validate()` fires, and rejects my login because the length of my username is lower than `protected_forms_post_size_threshold`.
Steps to reproduce
Have a username shorter than 20 characters and attempt to log in via the normal user login form.
Proposed resolution
It doesn't really make sense to exempt the login form from protection, so I think there may need to be a special case to skip the POST size threshold for login.
Comments
Comment #2
anaconda777 commentedI have this issue also.
So after I installed the module, the site is almost unusable untill changed the "Minimum post-size" from 20 to 3
(So the reset password and login forms were not working after installing this module.)
By the way, why this module has a honey pot field, when there is a separate "honeypot" module for this same purpose?
Should this module focus only checking what is posted?
Comment #4
altagrade commentedPlease either use the latest dev or add 'user_login_block, user_register_form, user_pass user_login' to the Excluded forms field under Miscellaneous settings.
This module is being developed and maintained in the first place for a customer project (we are just sharing it with the community) for which Honeypot module was an overkill. You can safely use Honeypot module together with Protected Forms if you need, but you do not have to as a super-light alternative of Honeypot implemented in this module does the job very well.
Comment #5
sidgrafix commentedThis does not appear to be fixed!
Updated to latest 3.1 for Drupal 7
drush cache:clear [2] all
and still cannot login!
EDIT:
Had to downgrade to the 2x module which then caused my IP to be blocked when visiting the user login
so had to access database and remove my IP from blocked_ip table to log back in
I then tried to update the module to 3.1 and had to clear the cache just to see the config page
Then tried adding user login and register to exclude list and logged out to try logging in again
Which FAILED with same initial results, where I then had to downgrade to 2.x and again upon accessing user/login caused my IP to be blocked
So I had to unblock IP again
PLEASE fix this..
If anyone else finds this issue - just downgrade and prepare to unblock your IP and don't bother upgrading until this issue is really fixed! You will need server and database access outside of your drupal install to do so. ( a real pain in the ...)
for mysql you need to be logged into db and can use this command from cmd-line
DELETE FROM `blocked_ips` WHERE ip='YOUR.IP.ADDR.HERE';Comment #6
altagrade commented@sidgrafix, quote from the previous comment:
The latest dev is on https://www.drupal.org/project/protected_forms/releases/2.0.x-dev
Comment #7
almador commentedI could confirm this problem, after updating to 7.x-3.1 the system started to ban me every time I was trying to login.
In 7.x-3.0 I was receiving the error:
Fatal error: Call to undefined function config_get()From line #327:
So I've downgraded to 7.x-2.0 and removed my IP from banned_ips table and now I could login, thanks sidgrafix!
p.s. AltaGrade, seems that you posted the wrong link. proper link is:
https://www.drupal.org/project/protected_forms/releases/7.x-2.x-dev
Comment #8
altagrade commented@almador, thanks for noticing the incorrect link. In fact, the reported issue has been fixed in 7.x.3.x and the correct link is https://git.drupalcode.org/project/protected_forms/-/archive/7.x-3.x/pro... or https://git.drupalcode.org/project/protected_forms/-/archive/7.x-3.x/pro...
Please also see https://www.drupal.org/project/protected_forms/releases/7.x-3.x-dev
Comment #10
altagrade commentedToday's change on Backdrop needs to be ported to Drupal: Disable native honeypot method if standalone Honeypot module is enabled