Problem/Motivation

Upon login, `_protected_forms_validate()` fires, and rejects my login because the length of my username is lower than `protected_forms_post_size_threshold`.

Steps to reproduce

Have a username shorter than 20 characters and attempt to log in via the normal user login form.

Proposed resolution

It doesn't really make sense to exempt the login form from protection, so I think there may need to be a special case to skip the POST size threshold for login.

Comments

MegaphoneJon created an issue. See original summary.

anaconda777’s picture

I have this issue also.
So after I installed the module, the site is almost unusable untill changed the "Minimum post-size" from 20 to 3

(So the reset password and login forms were not working after installing this module.)

By the way, why this module has a honey pot field, when there is a separate "honeypot" module for this same purpose?
Should this module focus only checking what is posted?

  • 601a9414 committed on 7.x-3.x
    Issue #3328708 by MegaphoneJon: User login fails minimum post size...
altagrade’s picture

Status: Active » Fixed

Please either use the latest dev or add 'user_login_block, user_register_form, user_pass user_login' to the Excluded forms field under Miscellaneous settings.

By the way, why this module has a honey pot field, when there is a separate "honeypot" module for this same purpose?

This module is being developed and maintained in the first place for a customer project (we are just sharing it with the community) for which Honeypot module was an overkill. You can safely use Honeypot module together with Protected Forms if you need, but you do not have to as a super-light alternative of Honeypot implemented in this module does the job very well.

sidgrafix’s picture

This does not appear to be fixed!

Updated to latest 3.1 for Drupal 7
drush cache:clear [2] all

and still cannot login!

EDIT:

Had to downgrade to the 2x module which then caused my IP to be blocked when visiting the user login
so had to access database and remove my IP from blocked_ip table to log back in

I then tried to update the module to 3.1 and had to clear the cache just to see the config page

Then tried adding user login and register to exclude list and logged out to try logging in again

Which FAILED with same initial results, where I then had to downgrade to 2.x and again upon accessing user/login caused my IP to be blocked

So I had to unblock IP again

PLEASE fix this..

If anyone else finds this issue - just downgrade and prepare to unblock your IP and don't bother upgrading until this issue is really fixed! You will need server and database access outside of your drupal install to do so. ( a real pain in the ...)

for mysql you need to be logged into db and can use this command from cmd-line
DELETE FROM `blocked_ips` WHERE ip='YOUR.IP.ADDR.HERE';

altagrade’s picture

@sidgrafix, quote from the previous comment:

Please either use the latest dev or add 'user_login_block, user_register_form, user_pass user_login' to the Excluded forms field under Miscellaneous settings.

The latest dev is on https://www.drupal.org/project/protected_forms/releases/2.0.x-dev

almador’s picture

I could confirm this problem, after updating to 7.x-3.1 the system started to ban me every time I was trying to login.

In 7.x-3.0 I was receiving the error:

Fatal error: Call to undefined function config_get()

From line #327:

$ban_threshold = config_get('protected_forms.settings', 'ban_threshold');

So I've downgraded to 7.x-2.0 and removed my IP from banned_ips table and now I could login, thanks sidgrafix!

p.s. AltaGrade, seems that you posted the wrong link. proper link is:
https://www.drupal.org/project/protected_forms/releases/7.x-2.x-dev

altagrade’s picture

@almador, thanks for noticing the incorrect link. In fact, the reported issue has been fixed in 7.x.3.x and the correct link is https://git.drupalcode.org/project/protected_forms/-/archive/7.x-3.x/pro... or https://git.drupalcode.org/project/protected_forms/-/archive/7.x-3.x/pro...

Please also see https://www.drupal.org/project/protected_forms/releases/7.x-3.x-dev

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

altagrade’s picture

Status: Closed (fixed) » Needs work

Today's change on Backdrop needs to be ported to Drupal: Disable native honeypot method if standalone Honeypot module is enabled