When a user is blocked by Flood API, there is no way to request password reset link, no warning displayed to user, and a wrong error message is logged.

Created on 7 July 2021, over 3 years ago
Updated 13 July 2023, over 1 year ago

Problem/Motivation

When a user requests password reset link multiple times, they will be blocked by Flood API.
After that, if the user requests again, Drupal does not show a proper warning,
Instead shows the normal message:
If %identifier is a valid account, an email will be sent with instructions to reset your password.
(No E-mail is sent!)

and the following message is logged to database:
Password reset form was submitted with an unknown or inactive account: %name.

when an administrator looks in dblog, they can't find the actual cause of the above message. It does not clarify whether the user is blocked, inactive, or only temporarily blocked by Flood!

Note that the user is still active, can login successfully, but cannot request password reset link!, weird situation.

@see \Drupal\user\Form\UserPasswordForm::validateForm()
@see \Drupal\user\Form\UserPasswordForm::submitForm()

πŸ› Bug report
Status

Closed: outdated

Version

9.5

Component
User systemΒ  β†’

Last updated 1 day ago

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024