Allow users to unblock their account once they used "request new password link"

There are changes in this patch that are out of scope like

+/**
+ * @file
+ */
+

and

-  if(empty($value)){
+  if (empty($value)) {

If it doesnt exists yet, please create an issue for code styling issues instead.

This creates a log notice with only the url as message? Can you expand this, so it includes better information?:

+    \Drupal::logger('flood_control')->notice($request_uri);

Same here: instead of just printing some IDs, add a bit more information:

+  \Drupal::logger('flood_control')->notice(json_encode($results));

We already have a function to clear flood events: floodUnblockClearEvent. Can you re-use that instead of a new custom function _flood_control_clear_log ?

If I do not want this functionality on my website (because I really want this visitor to wait a couple of weeks before he can login in again), there should be a way to disable it. So, we would need a setting to enable/disable this functionality. Make it disabled by default.

If I do not want this functionality on my website (because I really want this visitor to wait a couple of weeks before he can login in again), there is now a way to disable it. And removed the code style fixes.

This is improving.

But there is still a couple of issue with this patch:

1. This creates a log notice with only the url as message:

\Drupal::logger('flood_control')->notice($request_uri);

Can you expand this, so it includes better information?:

2. Same here: instead of just printing some IDs, add a bit more information:

\Drupal::logger('flood_control')->notice(json_encode($results));

3. We already have a function to clear flood events: floodUnblockClearEvent. Can you re-use that instead of a new custom function _flood_control_clear_log ?

+/**
+ * Custom function for clear the flood.
+ */
+function _flood_control_clear_log() {
+ $database = \Drupal::database();
+ $results = $database->select('flood', 'f')
+ ->fields('f', ['identifier', 'timestamp', 'fid'])
+ ->condition('identifier', $database->escapeLike(\Drupal::currentUser()->id()), '=')
+ ->execute()
+ ->fetchAll();
+ foreach ($results as $key => $value) {
+ $parts = explode('-', $value->identifier);
+
+ if (!empty($parts[0])) {
+ $query_delete = $database->delete('flood')->condition('fid', $value->fid);
+ $success = $query_delete->execute();
+ }
+ }
+
+ \Drupal::logger('flood_control')->notice(json_encode($results));
+}

I am working on it.

Hi @batigolix,

I have removed log notices code as it looks like added for testing purpose only, as you mentioned in Point 1 and 2.

For point 3, i have updated the delete query code with the function floodUnblockClearEvent of flood_control.flood_unblock_manager service.

Thnaks
Samit K.

After some testing your patch a bit more I realised this must be a Drupal core issue that someone must have ran into before
I found this issue, which addresses the same problem
https://www.drupal.org/project/drupal/issues/992540 🐛 Nothing clears the "5 failed login attempts" security message when a user resets their own password Fixed

I suppose we don't need to solve this in Flood Control, agree?

I am postponing this issue as it might be solved in Drupal core 🐛 Nothing clears the "5 failed login attempts" security message when a user resets their own password Fixed