User login fails silently when maintenance mode is active

Created on 1 August 2024, 3 months ago
Updated 2 August 2024, 3 months ago

Problem/Motivation

When a user tries to log in during maintenance mode without the "Use the site in maintenance mode" permission, the login fails. It is expected, but no message is displayed why did it fail.

Steps to reproduce

  1. Log in as administrator.
  2. Put the site in maintenance mode.
  3. Log out and try to log in with a user who doesn't have the "Use the site in maintenance mode" permission. Log in fails with valid credentials without any explanation about what happened.

Proposed resolution

The implemented solution shall not differentiate existing users from non-existing ones, we should avoid username enumeration.

Explain in a message that authentication failed because the user does not have "access site in maintenance mode" access.

OR

Follow the behavior of the user/register form and redirect the user to the maintenance page, with a small difference. User login would only perform a redirect after form submit and when the user does not have "access site in maintenance mode" access. (Again, this solution shall not differentiate existing and non-existing users.)

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component
Base 

Last updated about 1 hour ago

Created by

🇭🇺Hungary mxr576 Hungary

Live updates comments and jobs are added and updated live.
  • Needs issue summary update

    Issue summaries save everyone time if they are kept up-to-date. See Update issue summary task instructions.

Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024