Account locked unexpectedly

[jonasraoni]

If we get an account locked by exceeding the number of attempts, then wait for the lock expiration, the next login attempt will still display a message stating that the account is locked.

I'll open a PR to address this and also cleanup expired entries, to avoid accumulating data and bad usernames (e.g. ' OR 1=1; --).

PRs

• Bugfix/stable 3 3/63 fix lock message #64

[jonasraoni]

@ctgraham not sure if you're watching the notifications. If yes, then I won't tag you on any other issue from now on 😎

[jonasraoni]

FYI I've also included a helpful message to instruct the users, they don't know it's possible to unlock the account by resetting the password.

[wopsononock]

Hi Jonas. Thanks for the report. It took me a while to pin down what exactly was happening. To reproduce, here's what I did and how I think it was working:

Incur a lockout by exceeding the retry limit
Wait for lockout to expire
Fail once more
EXPECTED: normal password failure message
ACTUAL: Lockout message (lockout does not actually occur as db counter is reset due to the time expiry)
but the $count counter in the code doesn't get reset and triggers the warning message
User can still log in with correct credentials without waiting, but does see the misleading message.

[wopsononock]

I ended up making a much more limited PR to address this due to time constraints on my end. I'm going to review with Clinton, but I'd be happy to add you as a co-author if we go that direction. #66

[jonasraoni]

Yeah, I've added more things, a helpful message + cleanup of entries (if you take a look at a production data, you'll see a lot of trash there).