{"action":"created","issue":{"url":"https://api.github.com/repos/SimpleMachines/SMF2.1/issues/4297","repository_url":"https://api.github.com/repos/SimpleMachines/SMF2.1","labels_url":"https://api.github.com/repos/SimpleMachines/SMF2.1/issues/4297/labels{/name}","comments_url":"https://api.github.com/repos/SimpleMachines/SMF2.1/issues/4297/comments","events_url":"https://api.github.com/repos/SimpleMachines/SMF2.1/issues/4297/events","html_url":"https://github.com/SimpleMachines/SMF2.1/issues/4297","id":257582306,"number":4297,"title":"3 Login Errors","user":{"login":"sbulen","id":23568484,"avatar_url":"https://avatars3.githubusercontent.com/u/23568484?v=4","gravatar_id":"","url":"https://api.github.com/users/sbulen","html_url":"https://github.com/sbulen","followers_url":"https://api.github.com/users/sbulen/followers","following_url":"https://api.github.com/users/sbulen/following{/other_user}","gists_url":"https://api.github.com/users/sbulen/gists{/gist_id}","starred_url":"https://api.github.com/users/sbulen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbulen/subscriptions","organizations_url":"https://api.github.com/users/sbulen/orgs","repos_url":"https://api.github.com/users/sbulen/repos","events_url":"https://api.github.com/users/sbulen/events{/privacy}","received_events_url":"https://api.github.com/users/sbulen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-09-14T03:16:48Z","updated_at":"2017-09-25T17:35:29Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"When there is a cookie/session issue, trying to login gives inappropriate error messages.  \r\n\r\nTo reproduce:\r\n(1) Under Admin | Maintenance | Server Settings | Cookies & Sessions, change the value for \"Enable Local Storage of Cookies\".   (Changing this value properly affects _future_ cookie behavior, but screws up _active_ sessions...)\r\n(2) Log out.\r\n(3) Try to logon 3 times in rapid succession.  Quick is important.  \r\n\r\nBy the way, you are now LOCKED OUT...  You must delete your SMF cookie to log back in.  \r\n\r\nThe errors:  \r\n(1)  When logging on, you get \"Your session timed out when posting.  Please go back and try again.\"  Which makes no sense...  \r\n![login-1](https://user-images.githubusercontent.com/23568484/30410306-132964be-98bf-11e7-8359-c6ca908e67b1.JPG)\r\n\r\n(2)  On your 3rd attempt, it does not properly display the error message.  When trying to report \"Sorry, but you've reached your login attempts threshold for account xxxxxx. Please wait 30 seconds and try again later.\", instead, all you get is:\r\n![login-2](https://user-images.githubusercontent.com/23568484/30410417-c42235de-98bf-11e7-9097-040fb204a8d3.JPG)\r\n\r\n(3) The code checks for 5 login attempts.  Why did it fail after 3?  The problem is that validatePasswordFlood() is called from multiple places during login, doubling up on the count of attempts.   Your 3rd attempt internally is 5/6 due to the double-counting.   Not a huge issue, but an indication that some streamlining is in order.  \r\n\r\nI considered logging these as 3 separate issues.  If you want me to do so I'll split them up.  \r\n\r\nI do think this is kind of important, as it appears to me that there are certain admin tasks & settings updates that will basically lock folks out...  The only way to recover is to delete the cookie.  "},"comment":{"url":"https://api.github.com/repos/SimpleMachines/SMF2.1/issues/comments/331955721","html_url":"https://github.com/SimpleMachines/SMF2.1/issues/4297#issuecomment-331955721","issue_url":"https://api.github.com/repos/SimpleMachines/SMF2.1/issues/4297","id":331955721,"user":{"login":"Sesquipedalian","id":191731,"avatar_url":"https://avatars0.githubusercontent.com/u/191731?v=4","gravatar_id":"","url":"https://api.github.com/users/Sesquipedalian","html_url":"https://github.com/Sesquipedalian","followers_url":"https://api.github.com/users/Sesquipedalian/followers","following_url":"https://api.github.com/users/Sesquipedalian/following{/other_user}","gists_url":"https://api.github.com/users/Sesquipedalian/gists{/gist_id}","starred_url":"https://api.github.com/users/Sesquipedalian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Sesquipedalian/subscriptions","organizations_url":"https://api.github.com/users/Sesquipedalian/orgs","repos_url":"https://api.github.com/users/Sesquipedalian/repos","events_url":"https://api.github.com/users/Sesquipedalian/events{/privacy}","received_events_url":"https://api.github.com/users/Sesquipedalian/received_events","type":"User","site_admin":false},"created_at":"2017-09-25T17:35:29Z","updated_at":"2017-09-25T17:35:29Z","author_association":"MEMBER","body":"I'd say that this should actually be considered four issues. The first part is \"Changing this value properly affects future cookie behavior, but screws up active sessions...\" After that we have the two different bugs with wrong error messages, and finally the double count of validatePasswordFlood().\r\n\r\nRegarding the first of these, I wonder if enabling/disabling cookie related settings (local storage, global cookies, etc.) should automatically invalidate all current cookies and end all sessions, thereby requiring everyone to log back in."}}
{"actor":{"display_login":"Sesquipedalian"}}