collective / Products.LoginLockout

Prevents endless login attempts in Plone, making it more secure.
https://pypi.python.org/pypi/Products.LoginLockout
2 stars 7 forks source link

Password change history is broken #23

Closed djay closed 1 year ago

djay commented 6 years ago

Relies on skin overrides which is a bad idea and also not longer works in plone 5.

Options

  1. Use a PAS password validation plugin and set it to the last one. This may ensure its only called when a new valid password has been entered?
    • con: if it works its still fragile
  2. override the password panel form https://github.com/plone/plone.app.users/blob/master/plone/app/users/browser/passwordpanel.py.
    • con: what if someone else overrides it or it changes in the future?
  3. Get a password changed event put into the core?
    • con: takes time and won't work for old versions