Temporary password lock is ineffective

ulsdevteam / pkp-betterPassword

Plugin to implement password requirements for PKP OJS/OMP

GNU General Public License v2.0

7 stars 6 forks source link

Temporary password lock is ineffective #3

Closed ctgraham closed 5 years ago

ctgraham commented 5 years ago

Wiping the password from the POST superglobal is ineffective to prevent login because OJS core has already cached the POST and GET data within the Request object.

https://github.com/ulsdevteam/pkp-betterPassword/blob/43dd2e61a30cea7bc9e08b48afb41669274b3488/BetterPasswordPlugin.inc.php#L270