All users, even admin, locked out of plinth by one careless user
Three steps, all the same, to reproduce:
- User enters wrong password at Plinth login,
- User enters wrong password at Plinth login a second time,
- User enters wrong password at Plinth login a third time.
Done. It is now impossible for any user, including administrative users, to get to the login prompt by clicking the login button. Clicking on the log in button in Plinth, instead of leading to <domainname>/plinth/account/login
, redirects to <domainname>/plinth/accounts/login/locked/?username=
which displays the screen shown in the screenshot below.
The solution outlined here allows one to recover the login prompts. (pointing ones browser towards <domainname>/plinth/locked/
)
Expected behaviour:
- The login screen should always be available.
- Only users who have misentered their credentials 3 times in a row should be shown a lockout screen after each subsequent login attempt and be required to reclick the login button to get back to the login screen.
- Only users who have misentered their credentials 3 times in a row should be obliged to contact the admin in order to get the link with the captcha so that they can redeem their login.
I feel all users shouldn't be denied access because of one clumsy user.