z3c.password and tracking failed login attempts
Hi, A while ago I asked some questions and made some suggestions for improving how to track failed login attempts in z3c.password. Most likely these suggestions got buried in now a out-of-sight thread and were never noticed. My suggestion was that making a request for for example a resource could still trigger the account locked errors, where in my opinion only the login attempts themselves should do that. I created a branch of z3c.password..: http://svn.zope.org/z3c.password/branches/jw-noraise-for-irrelevant-requests... ..that will check for request relevancy as early as possible. All tests pass without modification, but with this change after an account has been locked out requests for for example resources will still work. Additionally I think the code is a tad more readible now. I added a test to demonstrate the specific behaviour. Would any of the z3c.password users/developers object to having this branch merged to the trunk? regards, jw
Hi Jan
Betreff: [Zope-dev] z3c.password and tracking failed login attempts
Hi,
A while ago I asked some questions and made some suggestions for improving how to track failed login attempts in z3c.password. Most likely these suggestions got buried in now a out-of-sight thread and were never noticed.
My suggestion was that making a request for for example a resource could still trigger the account locked errors, where in my opinion only the login attempts themselves should do that. I created a branch of z3c.password..: http://svn.zope.org/z3c.password/branches/jw-noraise-for-irrel evant-requests/ ..that will check for request relevancy as early as possible. All tests pass without modification, but with this change after an account has been locked out requests for for example resources will still work. Additionally I think the code is a tad more readible now. I added a test to demonstrate the specific behaviour. Would any of the z3c.password users/developers object to having this branch merged to the trunk?
Adam is on holiday this week. I'm sure he will take a look at the branch next monday. Regards Roger Ineichen
regards, jw
Hello Jan, Looks good. The only weird is to define those constants in the method parameters. def _isIrrelevantRequest(self, RELEVANT=False, IRRELEVANT=True): Do you call this method from somewhere else? Maybe it would be better to change the name (and behavour) to _isRelevantRequest and go with plain True/False instead of those constants. Monday, March 8, 2010, 9:15:06 PM, you wrote: JWK> Hi, JWK> A while ago I asked some questions and made some suggestions for improving how JWK> to track failed login attempts in z3c.password. Most likely these suggestions JWK> got buried in now a out-of-sight thread and were never noticed. JWK> My suggestion was that making a request for for example a resource could still JWK> trigger the account locked errors, where in my opinion only the login attempts JWK> themselves should do that. JWK> JWK> I created a branch of z3c.password..: JWK> JWK> JWK> http://svn.zope.org/z3c.password/branches/jw-noraise-for-irrelevant-requests... JWK> JWK> ..that will check for request relevancy as early as possible. JWK> JWK> All tests pass without modification, but with this change after an account has JWK> been locked out requests for for example resources will still work. Additionally JWK> I think the code is a tad more readible now. I added a test to demonstrate the JWK> specific behaviour. JWK> JWK> Would any of the z3c.password users/developers object to having this branch JWK> merged to the trunk? JWK> regards, jw JWK> _______________________________________________ JWK> Zope-Dev maillist - Zope-Dev@zope.org JWK> https://mail.zope.org/mailman/listinfo/zope-dev JWK> ** No cross posts or HTML encoding! ** JWK> (Related lists - JWK> https://mail.zope.org/mailman/listinfo/zope-announce JWK> https://mail.zope.org/mailman/listinfo/zope ) -- Best regards, Adam GROSZER mailto:agroszer@gmail.com -- Quote of the day: Everything you know is wrong!
Adam GROSZER <agroszer@gmail.com> wrote:
Looks good.
The only weird is to define those constants in the method parameters.
def _isIrrelevantRequest(self, RELEVANTlse, IRRELEVANT ue):
Do you call this method from somewhere else?
Maybe it would be better to change the name (and behavour) to _isRelevantRequest and go with plain True/False instead of those constants.
Hmm, right. I'd hoped to make it more understandable what "True" meant and what "False" meant in this context. But by changing the name of the method itself, it'll probably just as good. I'll change that and then merge it with the trunk. I'll make a release of z3c.password then too, if you agree with that. regards, and thanks, jw
Wednesday, March 24, 2010, 10:01:02 AM, you wrote: JWK> I'll make a release of z3c.password then too, if you agree with that. Sure. I'd go with a minor version increment. E.g. 0.10.1. -- Best regards, Adam GROSZER mailto:agroszer@gmail.com -- Quote of the day: Truth hurts - not the searching after; the running from! - John Eyberg
Adam GROSZER <agroszer@gmail.com> wrote:
JWK> I'll make a release of z3c.password then too, if you agree with that.
Sure. I'd go with a minor version increment. E.g. 0.10.1.
We were at 0.9.0, I made it a 0.10.0. Great for having these features available!! regards, jw
participants (3)
-
Adam GROSZER -
Jan-Wijbrand Kolman -
Roger