Possible Conflict with Login Security Module

this is a bug in login security module -- it's trying to merge a variable that's not always an array. it needs the line $form['validate'] = is_array($form['validate']) ? $form['validate'] : array(); right before the line that's throwing the error.

got this error with user login bar and then removed it.

Made the patch as suggested but now its one line down and still appearing on 83

I'm getting this same array error, has there been a patch to fix this?

FYI if anyone is still having this error you can simply uninstall the login security module clear cache and error should be removed.

T Mac

Same problem here.

I really need LoginToboggan to set the login block to link. This is required to provide SSL login. To avoid the above error message I have to disable it. But I need the security options by Secure login. Can anyone please patch it?

What is the configuration in LT that you are using? there are a lot of options to play with.

I was unable to reproduce the issue you are talking about, but I've found that enabling 'email' login in LT, does not protect the login at all. I guess it is a problem in the order of the validators, but that is because LT changes the content of the field, replacing the email with the valid username.

function logintoboggan_user_login_validate($form, &$form_state) {
  if (isset($form_state['values']['name']) && $form_state['values']['name']) {
    if ($name = db_result(db_query("SELECT name FROM {users} WHERE LOWER(mail) = LOWER('%s')", $form_state['values']['name']))) {
      form_set_value($form['name'], $name, $form_state);
    }
  }
}

After some debug I've seen that (using LT with email login option enabled) with current #validate order in login form we are hitting the tracking check operation twice (once for the email, and other for the real name), but the email is never finished in a correct way, being the table full of email login attempts. I think we should check the right order here to merge well with LT.

I've also seen that there are no error checking in login_security_set_login_timestamp() and _login_security_get_variables_by_name(), and both function assume that $account exists.

and finally login_user_block_user_name() only show blocking message if user already exists, that could be used to enumerate non-existant users.

same here ....

I think I'll follow hunmonk's advice and include the array check. But I'm unsure all available login forms are being tracked by this module, only the core login forms are being handled right now. I'll provide a patch soon.

I had this conflict with the Secure Site module. Since I need site security of an Intranet project - I had to disabled the Login Security Module.

I am seeing the same error in watchdog,

array_merge() [<a href='function.array-merge'>function.array-merge</a>]: Argument #2 is not an array in /home/cshm/public_html/sites/all/modules/login_security/login_security.module on line 93.

[edit] Tried the suggestion in #1 by hunmonk to add a line before the error and the error still shows but as on the next line
array_merge() [<a href='function.array-merge'>function.array-merge</a>]: Argument #2 is not an array in /home/cshm/public_html/sites/all/modules/login_security/login_security.module on line 94.
[/edit]

I haven't a clue where we're at on this but in case anyone is interested in testing a patch as described in comment #1 here it is. It's been a while so even I'll have to take a look at it.

I actually had to deal with this recently. We were seeing a major slowdown in the Drupal system and after doing a performance audit and compared that with events in the New Relic server logging system we found a huge amount of activity going to the watchdog table which then lead us to this PHP error with the login security module.

It was producing a TON of errors. This is because the site loads a lot on every page load, including aggregated CSS and JS files which seems to be the main source of the errors. So every page load produces the error multiple times.

My solution is a bit different actually. What I do is put the validate parameters into its own array variable. Then I check to see if the form param isset and is an array. If it is not then set it with the value of the validate parameters array that was created. If it is an array then push the validate parameters array with array_merge(). This seems to fix it just fine.

Attached is my patch.

Committed #14.