The text says Try again later or request a new password. And if you ask for a new password then we do not clear the flood. So if you log out after the successful reset and then try to log back in, you can't. And yes, people do that.

CommentFileSizeAuthor
flood_clear_on_pass_reset.patch1.92 KBchx

Comments

grendzy’s picture

grendzy commented

This patch would allow anyone with an account to completely bypass IP-based flood protection. (Repeatedly requesting new a new password would be easy to automate.) Considering that registration may be open to anyone, is it worth it?

cashwilliams’s picture

cashwilliams commented
Status: Needs review » Closed (duplicate)

I don't see how someone automating a password reset is a security concern. Worst case, the user gets flooded with reset emails...

#992540: Nothing clears the "5 failed login attempts" security message when a user resets their own password