Protecting the login and password-reset forms is blocked by missing phpBB core events

[bonelifer]

Hi! I had Claude dig into the login/lost-password limitation mentioned in the README's "Why not using the phpBB CAPTCHA system?" section, to see exactly what's missing, turns out it's not one uniform gap across all three forms.

Login form is actually half-coverable already. core.login_box_before exists and exposes a settable err string before credentials get checked, so the server-side "reject this submission" hook is there. What's actually missing is a template event in login_body.html to render the mosparo widget into the form, that file has zero template events at all.

Both password-reset steps ("forgot password" request, and "enter your new password" after clicking the emailed link) share one template file (ucp_reset_password.html, toggled by a conditional), and neither has a working verification event. The one event each step's PHP controller does have (core.ucp_remind_modify_select_sql, core.ucp_reset_password_modify_select_sql) only lets an extension tweak the SQL lookup query, no way to reject a bad submission.

I opened #1 with RFC docs proposing the specific events needed for all three forms, verified against real phpBB release-3.3.17 core (exact insertion points, current markup, proposed insertion). If these are ever filed as real requests, that happens at tracker.phpbb.com, which needs a phpbb.com account to log in, not an area51.phpbb.com one, those are separate account systems.

Not asking you to pursue this, just leaving the groundwork here in case it's ever useful, happy to hear if I've misjudged the login-form half being closer than the other two.

[zepich]

Hi @bonelifer

Thank you very much for your work!

Yes, from my perspective, the login forms only need the template event (as you wrote).

Another issue with the login form for me/us is that we cannot protect it on the front page. I'm not sure if there is an event (I guess not), but the main problem is that the form is very narrow and our big box would destroy the look and feel.

That's not a showstopper. We can protect the 'normal' login form and 'give' this small one on the front page away for free (for the bots). From a technical perspective, we would like to protect both.

Regarding the docs: As far as I can tell, you work a lot with phpBB. Do you think we have any chance of success by filing these RFCs?

I'm asking this question because I've had negative experiences with other systems where we gave feedback about missing events or integration functionality, which has made me hesitant to ask anyone to do anything specifically for mosparo.

Thank you very much for your help and opinion!

Kind regards,
zepich

[bonelifer]

I'm a Community team member(not a coder) at phpbb.com. Most request usually make it into the next release. As long as you give good reasons and provide as much information like the drafted RFC, most requests for templet/php events get approved. If you are reasonable the development team will work with you.