Add RFC docs for the phpBB core events login/password-reset protection would need - #1
Merged
Conversation
Documents the phpBB core events needed to protect the login form and both steps of the password-reset flow the same way registration and posting are already protected: one existing PHP event on login, two new PHP verification events for the password-reset request/reset steps, and one shared template event both reset steps render through.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/events/with four RFC docs, following the same shape phpBB's own dev docs use for event proposals (rationale, exact current markup, exact proposed insertion, how it was verified againstrelease-3.3.17core).login_body_buttons_before.txt— the one template event needed to close the login-form gap.core.login_box_beforealready exists and can reject a bad attempt; the template just has nowhere to render a widget. Same proposed name as an identical gap another extension of mine ran into independently, worth being one shared request rather than two competing ones if this ever gets filed against phpBB.ucp_remind_request_before.txt— a real verification PHP event for the "forgot password, enter your email" step.ucp_reset_password_verify_before.txt— the matching PHP event for the "enter your new password" step, plugging directly into the$errorsarray that step already has.ucp_reset_password_widget_before.txt— one shared template event covering both reset steps, since they render through the same file. (ucp_resend.htmlturned out to be a separate feature, resending the account-activation email, not part of this flow, so it's not part of this proposal.)If any of these get filed as real requests, that happens at tracker.phpbb.com: log in with a phpbb.com account (not area51.phpbb.com, those are separate account systems), click Create, and use the RFC doc's rationale as the ticket description.
Not proposing any changes to this repo's own code, these are reference material for that future ask, kept here so the research doesn't need to be redone.