Database Fatal error for long username

[henriquejsfj]

The login by email is getting fatal error (blank screen).

Explanation:
OJS username are set as in DB as VARCHAR(32), however, it allows login with e-mail which is VARCHAR(255).
So, you set table badpw_failedlogins with username as VARCHAR(32) which is correct, but it tries to insert the email as the username, getting error from database.

A solution would find the username for that email.

[ctgraham]

In order to prevent disclosure of valid usernames, we record and block based on the field input (even if unmatched for a user). So, we will need to extend this field in badpw_failedlogins to VARCHAR(255).

[henriquejsfj]

@ctgraham I am going to submit a PR in a couple of minutes!

[henriquejsfj]

In order to prevent disclosure of valid usernames, we record and block based on the field input (even if unmatched for a user). So, we will need to extend this field in badpw_failedlogins to VARCHAR(255).

@ctgraham yeah, that would be a hot fix, but system would still get fatal error for usernames bigger than 255 and would avoid the LimitRetry by changing with username/email... I hope you appreciate my PR

[ctgraham]

Yes, thank you for the recent contributions!

I do like the idea of resolving the email to a username when possible, but on the other hand, I consider it a firm requirement to have the same behavior whether someone tries a valid email / username vs. a non-existent email / username.

We might introduce some randomness to the count of email -> username lookups, but event that will eventually leak the validity of a username / email with repeated retries.

I'd like to extend the database table to support 255 characters, and truncate the input to 255 characters to avoid any SQL errors.

[henriquejsfj]

I see your point @ctgraham

I made another PR. So, you may choose which suits better and close the other.