Redmine

    redirect_to(home_url) && return unless user.status == User::STATUS_REGISTERED || user.status == User::STATUS_LOCKED

    user.failed_logins = 0

      # Invalid credentials      

      flash.now[:error] = remaining_login_attempts_notice params[:username]

  def successful_authentication(user)    

    # Reset count for failed authentication attempts

    user.failed_logins = 0

    user.save

  def remaining_login_attempts_notice(user_name)

      user = User.find_by_login(user_name)

      allowed_attempts = Setting.allowed_login_attempts.to_i

      return l(:notice_account_invalid_creditentials) if user.nil? || allowed_attempts == 0

      if allowed_attempts - user.failed_logins > 0

        s = l(:notice_account_invalid_creditentials)

        s << " "

        s << l(:notice_remaining_login_attempts, :value => (allowed_attempts - user.failed_logins))

      else

        s = l(:notice_too_many_login_attempts)

      end

    s 

  end

  def account_locked(token, user)

    set_language_if_valid(user.language)

    recipients user.mail

    subject l(:mail_subject_account_locked, :value => Setting.app_title)

    body :project => Setting.app_title, :token => token,

         :url => url_for(:controller => 'account', :action => 'activate', :token => token.value)

  end

  def admin_info_locked_account(user, admin_mail)

    recipients admin_mail

    subject l(:mail_subject_admin_info_locked_account, :value => user.login)

    body :value => user.login

  end

  attr_protected :login, :admin, :password, :password_confirmation, :hashed_password, :failed_logins

      if user.auth_source        

        if !user.auth_source.authenticate(login, password)        

          user.authentication_failed user

          return nil

        end

        if User.hash_password(password) != user.hashed_password

          user.authentication_failed

          return nil

        end       

  def authentication_failed

    self.failed_logins = self.failed_logins + 1

    if self.failed_logins >= Setting.allowed_login_attempts.to_i && Setting.allowed_login_attempts != 0

      self.status = 3

      token = Token.new(:user => self, :action => "register")

      token.save     

      Mailer.deliver_account_locked(token, self)

      if !Setting.too_many_logins_email.empty?

        logger.info("Sending admin mail.")

        Mailer.deliver_admin_info_locked_account(self, Setting.too_many_logins_email)

      end

    end    

    self.save

  end

<p><%= l(:mail_body_account_locked, :value => @project) %></p>

<%= auto_link(@url) %></p>

<%= l(:mail_body_account_locked, :value => @project) %>

<%= auto_link(@url) %>

<p><%= l(:mail_body_admin_info_locked_account, :value => @value) %></p>

<%= l(:mail_body_admin_info_locked_account, :value => @value) %>

<p><label><%= l(:label_allowed_login_attempts) %></label>

<%= text_field_tag 'settings[allowed_login_attempts]', Setting.allowed_login_attempts, :size => 6%><br /><em><%= l(:text_login_attempts) %></em></p>

<p><label><%= l(:label_too_many_logins_email) %></label>

<%= text_field_tag 'settings[too_many_logins_email]', Setting.too_many_logins_email, :size => 60%><br /><em><%= l(:text_account_locked_notification_address) %></em></p>

  notice_account_invalid_creditentials: Invalid user or password.

  notice_remaining_login_attempts: "{{value}} login attempt(s) left."

  notice_too_many_login_attempts: "Too many login attempts. Your account has been locked and an administrator has been informed."

  mail_subject_account_locked: "Your {{value}} account has been locked"

  mail_body_account_locked: "You or someone else attempted too often to log in to your {{value}} account. Your account has been locked to protect you and your project. To reactivate your account, click on the following link: "

  mail_body_admin_info_locked_account: "Due to too many failed login attempts, the account {{value}} has been locked."

  mail_subject_admin_info_locked_account: "Account {{value}} locked."

  label_allowed_login_attempts: Allowed login attempts

  label_too_many_logins_email: Notify admin if locked

  text_login_attempts: 'Put 0 to allow unlimited login attempts.'

  text_account_locked_notification_address: "Set an administrator's email address to be notified if an account was locked because of too many login attempts.\nLeave this empty to notify noone."

allowed_login_attempts:

  default: 0

too_many_logins_email:

  default: ''

class AddFailedLoginsToUsers < ActiveRecord::Migration

  def self.up

    add_column :users, :failed_logins, :integer, :default => 0

  end

  def self.down

    remove_column :users, :failed_logins

  end

end

  def test_login_attempts

    Setting.allowed_login_attempts = 2

    user = User.try_to_login("admin", "wrong")

    assert_equal nil, user

    user = User.try_to_login("admin", "admin")

    assert_equal "admin", user.login

    user = User.try_to_login("admin", "wrong")

    user = User.try_to_login("admin", "wrong")

    user = User.try_to_login("admin", "admin")

    assert_equal nil, user   

  end