isLockedOut() in Member.php call LoginAttempt::getByEmail but it passes to it the unique_identifier_field instead $this->Email

[alessandromarotta]

The public function isLockedOut() in Member.php call LoginAttempt::getByEmail but serves to it the unique_identifier_field.

This PR could allow to extensions to patch the use of uniqueidentifierfield (otherwise it would be necessary to extends the Member Class to override the isLockedOut function, with a lot of problems)

[dhensby]

See #9507

[kinglozzer]

If email isn’t the unique identifier field, then you could have multiple accounts with the same email address (or, my bigger concern, null). If the email address can be null, one person getting themselves locked out could potentially result in everyone being locked out

[dhensby]

This function is explicitly about getting loginattempts by email; not about getting it by unquie identifier.

The MemberAuthentictor only pushes the Email and doesn't try to discern the unique identifier of a member, so it's all a bit moot.

If potentially null emails are a problem, then we could filter that out when looking up or creating loginattempts.

I think if developers are taking the step to use a different identifier for authentication then I think they would be taking a lot greater steps than just assuming all this stuff works without a decent amount of effort.

Login attempt tracking won't work if the submitted form data doesn't contain an Email field, so if you aren't logging in with Email and you want login tracking, you're going to have to do a decent amount of customisation.

[alessandromarotta]

I think that the email should always be present and required for the registration of a user, as it is essential for password recovery. So I think it is correct to record (and get) the login attempts by email address, as it is the only field certainly present and real.

[dhensby]

Just because email addresses are provided during registration doesn't mean they'll be present during login, though. If you login with a username that doesn't exist, how do you track an email against it?

[robbieaverill]

Thanks @alessandromarotta