Re: Bug #6337 Patch

Hi Florian

Following are the review comments:

• The "MAX_LOGIN_ATTEMPTS" parameter is not present in the config.py. It should be there with some default value maybe 3.
• Can be added like

##########################################################################

# MAX_LOGIN_ATTEMPTS which sets the number of failed login attempts that

# are allowed. If this value is exceeded the account is locked and can be

# reset by an administrator. By setting the variable to the value zero

# this feature is deactivated.

##########################################################################

MAX_LOGIN_ATTEMPTS = 3

• I have tested by specifying the above value, and it seems the logic is not correct. I can perform N number of unsuccessful attempts and when I provided the correct password it shows the flash message "Account locked".
• Once the account is locked, the pgAdmin4 server needs to restart, can we make it time-bound? I mean after N minutes user can try again, so no need to restart the pgAdmin4 server.