fix: enforce account lockout on Flask-Security's /login endpoint (#9904)

pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its own /authenticate/login
view. Flask-Security's default /login view (registered automatically by
security.init_app) was reachable but never consulted the locked field:

  - User inherited Flask-Security's UserMixin.is_locked(), which always
    returns True (= "not locked, proceed").
  - User inherited Flask-Login's is_active, which only checks the active
    column, not locked.

So an attacker with valid credentials could bypass a lockout by posting
to /login after triggering the counter at /authenticate/login.

Override both contracts on the User model so every auth path inherits
them:

  - is_active: False when active=False OR locked=True, so
    flask_security.login_user() refuses to mint a session.
  - is_locked(form_error): returns False (= "locked") and appends the
    same "Your account is locked" message /authenticate/login uses, so
    LoginForm.validate() rejects the submission cleanly.

Only INTERNAL accounts are reachable by the bypass (LDAP/OAuth2/Kerberos/
Webserver users have no local password, which LoginForm.validate rejects
before the locked check) and lockout itself is internal-only (auth_source
filter at authenticate/__init__.py:124), so the overrides only take
effect for INTERNAL accounts.

Adds a unit test covering the four (active, locked) combinations of the
contract LoginForm.validate() depends on.

Also includes a SQLite-only data-cleanup migration. Migration 6650c52670c2
added the locked column with server_default='false'. SQLite has no native
BOOLEAN affinity, so the literal 'false' was stored as TEXT both in the
column DEFAULT and on existing rows backfilled by ALTER TABLE.
SQLAlchemy's Boolean processor then reads that TEXT back as Python True
(because bool('false') is True for any non-empty string), which means
the new is_active override would otherwise see every legacy row as
locked and refuse login. The new migration normalize_locked_text_default
rewrites every SQLite row's locked to integer 0/1 (NULL -> 0); on a
PostgreSQL config DB the column was always stored as a proper BOOLEAN
so the migration is a no-op there (and integer literals would fail
on a BOOLEAN column anyway). SCHEMA_VERSION is bumped from 51 to 52.

Reported-by: Fernando Bortotti <fernando.bortotti@bsd.com.br>

Author: asheshv

web/migrations/versions/normalize_locked_text_default_.py

@@ -0,0 +1,72 @@
+##########################################################################
+#
+# pgAdmin 4 - PostgreSQL Tools
+#
+# Copyright (C) 2013 - 2026, The pgAdmin Development Team
+# This software is released under the PostgreSQL Licence
+#
+##########################################################################
+
+"""Normalize User.locked column data from TEXT to integer 0/1 (SQLite only)
+
+Migration 6650c52670c2 added the locked column with
+``server_default='false'``. SQLite has no native BOOLEAN affinity, so the
+literal 'false' was stored as TEXT both in the column DEFAULT and on
+existing rows backfilled by the ALTER TABLE. SQLAlchemy's Boolean
+processor then reads that TEXT back as Python ``True`` (because
+``bool('false')`` is ``True`` for any non-empty string), which means any
+code that branches on ``User.locked`` sees a locked-out account where
+the data should be unlocked.
+
+This was harmless for years because the only writer (the lockout block in
+``/authenticate/login``) writes Python ``True``/``False`` (stored as
+integer 1/0), and no reader branched on the field. The ``User.is_active``
+and ``User.is_locked`` overrides added for the lockout-bypass fix are
+the first readers, so they trip over every legacy row.
+
+The data corruption is SQLite-specific. PostgreSQL accepts the string
+``'false'`` for a BOOLEAN column and coerces it on insert, so existing
+rows on a PostgreSQL config DB already hold proper boolean values and
+need no fix. Restrict the data normalization to SQLite — the integer
+literals below would also fail on PostgreSQL because the locked column
+is BOOLEAN, not INTEGER.
+
+Revision ID: normalize_locked_text_default
+Revises: sharedserver_feature_parity
+Create Date: 2026-05-05
+
+"""
+from alembic import op
+
+
+# revision identifiers, used by Alembic.
+revision = 'normalize_locked_text_default'
+down_revision = 'sharedserver_feature_parity'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    bind = op.get_bind()
+    if bind.dialect.name != 'sqlite':
+        # On PostgreSQL the locked column was always stored as a proper
+        # BOOLEAN, so there is nothing to normalize. Skip — UPDATEs with
+        # integer literals against a BOOLEAN column would otherwise raise
+        # "column locked is of type boolean but expression is of type
+        # integer" on PostgreSQL.
+        return
+
+    op.execute(
+        "UPDATE \"user\" SET locked = 1 "
+        "WHERE LOWER(CAST(locked AS TEXT)) IN ('true', 't', 'yes', 'y', '1')"
+    )
+    op.execute(
+        "UPDATE \"user\" SET locked = 0 "
+        "WHERE locked IS NULL OR LOWER(CAST(locked AS TEXT)) NOT IN "
+        "('true', 't', 'yes', 'y', '1')"
+    )
+
+
+def downgrade():
+    # pgAdmin only upgrades, downgrade not implemented.
+    pass

web/pgadmin/model/__init__.py

@@ -18,6 +18,7 @@
    made to the config database to upgrade it to the new version.
 """
 
+from flask_babel import gettext
 from flask_security import UserMixin, RoleMixin
 from flask_sqlalchemy import SQLAlchemy
 from sqlalchemy.ext.mutable import MutableDict
@@ -33,7 +34,7 @@
 #
 ##########################################################################
 
-SCHEMA_VERSION = 51
+SCHEMA_VERSION = 52
 
 ##########################################################################
 #
@@ -211,6 +212,28 @@ class User(db.Model, UserMixin):
     login_attempts = db.Column(db.Integer, default=0)
     locked = db.Column(db.Boolean(), default=False)
 
+    @property
+    def is_active(self):
+        # Treat a locked account as inactive so Flask-Login's login_user()
+        # refuses to mint a session, regardless of which view authenticated
+        # the password. Without this, a lockout set by /authenticate/login
+        # is bypassed by a direct POST to Flask-Security's /login.
+        return self.active and not self.locked
+
+    def is_locked(self, form_error=None):
+        # Flask-Security's LoginForm.validate() calls this after password
+        # verification and treats the return value inverted: True means
+        # "not locked, proceed"; False means "locked, fail validation".
+        # The default UserMixin.is_locked unconditionally returns True,
+        # which is what allows the /login bypass on a locked account.
+        if self.locked:
+            if form_error is not None:
+                form_error.append(gettext(
+                    'Your account is locked. Please contact the '
+                    'Administrator.'))
+            return False
+        return True
+
 
 class Setting(db.Model, UserScopedMixin):
     """Define a setting object"""

web/pgadmin/tools/user_management/tests/test_locked_user.py

@@ -0,0 +1,80 @@
+##########################################################################
+#
+# pgAdmin 4 - PostgreSQL Tools
+#
+# Copyright (C) 2013 - 2026, The pgAdmin Development Team
+# This software is released under the PostgreSQL Licence
+#
+##########################################################################
+
+"""Regression tests for User model lockout enforcement.
+
+Flask-Security's default `/login` view (registered by `security.init_app`)
+calls `User.is_active` and `User.is_locked()` during form validation.
+Without these overrides on pgAdmin's User model, an account that has been
+locked via repeated failed attempts at `/authenticate/login` could still
+obtain a session by posting valid credentials directly to `/login`.
+"""
+
+from pgadmin.utils.route import BaseTestGenerator
+from pgadmin.model import User
+
+
+class TestLockedUser(BaseTestGenerator):
+    """Verifies the contract `flask_security.forms.LoginForm.validate()`
+    relies on:
+
+      - `is_active` -> False when the account is deactivated OR locked
+        (Flask-Login's `login_user()` then refuses the session).
+      - `is_locked(errors)` -> False when locked, True otherwise; populates
+        the supplied error list when locked so the form surfaces a message.
+    """
+
+    # Pure model-contract test - no Postgres server interaction needed.
+    # Skip BaseTestGenerator.setUp's connect_server() which would otherwise
+    # make this test depend on a healthy local PG.
+    def setUp(self):
+        pass
+
+    scenarios = [
+        ('active and not locked: login allowed',
+         dict(active=True, locked=False,
+              expect_is_active=True, expect_is_locked=True)),
+        ('active and locked: login blocked',
+         dict(active=True, locked=True,
+              expect_is_active=False, expect_is_locked=False)),
+        ('inactive and not locked: login blocked',
+         dict(active=False, locked=False,
+              expect_is_active=False, expect_is_locked=True)),
+        ('inactive and locked: login blocked',
+         dict(active=False, locked=True,
+              expect_is_active=False, expect_is_locked=False)),
+    ]
+
+    def runTest(self):
+        user = User()
+        user.active = self.active
+        user.locked = self.locked
+
+        self.assertEqual(
+            user.is_active, self.expect_is_active,
+            "is_active expected {0} for active={1}, locked={2}".format(
+                self.expect_is_active, self.active, self.locked))
+
+        form_errors = []
+        result = user.is_locked(form_errors)
+        self.assertEqual(
+            result, self.expect_is_locked,
+            "is_locked() expected {0} for locked={1}".format(
+                self.expect_is_locked, self.locked))
+
+        if self.locked:
+            self.assertTrue(
+                form_errors,
+                "is_locked() must populate form_error when account is "
+                "locked so the login form can surface the message")
+        else:
+            self.assertFalse(
+                form_errors,
+                "is_locked() must not append errors when account is not "
+                "locked")