plataformatec/devise — pull request #1534 by jigyasa (2011-12-29 18:44:36+00:00)
Title: Fix for a bug: Incorrect message for locked account

Thanks for the wonderful plugin. I encountered this issue that I could replicate in the latest code.

If a user has already been locked and he/she tries to login with correct password again, the 'failed_attempts' count is reset to zero. Any further attempts to login with incorrect password increments the 'failed_attempts' and gives out the "Invalid username or email' message instead of the expected 'Your account has been locked' until the count exceeds the maximum attempts allowed.
It could be so because Devise resets the 'failed_attempts' based on mainly the password validity and doesn't check for locked state. I've tried to fix the same.