symfony/symfony — pull request #9622 by craigmarvelley (2013-11-26 18:28:33+00:00)
Title: Check account isn't locked before user authentication

| Q | A
| ------------- | ---
| Bug fix? | [yes]
| New feature? | [no]
| BC breaks? | [no]
| Deprecations? | [no]
| Tests pass? | [yes]
| Fixed tickets | [#8510]
| License | MIT
| Doc PR | N/A

I agreed with the point raised in #8510 that if the user's account is locked we should no longer attempt to authenticate them, assuming that account locking in this case is a response to too many failed login attempts. A malicious user should be prevented from authenticating if they are attempting a brute force attack.

This PR implements the change suggested by @mmucklo in that issue, and updates the `UserChecker` class' tests appropriately.