chore: add username_enumeration_prevention module

.dockerignore

@@ -4,7 +4,7 @@
 !docker
 !html/modules/custom
 !html/themes/custom
-!patches
+!PATCHES
 !scripts
 !composer.json
 !composer.lock

PATCHES/username_enumeration_prevention-user-login-block-form-3312288.patch

@@ -0,0 +1,20 @@
+diff --git a/username_enumeration_prevention.module b/username_enumeration_prevention.module
+index 1038f75b1d823887965f79df9d3b76fc396031a1..075abaa22c8392f810093e066990934328fdd01c 100644
+--- a/username_enumeration_prevention.module
++++ b/username_enumeration_prevention.module
+@@ -86,3 +86,15 @@ function username_enumeration_prevention_pass_submit($form, FormStateInterface $
+   \Drupal::messenger()->addMessage(t('If the username or email address exists and is active, further instructions have been sent to your email address.'));
+   $form_state->setRedirect('user.page');
+ }
++
++/**
++ * Implements hook_js_settings_alter().
++ *
++ * Remove drupalSettings.path.currentPath on 404 responses.
++ */
++function username_enumeration_prevention_js_settings_alter(&$settings) {
++  if (\Drupal::routeMatch()->getRouteName() === "system.404" ) {
++    $settings['path']['currentPath'] = '';
++  }
++}
++

composer.json

@@ -169,6 +169,7 @@
         "drupal/token_filter": "^2.0",
         "drupal/tome": "^1.4",
         "drupal/user_expire": "^1.0",
+        "drupal/username_enumeration_prevention": "^1.3",
         "drupal/userprotect": "^1.1",
         "drupal/video_embed_field": "^2.4",
         "drupal/views_base_url": "^2.0@beta",

composer.patches.json

@@ -1,26 +1,29 @@
 {
     "patches": {
         "drupal/anchor_link": {
-            "Design Issue": "patches/anchorlink/anchor_link-Integration-with-LinkIt-2958532.patch",
-            "CSS dialog Design Issue": "patches/anchorlink/anchor_link-styling_issue_in_link_dialog-2986268-11.patch"
+            "Design Issue": "PATCHES/anchorlink/anchor_link-Integration-with-LinkIt-2958532.patch",
+            "CSS dialog Design Issue": "PATCHES/anchorlink/anchor_link-styling_issue_in_link_dialog-2986268-11.patch"
         },
         "drupal/core": {
-            "CKeditor Image": "patches/ckeditor/2642808-69.patch",
-            "Warning": "patches/core/CoreError.patch",
+            "CKeditor Image": "PATCHES/ckeditor/2642808-69.patch",
+            "Warning": "PATCHES/core/CoreError.patch",
             "https://www.drupal.org/project/drupal/issues/3143617": "https://www.drupal.org/files/issues/2020-07-07/3143617-28_0.patch"
         },
         "drupal/csp": {
-            "Simplify log format": "patches/csp-log-format.patch"
+            "Simplify log format": "PATCHES/csp-log-format.patch"
         },
         "drupal/entity_browser": {
-            "expects parameter 1 to be array": "patches/entity_browser/entity_browser-key-2914385-6.patch"
+            "expects parameter 1 to be array": "PATCHES/entity_browser/entity_browser-key-2914385-6.patch"
         },
         "drupal/google_tag": {
-            "Error during cache rebuild when assets are stored on NFS": "patches/google_tag/3250315-google-tag-nfs-locks-5.patch"
+            "Error during cache rebuild when assets are stored on NFS": "PATCHES/google_tag/3250315-google-tag-nfs-locks-5.patch"
         },
         "drupal/user_expire": {
-            "Allow the notification email to be customised": "patches/user_expire/customize-notification-email.patch",
-            "Reset expiration when user is reactivated": "patches/user_expire/reset-expiration-on-reactivation.patch"
+            "Allow the notification email to be customised": "PATCHES/user_expire/customize-notification-email.patch",
+            "Reset expiration when user is reactivated": "PATCHES/user_expire/reset-expiration-on-reactivation.patch"
+        },
+        "drupal/username_enumeration_prevention": {
+            "Avoid leaking the path via Drupal.settings json": "PATCHES/username_enumeration_prevention-user-login-block-form-3312288.patch"
         }
     }
 }

config/core.extension.yml

@@ -133,6 +133,7 @@ module:
   user_event_dispatcher: 0
   user_expire: 0
   user_login: 0
+  username_enumeration_prevention: 0
   userprotect: 0
   video_embed_field: 0
   views_base_url: 0

docker/Dockerfile

@@ -60,5 +60,5 @@ COPY --from=builder /srv/www/composer.json /srv/www/composer.json
 COPY --from=builder /srv/www/composer.patches.json /srv/www/composer.patches.json
 COPY --from=builder /srv/www/composer.lock /srv/www/composer.lock
 COPY --from=builder /srv/www/symfony.lock /srv/www/symfony.lock
-COPY --from=builder /srv/www/patches /srv/www/patches
+COPY --from=builder /srv/www/PATCHES /srv/www/PATCHES
 COPY --from=builder /srv/www/docker/etc/nginx/apps/drupal/fastcgi_drupal.conf /etc/nginx/apps/drupal/fastcgi_drupal.conf