From eefbfa82ef24a4427a6a2f117ae3eedd14fcf9ff Mon Sep 17 00:00:00 2001 From: Brian Wolff Date: Sun, 13 Nov 2016 05:11:49 +0000 Subject: [PATCH] Add extra logging for when user logs in with a temp password It would be good to keep better track of this in the logs Change-Id: I7f33b45f83034bfa1c003c149e92917b2f045988 --- .../TemporaryPasswordPrimaryAuthenticationProvider.php | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php b/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php index 9962fa3902..2e6f93c8f7 100644 --- a/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php +++ b/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php @@ -154,6 +154,16 @@ class TemporaryPasswordPrimaryAuthenticationProvider return $this->failResponse( $req ); } + // Add an extra log entry since a temporary password is + // an unusual way to log in, so its important to keep track + // of in case of abuse. + $this->logger->info( "{user} successfully logged in using temp password", + [ + 'user' => $username, + 'requestIP' => $this->manager->getRequest()->getIP() + ] + ); + $this->setPasswordResetFlag( $username, $status ); return AuthenticationResponse::newPass( $username ); -- 2.20.1