From: Brian Wolff <bawolff+wn@gmail.com>
Date: Sun, 13 Nov 2016 05:11:49 +0000 (+0000)
Subject: Add extra logging for when user logs in with a temp password
X-Git-Tag: 1.31.0-rc.0~4875^2
X-Git-Url: https://git.cyclocoop.org/%7B%7B%20url_for%28?a=commitdiff_plain;h=eefbfa82ef24a4427a6a2f117ae3eedd14fcf9ff;p=lhc%2Fweb%2Fwiklou.git

Add extra logging for when user logs in with a temp password

It would be good to keep better track of this in the logs

Change-Id: I7f33b45f83034bfa1c003c149e92917b2f045988
---

diff --git a/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php b/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php
index 9962fa3902..2e6f93c8f7 100644
--- a/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php
+++ b/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php
@@ -154,6 +154,16 @@ class TemporaryPasswordPrimaryAuthenticationProvider
 			return $this->failResponse( $req );
 		}
 
+		// Add an extra log entry since a temporary password is
+		// an unusual way to log in, so its important to keep track
+		// of in case of abuse.
+		$this->logger->info( "{user} successfully logged in using temp password",
+			[
+				'user' => $username,
+				'requestIP' => $this->manager->getRequest()->getIP()
+			]
+		);
+
 		$this->setPasswordResetFlag( $username, $status );
 
 		return AuthenticationResponse::newPass( $username );