diff MoinMoin/auth/__init__.py @ 6045:f029e42ecdec

add logging for login to detect potential abuse
author Thomas Waldmann <tw AT waldmann-edv DOT de>
date Fri, 06 Jun 2014 13:33:16 +0200
parents 105451cabedb
children a9bfc8e99775
line wrap: on
line diff
--- a/MoinMoin/auth/__init__.py	Tue Apr 29 10:42:46 2014 +0200
+++ b/MoinMoin/auth/__init__.py	Fri Jun 06 13:33:16 2014 +0200
@@ -140,6 +140,7 @@
 from werkzeug import redirect, abort, url_quote, url_quote_plus
 
 from MoinMoin import user, wikiutil
+from MoinMoin.util.abuse import log_attempt
 
 
 def get_multistage_continuation_url(request, auth_name, extra_fields={}):
@@ -245,9 +246,11 @@
         u = user.User(request, name=username, password=password, auth_method=self.name)
         if u.valid:
             logging.debug("%s: successfully authenticated user %r (valid)" % (self.name, u.name))
+            log_attempt("auth: login (moin)", True, request, username)
             return ContinueLogin(u)
         else:
             logging.debug("%s: could not authenticate user %r (not valid)" % (self.name, username))
+            log_attempt("auth: login (moin)", False, request, username)
             return ContinueLogin(user_obj, _("Invalid username or password."))
 
     def login_hint(self, request):
@@ -370,9 +373,12 @@
             u.create_or_update()
         if u and u.valid:
             logging.debug("returning valid user %r" % u)
+            log_attempt("auth: request (given)", True, request, auth_username)
             return u, True # True to get other methods called, too
         else:
             logging.debug("returning %r" % user_obj)
+            if u and not u.valid:
+                log_attempt("auth: request (given)", False, request, auth_username)
             return user_obj, True