github-mirror/discourse
github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-04-09 15:50:48 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Make the verbose_auth_token_logging setting off by default (#14664)

Browse Source 
The `generate`, `rotate` and `suspicious`  auth token logs are now always logged regardless of the `verbose_auth_token_logging` setting because we rely no these to detect suspicious logins.
This commit is contained in:
Osama Sayegh 2021-10-20 17:20:39 +03:00 committed by GitHub
parent 1f8939c0f1
commit 8fb823c30f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 41 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
app/models/user_auth_token.rb
View File

@ -15,17 +15,23 @@ class UserAuthToken < ActiveRecord::Base
attr_accessor :unhashed_auth_token attr_accessor :unhashed_auth_token
before_destroy do before_destroy do
UserAuthToken.log(action: 'destroy', UserAuthToken.log_verbose(
user_auth_token_id: self.id, action: 'destroy',
user_id: self.user_id, user_auth_token_id: self.id,
user_agent: self.user_agent, user_id: self.user_id,
client_ip: self.client_ip, user_agent: self.user_agent,
auth_token: self.auth_token) client_ip: self.client_ip,
auth_token: self.auth_token,
)
end end
def self.log(info) def self.log(info)
UserAuthTokenLog.create!(info)
end
def self.log_verbose(info)
if SiteSetting.verbose_auth_token_logging if SiteSetting.verbose_auth_token_logging
UserAuthTokenLog.create!(info) log(info)
end end
end end
@ -78,13 +84,15 @@ class UserAuthToken < ActiveRecord::Base
) )
user_auth_token.unhashed_auth_token = token user_auth_token.unhashed_auth_token = token
log(action: 'generate', log(
user_auth_token_id: user_auth_token.id, action: 'generate',
user_id: user_id, user_auth_token_id: user_auth_token.id,
user_agent: user_agent, user_id: user_id,
client_ip: client_ip, user_agent: user_agent,
path: path, client_ip: client_ip,
auth_token: hashed_token) path: path,
auth_token: hashed_token,
)
if staff && !impersonate if staff && !impersonate
Jobs.enqueue(:suspicious_login, Jobs.enqueue(:suspicious_login,
@ -108,12 +116,14 @@ class UserAuthToken < ActiveRecord::Base
if !user_token if !user_token
log(action: "miss token", log_verbose(
user_id: user_token&.user_id, action: "miss token",
auth_token: token, user_id: nil,
user_agent: opts && opts[:user_agent], auth_token: token,
path: opts && opts[:path], user_agent: opts && opts[:user_agent],
client_ip: opts && opts[:client_ip]) path: opts && opts[:path],
client_ip: opts && opts[:client_ip],
)
return nil return nil
end end
@ -126,7 +136,7 @@ class UserAuthToken < ActiveRecord::Base
# not updating AR model cause we want to give it one more req # not updating AR model cause we want to give it one more req
# with wrong cookie # with wrong cookie
UserAuthToken.log( UserAuthToken.log_verbose(
action: changed_rows == 0 ? "prev seen token unchanged" : "prev seen token", action: changed_rows == 0 ? "prev seen token unchanged" : "prev seen token",
user_auth_token_id: user_token.id, user_auth_token_id: user_token.id,
user_id: user_token.user_id, user_id: user_token.user_id,
@ -149,13 +159,15 @@ class UserAuthToken < ActiveRecord::Base
user_token.seen_at = Time.zone.now user_token.seen_at = Time.zone.now
end end
log(action: changed_rows == 0 ? "seen wrong token" : "seen token", log_verbose(
user_auth_token_id: user_token.id, action: changed_rows == 0 ? "seen wrong token" : "seen token",
user_id: user_token.user_id, user_auth_token_id: user_token.id,
auth_token: user_token.auth_token, user_id: user_token.user_id,
user_agent: opts && opts[:user_agent], auth_token: user_token.auth_token,
path: opts && opts[:path], user_agent: opts && opts[:user_agent],
client_ip: opts && opts[:client_ip]) path: opts && opts[:path],
client_ip: opts && opts[:client_ip],
)
end end
user_token user_token

2
config/site_settings.yml
View File

@ -465,7 +465,7 @@ login:
default: false default: false
verbose_auth_token_logging: verbose_auth_token_logging:
hidden: true hidden: true
default: true default: false
max_suspicious_distance_km: max_suspicious_distance_km:
hidden: true hidden: true
default: 500 default: 500