From 67a968caf2a534d477b9deb3153cdf36ac99cb70 Mon Sep 17 00:00:00 2001
From: Azareal <azareal@users.noreply.github.com>
Date: Tue, 27 Apr 2021 19:44:00 +1000
Subject: [PATCH] Add DisableLoginLog config setting.

The tests / tickloop portions (to purge existing login logs when the setting is enabled) are coming with the tickloop rewrite.
---
 common/site.go    |  9 +++++----
 routes/account.go | 39 ++++++++++++++++++++-------------------
 2 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/common/site.go b/common/site.go
index 9ffaa424..08b3f2d1 100644
--- a/common/site.go
+++ b/common/site.go
@@ -99,10 +99,11 @@ type config struct {
 	LogPruneCutoff int
 	//SelfDeleteTruncCutoff int // Personal data is stripped from the mod action rows only leaving the TID and the action for later investigation.
 
-	DisableLastIP bool
-	DisablePostIP bool
-	DisablePollIP bool
-	DisableRegLog bool
+	DisableLastIP   bool
+	DisablePostIP   bool
+	DisablePollIP   bool
+	DisableRegLog   bool
+	DisableLoginLog bool
 	//DisableSelfDeleteLog bool
 
 	DisableLiveTopicList bool
diff --git a/routes/account.go b/routes/account.go
index 124afd3a..4c687c90 100644
--- a/routes/account.go
+++ b/routes/account.go
@@ -37,29 +37,31 @@ func AccountLoginSubmit(w http.ResponseWriter, r *http.Request, u *c.User) c.Rou
 	}
 
 	name := c.SanitiseSingleLine(r.PostFormValue("username"))
-	uid, err, requiresExtraAuth := c.Auth.Authenticate(name, r.PostFormValue("password"))
-	if err != nil {
+	uid, e, requiresExtraAuth := c.Auth.Authenticate(name, r.PostFormValue("password"))
+	if e != nil {
 		// TODO: uid is currently set to 0 as authenticate fetches the user by username and password. Get the actual uid, so we can alert the user of attempted logins? What if someone takes advantage of the response times to deduce if an account exists?
-		logItem := &c.LoginLogItem{UID: uid, Success: false, IP: u.GetIP()}
-		_, ierr := logItem.Create()
-		if ierr != nil {
-			return c.InternalError(ierr, w, r)
+		if !c.Config.DisableLoginLog {
+			li := &c.LoginLogItem{UID: uid, Success: false, IP: u.GetIP()}
+			if _, ie := li.Create(); ie != nil {
+				return c.InternalError(ie, w, r)
+			}
 		}
-		return c.LocalError(err.Error(), w, r, u)
+		return c.LocalError(e.Error(), w, r, u)
 	}
 
 	// TODO: Take 2FA into account
-	logItem := &c.LoginLogItem{UID: uid, Success: true, IP: u.GetIP()}
-	_, err = logItem.Create()
-	if err != nil {
-		return c.InternalError(err, w, r)
+	if !c.Config.DisableLoginLog {
+		li := &c.LoginLogItem{UID: uid, Success: true, IP: u.GetIP()}
+		if _, e = li.Create(); e != nil {
+			return c.InternalError(e, w, r)
+		}
 	}
 
 	// TODO: Do we want to slacken this by only doing it when the IP changes?
 	if requiresExtraAuth {
-		provSession, signedSession, err := c.Auth.CreateProvisionalSession(uid)
-		if err != nil {
-			return c.InternalError(err, w, r)
+		provSession, signedSession, e := c.Auth.CreateProvisionalSession(uid)
+		if e != nil {
+			return c.InternalError(e, w, r)
 		}
 		// TODO: Use the login log ID in the provisional cookie?
 		c.Auth.SetProvisionalCookies(w, uid, provSession, signedSession)
@@ -283,9 +285,8 @@ func AccountRegisterSubmit(w http.ResponseWriter, r *http.Request, user *c.User)
 
 	regLog := c.RegLogItem{Username: name, Email: email, FailureReason: regErrReason, Success: regSuccess, IP: user.GetIP()}
 	if !c.Config.DisableRegLog && regSuccess {
-		_, err := regLog.Create()
-		if err != nil {
-			return c.InternalError(err, w, r)
+		if _, e := regLog.Create(); e != nil {
+			return c.InternalError(e, w, r)
 		}
 	}
 	if !regSuccess {
@@ -305,8 +306,8 @@ func AccountRegisterSubmit(w http.ResponseWriter, r *http.Request, user *c.User)
 	pushLog := func(reason string) error {
 		if !c.Config.DisableRegLog {
 			regLog.FailureReason += reason + "|"
-			_, err := regLog.Create()
-			return err
+			_, e := regLog.Create()
+			return e
 		}
 		return nil
 	}