pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-14 10:22:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(logs): standardize logs (#6484)

Browse Source 
* fix(logs): standardize login and logout logs

* fix(logs): log the real username on login lines

The four login log lines logged safeUser, the HTML-escaped copy kept for
the Telegram and email notifiers, so an account named o"reilly<1> showed
up as o&#34;reilly&lt;1&gt; on login but o\"reilly<1> on logout. %q
already neutralises control characters, so the log now carries
form.Username and safeUser feeds only the notifiers.

Resolves the pre-existing LOW left on PR #6484. TestLoginLogsRealUsername
drives the success, plain-failure, blocking and refused paths over HTTP
and fails on the escaped value.

Refs #6483

---------

Co-authored-by: Mapioe <Mapioe@users.noreply.github.com>
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>
This commit is contained in:
Mapioe
2026-09-14 00:52:18 +05:00
committed by GitHub
parent 435ed976c0
commit 4760ccaba0
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
internal/web/controller/index.go
View File

@@ -80,7 +80,7 @@ func (a *IndexController) login(c *gin.Context) {
timeStr := time.Now().Format("2006-01-02 15:04:05")
if blockedUntil, ok := defaultLoginLimiter.allow(remoteIP, form.Username); !ok {
reason := "too many failed attempts"
logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", safeUser, remoteIP, reason, blockedUntil.Format(time.RFC3339))
logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", form.Username, remoteIP, reason, blockedUntil.Format(time.RFC3339))
a.tgbot.UserLoginNotify(tgbot.LoginAttempt{
Username: safeUser,
IP: remoteIP,
@@ -97,9 +97,9 @@ func (a *IndexController) login(c *gin.Context) {
if user == nil {
reason := loginFailureReason(checkErr)
if blockedUntil, blocked := defaultLoginLimiter.registerFailure(remoteIP, form.Username); blocked {
logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", safeUser, remoteIP, reason, blockedUntil.Format(time.RFC3339))
logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", form.Username, remoteIP, reason, blockedUntil.Format(time.RFC3339))
} else {
logger.Warningf("failed login: username=%q, IP=%q, reason=%q", safeUser, remoteIP, reason)
logger.Warningf("failed login: username=%q, IP=%q, reason=%q", form.Username, remoteIP, reason)
}
a.tgbot.UserLoginNotify(tgbot.LoginAttempt{
Username: safeUser,
@@ -113,7 +113,7 @@ func (a *IndexController) login(c *gin.Context) {
}
defaultLoginLimiter.registerSuccess(remoteIP, form.Username)
logger.Infof("%s logged in successfully, Ip Address: %s\n", safeUser, remoteIP)
logger.Infof("logged in successfully: username=%q, IP=%q", form.Username, remoteIP)
a.tgbot.UserLoginNotify(tgbot.LoginAttempt{
Username: safeUser,
IP: remoteIP,
@@ -139,7 +139,7 @@ func loginFailureReason(err error) string {
func (a *IndexController) logout(c *gin.Context) {
user := session.GetLoginUser(c)
if user != nil {
logger.Infof("%s logged out successfully", user.Username)
logger.Infof("logged out successfully: username=%q", user.Username)
}
if err := session.ClearSession(c); err != nil {
logger.Warning("Unable to clear session on logout:", err)