From 4760ccaba0396e0e6e617c00c2aa20b8e54c111d Mon Sep 17 00:00:00 2001 From: Mapioe <96563902+Mapioe@users.noreply.github.com> Date: Mon, 14 Sep 2026 00:52:18 +0500 Subject: [PATCH] fix(logs): standardize logs (#6484) * fix(logs): standardize login and logout logs * fix(logs): log the real username on login lines The four login log lines logged safeUser, the HTML-escaped copy kept for the Telegram and email notifiers, so an account named o"reilly<1> showed up as o"reilly<1> on login but o\"reilly<1> on logout. %q already neutralises control characters, so the log now carries form.Username and safeUser feeds only the notifiers. Resolves the pre-existing LOW left on PR #6484. TestLoginLogsRealUsername drives the success, plain-failure, blocking and refused paths over HTTP and fails on the escaped value. Refs #6483 --------- Co-authored-by: Mapioe Co-authored-by: Sanaei --- internal/web/controller/index.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/internal/web/controller/index.go b/internal/web/controller/index.go index 73f2df67e..a5ad9afc9 100644 --- a/internal/web/controller/index.go +++ b/internal/web/controller/index.go @@ -80,7 +80,7 @@ func (a *IndexController) login(c *gin.Context) { timeStr := time.Now().Format("2006-01-02 15:04:05") if blockedUntil, ok := defaultLoginLimiter.allow(remoteIP, form.Username); !ok { reason := "too many failed attempts" - logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", safeUser, remoteIP, reason, blockedUntil.Format(time.RFC3339)) + logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", form.Username, remoteIP, reason, blockedUntil.Format(time.RFC3339)) a.tgbot.UserLoginNotify(tgbot.LoginAttempt{ Username: safeUser, IP: remoteIP, @@ -97,9 +97,9 @@ func (a *IndexController) login(c *gin.Context) { if user == nil { reason := loginFailureReason(checkErr) if blockedUntil, blocked := defaultLoginLimiter.registerFailure(remoteIP, form.Username); blocked { - logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", safeUser, remoteIP, reason, blockedUntil.Format(time.RFC3339)) + logger.Warningf("failed login: username=%q, IP=%q, reason=%q, blocked_until=%s", form.Username, remoteIP, reason, blockedUntil.Format(time.RFC3339)) } else { - logger.Warningf("failed login: username=%q, IP=%q, reason=%q", safeUser, remoteIP, reason) + logger.Warningf("failed login: username=%q, IP=%q, reason=%q", form.Username, remoteIP, reason) } a.tgbot.UserLoginNotify(tgbot.LoginAttempt{ Username: safeUser, @@ -113,7 +113,7 @@ func (a *IndexController) login(c *gin.Context) { } defaultLoginLimiter.registerSuccess(remoteIP, form.Username) - logger.Infof("%s logged in successfully, Ip Address: %s\n", safeUser, remoteIP) + logger.Infof("logged in successfully: username=%q, IP=%q", form.Username, remoteIP) a.tgbot.UserLoginNotify(tgbot.LoginAttempt{ Username: safeUser, IP: remoteIP, @@ -139,7 +139,7 @@ func loginFailureReason(err error) string { func (a *IndexController) logout(c *gin.Context) { user := session.GetLoginUser(c) if user != nil { - logger.Infof("%s logged out successfully", user.Username) + logger.Infof("logged out successfully: username=%q", user.Username) } if err := session.ClearSession(c); err != nil { logger.Warning("Unable to clear session on logout:", err)