silverstripe / cwp-core

CWP basic compatibility module
BSD 3-Clause "New" or "Revised" License
3 stars 12 forks source link

Follow up on the LoginAttemptNotifications extension #41

Open robbieaverill opened 6 years ago

robbieaverill commented 6 years ago

CWP 2.1, probably CWP 2.0 as well

The LoginAttemptNotifications extensions purpose is to show the CMS user when they log in the number of successful and/or unsuccessful login attempts that occurred since the previous time they logged into the CMS.

@chillu pointed out that it's not particularly useful to show CMS users that there were successful login attempts, seeing as the message looks like this (nobody will remember their IP and be able to distinguish a malicious login from it):

In the last 2 mins a successful login attempt to your account was registered. The attempt was made from 14.1.35.58.

In CWP 1.x this extension was disabled in 2013:

https://github.com/silverstripe/cwp/commit/2c576c32689cff4d10ad867b24cc6e9695e15781#diff-8a7315557cd9f672e36f7e8f0ce2c29e

It was re-enabled during the CWP 2.x upgrade, possibly by mistake:

https://github.com/silverstripe/cwp-core/commit/f46727fb5fbc5f1674178bd679cc3ee13783fcb8#diff-8a7315557cd9f672e36f7e8f0ce2c29eR125

It was then moved from _config.php into a YAML config file.


This issue is raised as a placeholder to either deprecated and remove this feature OR to investigate, fix and reimplement it so that it works correctly and doesn't show up every time a CMS user does something in the CMS.

Context: CWP kitchen sink recipe 2.1.x-dev on the CWP platform, not logged in as the default admin user.

Related bug fix for this functionality in core (UI fix): https://github.com/silverstripe/silverstripe-admin/issues/568