Page MenuHomePhabricator

LoginNotify should inform users of the IP address of successful login attempts to their account
Open, HighPublic

Description

I think LoginNotify should show the IP information not just for failed login attempts, but also for successful logins from new IPs.

This request is distinct from the request in T174388, so I have filed this task to separate them out.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 30 2017, 2:14 PM

I'd personally prefer to combine both requests in one task since it's not very different, technically speaking. The software changes required for both are pretty much the same (i.e the changes will be made in one place and not two).

Huji added a comment.Aug 30 2017, 7:33 PM

It is no big deal, IMHO. Now that we separated them, let's leave it this way. Whomever writes a patch might actually write the other as well.

I'd personally prefer to combine both requests in one task since it's not very different, technically speaking. The software changes required for both are pretty much the same (i.e the changes will be made in one place and not two).

The reason I separated them out is because it is possible that we may want to do one and not the other, so I think considering them separately helps. If you use the same patch for both, it can be tagged against multiple tasks, so there's no overhead there.

Anyway, I'm not strongly tied to any particular task configuration. It's your project, so if you'd prefer to merge them together, I have no objections. :-)

Samtar added a subscriber: Samtar.

Pinged WMF Privacy/Legal/Security to get feedback on this before moving forward.

This comment was removed by kaldari.

Approved by Legal.

Any progress? The Legal team approved this two and a half months ago.

Huji added a comment.Dec 27 2017, 3:47 PM

I started working on it but I found out that the first thing we need is a way to create login records from an arbitrary IP address (because I only have one test VM, and all edits from it will have the same IP i.e. 127.0.0.1

I worked on creating a maintenance script that would create a login attempt from an arbitrary IP, and tried to model after our unit testing code, but did not finish the job. I think it is best if we create a subtask for it, and perhaps someone else can help develop that script. Overall, any help in this area is appreciated, as I have run into a bit of difficulty finding time to work on patches recently.

Huji triaged this task as High priority.Jan 2 2018, 12:19 AM

To match T174388

Huji claimed this task.Jan 2 2018, 12:19 AM
Scott renamed this task from LoginNotify should inform users of the IP address of successful login attemps to their account to LoginNotify should inform users of the IP address of successful login attempts to their account.Jan 20 2018, 4:27 PM
Scott added a subscriber: Scott.
SQL added a subscriber: SQL.May 3 2018, 11:41 PM
Yb2 added a subscriber: Yb2.May 7 2018, 4:59 PM