Plugin Hook does not work properly?

[XHyperDEVX]

Hello,

this is my plugin:

<?php
/*
Plugin Name: Failed Login Logger
Description: Logs failed login attempts with IP address.
Version: 1.0
Author: User
*/

// Hook into the login_failed action
yourls_add_action('login_failed', 'log_failed_login');

function log_failed_login($args) {
    $ip = yourls_get_IP();
    $timestamp = date('Y-m-d H:i:s');
    $log_entry = "Failed login attempt from IP $ip at $timestamp\n";

    // Specify the path to the log file
    $log_file = '/var/www/html/yourls/user/login.log';

    // Append the log entry to the log file
    file_put_contents($log_file, $log_entry, FILE_APPEND);
}
?>

I want that when a login fails, in a text file [/user/login.log] is written "Failed login from ip.ip.ip.ip at year-month-day hour:minute:second".

this works as far as possible, but apparently the hook "login_failed" [i got the hook from here: https://yourls.org/hooklist.php] is also triggered if you only load the login page! At least with this plugin it is also logged when you load the login page AND again when the login fails. If it is successful nothing happens. that is also correct.

I also looked at the code with "login_failed", [/includes/functions-auth.php, https://github.com/YOURLS/YOURLS/blob/master//includes/functions-auth.php#L116] only unfortunately I don't quite understand the code/don't find the error.

Why is "login_failed" also executed when the page loads, and not only when the login fails?

[dgw]

Looking at the authentication code, I believe this is a design bug. Solution proposed for discussion by the other maintainers at #3627.

Thanks for pointing this out!

[XHyperDEVX]

I only had to change one line, that fixes the problem:

#3628