Version 4.7.23

oauth/token/index.php

@@ -197,9 +197,9 @@ class oAuthServerTokenRequest
 	 */
 	public function validatePassword( $username, $password, $scope )
 	{
-		$member = NULL;
 		$accessToken = NULL;
-		$fails = array();
+		$fails = [];
+		$success = FALSE;
 				
 		$login = new \IPS\Login();
 				
@@ -207,7 +207,10 @@ class oAuthServerTokenRequest
 		{
 			try
 			{
-				$member = $method->authenticateUsernamePassword( $login, $username, $password );
+				if( $member = $method->authenticateUsernamePassword( $login, $username, $password ) )
+				{
+					$success = TRUE;
+				}
 				\IPS\Login::checkIfAccountIsLocked( $member, TRUE );
 				
 				if ( !$member->isBanned() and !$member->members_bitoptions['validating'] )
@@ -225,18 +228,16 @@ class oAuthServerTokenRequest
 			}
 			catch ( \Exception $e ) { }
 		}
-				
-		foreach ( $fails as $failedMember )
+
+		/* Record any fails if none of the sign-ins were successful */
+		if( $success === TRUE )
 		{
-			if ( !$member or $failedMember->member_id != $failedMember->member_id )
+			foreach ( $fails as $failedMember )
 			{
-				$failedLogins = \is_array( $failedMember->failed_logins ) ? $failedMember->failed_logins : array();
-				$failedLogins[ \IPS\Request::i()->ipAddress() ][] = time();
-				$failedMember->failed_logins = $failedLogins;
-				$failedMember->save();
+				$failedMember->failedLogin();
 			}
 		}
-		
+
 		return $accessToken;
 	}