Version 5.0.6

oauth/token/index.php

@@ -207,9 +207,9 @@ class oAuthServerTokenRequest
 	 */
 	public function validatePassword( $username, $password, $scope )
 	{
-		$member = NULL;
+		$success = FALSE;
 		$accessToken = NULL;
-		$fails = array();
+		$fails = [];
 				
 		$login = new Login();
 				
@@ -217,9 +217,12 @@ class oAuthServerTokenRequest
 		{
 			try
 			{
-				$member = $method->authenticateUsernamePassword( $login, $username, $password );
+				if( $member = $method->authenticateUsernamePassword( $login, $username, $password ) )
+				{
+					$success = TRUE;
+				}
+
 				Login::checkIfAccountIsLocked( $member, TRUE );
-				
 				if ( !$member->isBanned() and !$member->members_bitoptions['validating'] )
 				{
 					$accessToken = $this->client->generateAccessToken( $member, $scope, 'password', FALSE, NULL, isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : NULL, isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : NULL, NULL );
@@ -230,23 +233,21 @@ class oAuthServerTokenRequest
 			{
 				if ( $e->getCode() === \IPS\Login\Exception::BAD_PASSWORD and $e->member )
 				{
-					$e->member->failedLogin();
+					$fails[ $e->member->member_id ] = $e->member;
 				}
 			}
-			catch (Exception $e ) { }
+			catch ( Exception $e ) { }
 		}
-				
-		foreach ( $fails as $failedMember )
+
+		/* Record any fails if none of the sign-ins were successful */
+		if( $success === TRUE )
 		{
-			if ( !$member or $failedMember->member_id != $failedMember->member_id )
+			foreach ( $fails as $failedMember )
 			{
-				$failedLogins = is_array( $failedMember->failed_logins ) ? $failedMember->failed_logins : array();
-				$failedLogins[ Request::i()->ipAddress() ][] = time();
-				$failedMember->failed_logins = $failedLogins;
-				$failedMember->save();
+				$failedMember->failedLogin();
 			}
 		}
-		
+
 		return $accessToken;
 	}