From c8ae064b791edc0a83ddf9bd5e90f9ac174ed56e Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Wed, 22 Jan 2014 22:16:03 +1100
Subject: [PATCH] ENH: tighten regex and change failJSON to support timezone.
 Closes gh-583

---
 THANKS                           |  1 +
 config/filter.d/tine20.conf      | 12 ++++++++++--
 fail2ban/tests/files/logs/tine20 |  7 +++++++
 testcases/files/logs/tine20      |  2 --
 4 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 fail2ban/tests/files/logs/tine20
 delete mode 100644 testcases/files/logs/tine20

diff --git a/THANKS b/THANKS
index 72bbdbda..cef5d506 100644
--- a/THANKS
+++ b/THANKS
@@ -67,6 +67,7 @@ mEDI
 Merijn Schering
 Michael C. Haller
 Michael Hanselmann
+Mika (mkl)
 Nick Munger
 onorua
 Patrick Börjesson
diff --git a/config/filter.d/tine20.conf b/config/filter.d/tine20.conf
index a878d890..0fa6eccd 100644
--- a/config/filter.d/tine20.conf
+++ b/config/filter.d/tine20.conf
@@ -6,8 +6,16 @@
 
 [Definition]
 
-failregex = Login with username .* from <HOST> failed
+failregex =  ^[\da-f]{5,} [\da-f]{5,} (-- none --|.*?)( \d+(\.\d+)?(h|m|s|ms)){0,2} -  WARN \(\d+\): Tinebase_Controller::login::\d+ Login with username .*? from <HOST> failed \(-[13]\)!$
 
 ignoreregex = 
 
-# Author: mkl from Tine20.org forum
+# Author: Mika (mkl) from Tine20.org forum: https://www.tine20.org/forum/viewtopic.php?f=2&t=15688&p=54766
+# Editor: Daniel Black
+# Advisor: Lars Kneschke
+#
+# Usernames can contain spaces.
+#
+# Authentication: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Controller.php#l105
+# Logger: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Log/Formatter.php
+# formatMicrotimeDiff: http://git.tine20.org/git?p=tine20;a=blob;f=tine20/Tinebase/Helper.php#l276
diff --git a/fail2ban/tests/files/logs/tine20 b/fail2ban/tests/files/logs/tine20
new file mode 100644
index 00000000..dbb9f424
--- /dev/null
+++ b/fail2ban/tests/files/logs/tine20
@@ -0,0 +1,7 @@
+# Wrong username (-1) error
+# failJSON: { "time": "2014-01-13T06:02:22", "match": true, "host": "127.0.0.1" }
+78017 00cff -- none -- - 2014-01-13T05:02:22+00:00 WARN (4): Tinebase_Controller::login::106 Login with username sdfsadf from 127.0.0.1 failed (-1)!
+
+# Wrong password (-3) error
+# failJSON: { "time": "2014-01-21T05:38:14", "match": true, "host": "127.0.0.1" }
+8e035 ffff3 -- none -- - 2014-01-21T04:38:14+00:00 WARN (4): Tinebase_Controller::login::106 Login with username testuser from 127.0.0.1 failed (-3)!
diff --git a/testcases/files/logs/tine20 b/testcases/files/logs/tine20
deleted file mode 100644
index 87d5c8ae..00000000
--- a/testcases/files/logs/tine20
+++ /dev/null
@@ -1,2 +0,0 @@
-# failJSON: { "time": "2014-01-13T05:02:22", "match": true, "host": "127.0.0.1" }
-78017 00cff -- none -- - 2014-01-13T05:02:22+00:00 WARN (4): Tinebase_Controller::login::106 Login with username sdfsadf from 127.0.0.1 failed (-1)!