Reply to thread

This function is flawed in a significant way.

Ip::getLoggedIp is only called with the content type 'user'. Except all non-content ip records are store under user/user id/<action> triplet, with only an index on content type/content id columns.  This logs every user login IP, and such including the registration/confirmation IPs.

There was a bug in older version which logged a login ip on practically every request for users.

The real fix is to record the xf_ip.ip_id field for the registration record somewhere on a related user table. This turns scanning an arbitrary number of rows using string matching to just a primary key lookup.