Log file upload events

[securitydave]

We should have a requirement such as:

12.1.x (new) Verify that each file upload event, successful or rejected, is logged, including identification of the user.

(Related to #1444)

[elarlang]

I think we can make the requirement more precise with mentioning what kind of data should be logged for the event related to file upload (filesize, filename, checksum).

Additionally:

• viruscheck result
• for packed files, amount of files and packing ratio

[tghosth]

This is explicitly mentioned in the logging cheatsheet
OWASP/CheatSheetSeries#1394

As part of making requirements slightly more abstract, I don't think we would add this here as well..

@elarlang do you think we can close?

[elarlang]

In general yes, I just have not removed them as the new solution is not in place yet. But it's a clear case here now, that we will not cover all logging events in detail and are going to provide abstract requirements instead.