upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 54

Merge pull request #36489 from nextcloud/bugfix/noid/brute-force-protection-password-reset

Browse source 
Add bruteforce protection to password reset page
This commit is contained in:
Joas Schilling 2023-02-06 22:12:25 +01:00 committed by GitHub
commit 59578817f5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
core/Controller/LostController.php
View file

@ -128,6 +128,8 @@ class LostController extends Controller {
*
* @PublicPage
* @NoCSRFRequired
* @BruteForceProtection(action=passwordResetEmail)
* @AnonRateThrottle(limit=10, period=300)
*/
public function resetform(string $token, string $userId): TemplateResponse {
try {
@ -137,12 +139,14 @@ class LostController extends Controller {
|| ($e instanceof InvalidTokenException
&& !in_array($e->getCode(), [InvalidTokenException::TOKEN_NOT_FOUND, InvalidTokenException::USER_UNKNOWN]))
) {
return new TemplateResponse(
$response = new TemplateResponse(
'core', 'error', [
"errors" => [["error" => $e->getMessage()]]
],
TemplateResponse::RENDER_AS_GUEST
);
$response->throttle();
return $response;
}
return new TemplateResponse('core', 'error', [
'errors' => [['error' => $this->l10n->t('Password reset is disabled')]]

1
tests/Core/Controller/LostControllerTest.php
View file

@ -171,6 +171,7 @@ class LostControllerTest extends TestCase {
]
],
'guest');
$expectedResponse->throttle();
$this->assertEquals($expectedResponse, $response);
}