upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-08 08:16:43 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Merge pull request #27616 from nextcloud/backport/27610/stable21

Browse source 
[stable21] Throttle on public DAV endpoint
This commit is contained in:
Lukas Reschke 2021-06-23 12:41:20 +02:00 committed by GitHub
commit 82adb4c21e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 25 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
apps/dav/appinfo/v1/publicwebdav.php
View file

@ -42,7 +42,8 @@ OC_Util::obEnd();
$authBackend = new OCA\DAV\Connector\PublicAuth(
\OC::$server->getRequest(),
\OC::$server->getShareManager(),
\OC::$server->getSession()
\OC::$server->getSession(),
\OC::$server->getBruteForceThrottler()
);
$authPlugin = new \Sabre\DAV\Auth\Plugin($authBackend);

16
apps/dav/lib/Connector/PublicAuth.php
View file

@ -31,6 +31,7 @@
namespace OCA\DAV\Connector;
use OC\Security\Bruteforce\Throttler;
use OCP\IRequest;
use OCP\ISession;
use OCP\Share\Exceptions\ShareNotFound;
@ -44,6 +45,7 @@ use Sabre\DAV\Auth\Backend\AbstractBasic;
* @package OCA\DAV\Connector
*/
class PublicAuth extends AbstractBasic {
private const BRUTEFORCE_ACTION = 'public_webdav_auth';
/** @var \OCP\Share\IShare */
private $share;
@ -57,17 +59,23 @@ class PublicAuth extends AbstractBasic {
/** @var IRequest */
private $request;
/** @var Throttler */
private $throttler;
/**
* @param IRequest $request
* @param IManager $shareManager
* @param ISession $session
* @param Throttler $throttler
*/
public function __construct(IRequest $request,
IManager $shareManager,
ISession $session) {
ISession $session,
Throttler $throttler) {
$this->request = $request;
$this->shareManager = $shareManager;
$this->session = $session;
$this->throttler = $throttler;
// setup realm
$defaults = new \OCP\Defaults();
@ -87,9 +95,12 @@ class PublicAuth extends AbstractBasic {
* @throws \Sabre\DAV\Exception\NotAuthenticated
*/
protected function validateUserPass($username, $password) {
$this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), self::BRUTEFORCE_ACTION);
try {
$share = $this->shareManager->getShareByToken($username);
} catch (ShareNotFound $e) {
$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
return false;
}
@ -114,11 +125,14 @@ class PublicAuth extends AbstractBasic {
header('WWW-Authenticate: DummyBasic realm="' . $this->realm . '"');
throw new \Sabre\DAV\Exception\NotAuthenticated('Cannot authenticate over ajax calls');
}
$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
return false;
}
} elseif ($share->getShareType() === IShare::TYPE_REMOTE) {
return true;
} else {
$this->throttler->registerAttempt(self::BRUTEFORCE_ACTION, $this->request->getRemoteAddress());
return false;
}
} else {

9
apps/dav/tests/unit/Connector/PublicAuthTest.php
View file

@ -27,6 +27,7 @@
namespace OCA\DAV\Tests\unit\Connector;
use OC\Security\Bruteforce\Throttler;
use OCP\IRequest;
use OCP\ISession;
use OCP\Share\Exceptions\ShareNotFound;
@ -50,6 +51,8 @@ class PublicAuthTest extends \Test\TestCase {
private $shareManager;
/** @var \OCA\DAV\Connector\PublicAuth */
private $auth;
/** @var Throttler|\PHPUnit\Framework\MockObject\MockObject */
private $throttler;
/** @var string */
private $oldUser;
@ -66,11 +69,15 @@ class PublicAuthTest extends \Test\TestCase {
$this->shareManager = $this->getMockBuilder(IManager::class)
->disableOriginalConstructor()
->getMock();
$this->throttler = $this->getMockBuilder(Throttler::class)
->disableOriginalConstructor()
->getMock();
$this->auth = new \OCA\DAV\Connector\PublicAuth(
$this->request,
$this->shareManager,
$this->session
$this->session,
$this->throttler
);
// Store current user