upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-11 01:30:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 79

Merge pull request #36574 from nextcloud/backport/36489/stable24

Browse source 
[stable24] Add bruteforce protection to password reset page
This commit is contained in:
blizzz 2023-02-07 10:08:02 +01:00 committed by GitHub
commit c81f672200
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
core/Controller/LostController.php
View file

@ -134,6 +134,8 @@ class LostController extends Controller {
*
* @PublicPage
* @NoCSRFRequired
* @BruteForceProtection(action=passwordResetEmail)
* @AnonRateThrottle(limit=10, period=300)
*
* @param string $token
* @param string $userId
@ -147,12 +149,14 @@ class LostController extends Controller {
|| ($e instanceof InvalidTokenException
&& !in_array($e->getCode(), [InvalidTokenException::TOKEN_NOT_FOUND, InvalidTokenException::USER_UNKNOWN]))
) {
return new TemplateResponse(
$response = new TemplateResponse(
'core', 'error', [
"errors" => [["error" => $e->getMessage()]]
],
TemplateResponse::RENDER_AS_GUEST
);
$response->throttle();
return $response;
}
return new TemplateResponse('core', 'error', [
'errors' => [['error' => $this->l10n->t('Password reset is disabled')]]

1
tests/Core/Controller/LostControllerTest.php
View file

@ -170,6 +170,7 @@ class LostControllerTest extends \Test\TestCase {
]
],
'guest');
$expectedResponse->throttle();
$this->assertEquals($expectedResponse, $response);
}