fix(lostpassword): Also rate limit the setPassword endpoint

Signed-off-by: Joas Schilling <coding@schilljs.com>

diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php
index 1fda92fb500017bc7b5593de7a9a8a9de01832b9..96579b278cf981938617e770778d9e3a1b1cd79a 100644 (file)
--- a/core/Controller/LostController.php
+++ b/core/Controller/LostController.php
@@ -283,11 +283,13 @@ class LostController extends Controller {
 
        /**
         * @PublicPage
+        * @BruteForceProtection(action=passwordResetEmail)
+        * @AnonRateThrottle(limit=10, period=300)
         * @param string $token
         * @param string $userId
         * @param string $password
         * @param boolean $proceed
-        * @return array
+        * @return JSONResponse
         */
        public function setPassword($token, $userId, $password, $proceed) {
                if ($this->config->getSystemValue('lost_password_link', '') !== '') {
@@ -301,7 +303,7 @@ class LostController extends Controller {
                                $instance = call_user_func($module['callback']);
                                // this way we can find out whether per-user keys are used or a system wide encryption key
                                if ($instance->needDetailedAccessList()) {
-                                       return $this->error('', ['encryption' => true]);
+                                       return new JSONResponse($this->error('', ['encryption' => true]));
                                }
                        }
                }
@@ -323,12 +325,16 @@ class LostController extends Controller {
                        $this->config->deleteUserValue($userId, 'core', 'lostpassword');
                        @\OC::$server->getUserSession()->unsetMagicInCookie();
                } catch (HintException $e) {
-                       return $this->error($e->getHint());
+                       $response = new JSONResponse($this->error($e->getHint()));
+                       $response->throttle();
+                       return $response;
                } catch (\Exception $e) {
-                       return $this->error($e->getMessage());
+                       $response = new JSONResponse($this->error($e->getMessage()));
+                       $response->throttle();
+                       return $response;
                }
 
-               return $this->success(['user' => $userId]);
+               return new JSONResponse($this->success(['user' => $userId]));
        }
 
        /**