feat: don't count failed CSRF as failed login attempt

Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>

diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php
index 6a29bd17282f5aed86d5dfb47895b3590ad124c0..bc332df7ecd2353f67044978a65ffdfc335543a2 100644 (file)
--- a/core/Controller/LoginController.php
+++ b/core/Controller/LoginController.php
@@ -232,7 +232,7 @@ class LoginController extends Controller {
                        $this->canResetPassword($passwordLink, $user)
                );
        }
-       
+
        /**
         * Sets the initial state of whether or not a user is allowed to login with their email
         * initial state is passed in the array of 1 for email allowed and 0 for not allowed
@@ -326,7 +326,8 @@ class LoginController extends Controller {
                                $user,
                                $user,
                                $redirect_url,
-                               self::LOGIN_MSG_CSRFCHECKFAILED
+                               self::LOGIN_MSG_CSRFCHECKFAILED,
+                               false,
                        );
                }
 
@@ -376,7 +377,12 @@ class LoginController extends Controller {
         * @return RedirectResponse
         */
        private function createLoginFailedResponse(
-               $user, $originalUser, $redirect_url, string $loginMessage) {
+               $user,
+               $originalUser,
+               $redirect_url,
+               string $loginMessage,
+               bool $throttle = true,
+       ) {
                // Read current user and append if possible we need to
                // return the unmodified user otherwise we will leak the login name
                $args = $user !== null ? ['user' => $originalUser, 'direct' => 1] : [];
@@ -386,7 +392,9 @@ class LoginController extends Controller {
                $response = new RedirectResponse(
                        $this->urlGenerator->linkToRoute('core.login.showLoginForm', $args)
                );
-               $response->throttle(['user' => substr($user, 0, 64)]);
+               if ($throttle) {
+                       $response->throttle(['user' => substr($user, 0, 64)]);
+               }
                $this->session->set('loginMessages', [
                        [$loginMessage], []
                ]);

diff --git a/tests/Core/Controller/LoginControllerTest.php b/tests/Core/Controller/LoginControllerTest.php
index 005b7d713e5947e4bcd63fe5661b2811c4f631a1..3adb62b0743500504c124dd40b9d78c90b004e9d 100644 (file)
--- a/tests/Core/Controller/LoginControllerTest.php
+++ b/tests/Core/Controller/LoginControllerTest.php
@@ -544,7 +544,6 @@ class LoginControllerTest extends TestCase {
                $response = $this->loginController->tryLogin($loginChain, 'Jane', $password, $originalUrl);
 
                $expected = new RedirectResponse('');
-               $expected->throttle(['user' => 'Jane']);
                $this->assertEquals($expected, $response);
        }