Signed-off-by: Florian Klinger <florian.klinger@nextcloud.com> Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>tags/v28.0.5rc1
@@ -302,7 +302,8 @@ class DIContainer extends SimpleContainer implements IAppContainer { | |||
$c->get(IRequest::class), | |||
$c->get(IUserSession::class), | |||
$c->get(IControllerMethodReflector::class), | |||
$c->get(OC\Security\RateLimiting\Limiter::class) | |||
$c->get(OC\Security\RateLimiting\Limiter::class), | |||
$c->get(ISession::class) | |||
) | |||
); | |||
$dispatcher->registerMiddleware( |
@@ -40,6 +40,7 @@ use OCP\AppFramework\Http\Response; | |||
use OCP\AppFramework\Http\TemplateResponse; | |||
use OCP\AppFramework\Middleware; | |||
use OCP\IRequest; | |||
use OCP\ISession; | |||
use OCP\IUserSession; | |||
use ReflectionMethod; | |||
@@ -70,6 +71,7 @@ class RateLimitingMiddleware extends Middleware { | |||
protected IUserSession $userSession, | |||
protected ControllerMethodReflector $reflector, | |||
protected Limiter $limiter, | |||
protected ISession $session, | |||
) { | |||
} | |||
@@ -81,6 +83,11 @@ class RateLimitingMiddleware extends Middleware { | |||
parent::beforeController($controller, $methodName); | |||
$rateLimitIdentifier = get_class($controller) . '::' . $methodName; | |||
if ($this->session->exists('app_api_system')) { | |||
// Bypass rate limiting for app_api | |||
return; | |||
} | |||
if ($this->userSession->isLoggedIn()) { | |||
$rateLimit = $this->readLimitFromAnnotationOrAttribute($controller, $methodName, 'UserRateThrottle', UserRateLimit::class); | |||
@@ -37,6 +37,7 @@ use OCP\AppFramework\Http\Attribute\UserRateLimit; | |||
use OCP\AppFramework\Http\DataResponse; | |||
use OCP\AppFramework\Http\TemplateResponse; | |||
use OCP\IRequest; | |||
use OCP\ISession; | |||
use OCP\IUser; | |||
use OCP\IUserSession; | |||
use PHPUnit\Framework\MockObject\MockObject; | |||
@@ -77,6 +78,7 @@ class RateLimitingMiddlewareTest extends TestCase { | |||
private IUserSession|MockObject $userSession; | |||
private ControllerMethodReflector $reflector; | |||
private Limiter|MockObject $limiter; | |||
private ISession|MockObject $session; | |||
private RateLimitingMiddleware $rateLimitingMiddleware; | |||
protected function setUp(): void { | |||
@@ -86,12 +88,14 @@ class RateLimitingMiddlewareTest extends TestCase { | |||
$this->userSession = $this->createMock(IUserSession::class); | |||
$this->reflector = new ControllerMethodReflector(); | |||
$this->limiter = $this->createMock(Limiter::class); | |||
$this->session = $this->createMock(ISession::class); | |||
$this->rateLimitingMiddleware = new RateLimitingMiddleware( | |||
$this->request, | |||
$this->userSession, | |||
$this->reflector, | |||
$this->limiter | |||
$this->limiter, | |||
$this->session | |||
); | |||
} | |||