diff options
| author | blizzz <blizzz@arthur-schiwon.de> | 2023-02-07 10:07:39 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-07 10:07:39 +0100 |
| commit | 371bd563c1e3325504907d031cb0581e49bc2d9f (patch) | |
| tree | 93eb04db0291cde62c6633e436475748306a11db | |
| parent | 5b2dea6e031fa197395bc0896c42f8aee24e6195 (diff) | |
| parent | 65e81601d61df1881befc868a90e1e0747a680b9 (diff) | |
| download | nextcloud-server-371bd563c1e3325504907d031cb0581e49bc2d9f.tar.gz nextcloud-server-371bd563c1e3325504907d031cb0581e49bc2d9f.zip | |
Merge pull request #36573 from nextcloud/backport/36489/stable25
[stable25] Add bruteforce protection to password reset page
| -rw-r--r-- | core/Controller/LostController.php | 6 | ||||
| -rw-r--r-- | tests/Core/Controller/LostControllerTest.php | 1 |
2 files changed, 6 insertions, 1 deletions
diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php index e7960dbcef5..1a241790641 100644 --- a/core/Controller/LostController.php +++ b/core/Controller/LostController.php @@ -128,6 +128,8 @@ class LostController extends Controller { * * @PublicPage * @NoCSRFRequired + * @BruteForceProtection(action=passwordResetEmail) + * @AnonRateThrottle(limit=10, period=300) */ public function resetform(string $token, string $userId): TemplateResponse { try { @@ -137,12 +139,14 @@ class LostController extends Controller { || ($e instanceof InvalidTokenException && !in_array($e->getCode(), [InvalidTokenException::TOKEN_NOT_FOUND, InvalidTokenException::USER_UNKNOWN])) ) { - return new TemplateResponse( + $response = new TemplateResponse( 'core', 'error', [ "errors" => [["error" => $e->getMessage()]] ], TemplateResponse::RENDER_AS_GUEST ); + $response->throttle(); + return $response; } return new TemplateResponse('core', 'error', [ 'errors' => [['error' => $this->l10n->t('Password reset is disabled')]] diff --git a/tests/Core/Controller/LostControllerTest.php b/tests/Core/Controller/LostControllerTest.php index 3f62c522627..e95c3fa1c51 100644 --- a/tests/Core/Controller/LostControllerTest.php +++ b/tests/Core/Controller/LostControllerTest.php @@ -171,6 +171,7 @@ class LostControllerTest extends TestCase { ] ], 'guest'); + $expectedResponse->throttle(); $this->assertEquals($expectedResponse, $response); } |