diff options
| author | Joas Schilling <coding@schilljs.com> | 2020-03-19 13:31:07 +0100 |
|---|---|---|
| committer | Joas Schilling <coding@schilljs.com> | 2020-08-19 11:20:36 +0200 |
| commit | 6f751d01dbe84b7564c573e20e9264d53b19c48a (patch) | |
| tree | eb327b41082d620823cfe3fd9823323badd645e6 /lib/private/Security | |
| parent | 64539a6ee13f596260cea1a89b287a66ca9a0aed (diff) | |
| download | nextcloud-server-6f751d01dbe84b7564c573e20e9264d53b19c48a.tar.gz nextcloud-server-6f751d01dbe84b7564c573e20e9264d53b19c48a.zip | |
Make the throttling O(2^n) instead of O(n^n)
Signed-off-by: Joas Schilling <coding@schilljs.com>
Diffstat (limited to 'lib/private/Security')
| -rw-r--r-- | lib/private/Security/Bruteforce/Throttler.php | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/lib/private/Security/Bruteforce/Throttler.php b/lib/private/Security/Bruteforce/Throttler.php index 10e5061b9e8..f2bdd9986b6 100644 --- a/lib/private/Security/Bruteforce/Throttler.php +++ b/lib/private/Security/Bruteforce/Throttler.php @@ -53,6 +53,7 @@ use OCP\Security\Bruteforce\MaxDelayReached; class Throttler { public const LOGIN_ACTION = 'login'; public const MAX_DELAY = 25; + public const MAX_ATTEMPTS = 10; /** @var IDBConnection */ private $db; @@ -260,18 +261,17 @@ class Throttler { return 0; } - $maxDelay = self::MAX_DELAY; $firstDelay = 0.1; - if ($attempts > (8 * PHP_INT_SIZE - 1)) { + if ($attempts > self::MAX_ATTEMPTS) { // Don't ever overflow. Just assume the maxDelay time:s - $firstDelay = $maxDelay; - } else { - $firstDelay *= pow(2, $attempts); - if ($firstDelay > $maxDelay) { - $firstDelay = $maxDelay; - } + return self::MAX_DELAY; + } + + $delay = $firstDelay * 2**$attempts; + if ($delay > self::MAX_DELAY) { + return self::MAX_DELAY; } - return (int) \ceil($firstDelay * 1000); + return (int) \ceil($delay * 1000); } /** |