diff options
| -rw-r--r-- | lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php index 2ecd26a68e1..6a943af2a1f 100644 --- a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php @@ -51,6 +51,8 @@ use ReflectionMethod; * @package OC\AppFramework\Middleware\Security */ class BruteForceMiddleware extends Middleware { + private int $delaySlept = 0; + public function __construct( protected ControllerMethodReflector $reflector, protected Throttler $throttler, @@ -67,7 +69,7 @@ class BruteForceMiddleware extends Middleware { if ($this->reflector->hasAnnotation('BruteForceProtection')) { $action = $this->reflector->getAnnotationParameter('BruteForceProtection', 'action'); - $this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), $action); + $this->delaySlept += $this->throttler->sleepDelayOrThrowOnMax($this->request->getRemoteAddress(), $action); } else { $reflectionMethod = new ReflectionMethod($controller, $methodName); $attributes = $reflectionMethod->getAttributes(BruteForceProtection::class); @@ -79,7 +81,7 @@ class BruteForceMiddleware extends Middleware { /** @var BruteForceProtection $protection */ $protection = $attribute->newInstance(); $action = $protection->getAction(); - $this->throttler->sleepDelayOrThrowOnMax($remoteAddress, $action); + $this->delaySlept += $this->throttler->sleepDelayOrThrowOnMax($remoteAddress, $action); } } } @@ -95,7 +97,7 @@ class BruteForceMiddleware extends Middleware { $action = $this->reflector->getAnnotationParameter('BruteForceProtection', 'action'); $ip = $this->request->getRemoteAddress(); $this->throttler->registerAttempt($action, $ip, $response->getThrottleMetadata()); - $this->throttler->sleepDelayOrThrowOnMax($ip, $action); + $this->delaySlept += $this->throttler->sleepDelayOrThrowOnMax($ip, $action); } else { $reflectionMethod = new ReflectionMethod($controller, $methodName); $attributes = $reflectionMethod->getAttributes(BruteForceProtection::class); @@ -111,7 +113,7 @@ class BruteForceMiddleware extends Middleware { if (!isset($metaData['action']) || $metaData['action'] === $action) { $this->throttler->registerAttempt($action, $ip, $metaData); - $this->throttler->sleepDelayOrThrowOnMax($ip, $action); + $this->delaySlept += $this->throttler->sleepDelayOrThrowOnMax($ip, $action); } } } else { @@ -127,6 +129,14 @@ class BruteForceMiddleware extends Middleware { } } + if ($this->delaySlept) { + $headers = $response->getHeaders(); + if (!isset($headers['X-Nextcloud-Bruteforce-Throttled'])) { + $headers['X-Nextcloud-Bruteforce-Throttled'] = $this->delaySlept . 'ms'; + $response->setHeaders($headers); + } + } + return parent::afterController($controller, $methodName, $response); } |