aboutsummaryrefslogtreecommitdiffstats
path: root/tests/lib/Security/Bruteforce
Commit message (Collapse)AuthorAgeFilesLines
* fix(ratelimit): Allow to bypass rate-limit from bruteforce allowlistbugfix/noid/allow-ratelimit-bypassJoas Schilling2025-01-271-212/+0
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* refactor: Add void return type to PHPUnit test methodsChristoph Wurst2024-09-151-2/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* chore: Add SPDX headerAndy Scherzinger2024-05-133-53/+6
| | | | Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
* chore: apply changes from Nextcloud coding standards 1.1.1Joas Schilling2023-11-231-7/+7
| | | | | Signed-off-by: Joas Schilling <coding@schilljs.com> Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
* fix: Make bypass function public APIJoas Schilling2023-08-212-5/+5
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat: Expose if the own IP is allowed to bypass bruteforce protectionJoas Schilling2023-08-211-4/+11
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* feat(security): Add a bruteforce protection backend base on memcacheJoas Schilling2023-08-212-23/+164
| | | | | | Similar to the ratelimit backend Signed-off-by: Joas Schilling <coding@schilljs.com>
* Adapt tests to config value typingCôme Chilliet2023-04-051-1/+1
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Migrate from ILogger to LoggerInterface where needed in the testsCôme Chilliet2022-03-241-3/+3
| | | | Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
* Make Security module strictJ0WI2021-04-192-0/+6
| | | | Signed-off-by: J0WI <J0WI@users.noreply.github.com>
* Don't break when the IP is emptyJoas Schilling2020-09-101-2/+22
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Change PHPDoc type hint from PHPUnit_Framework_MockObject_MockObject to ↵Morris Jobke2020-08-122-4/+4
| | | | | | \PHPUnit\Framework\MockObject\MockObject Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Unify function spacing to PSR2 recommendationChristoph Wurst2020-04-091-1/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Use the shorter phpunit syntax for mocked return valuesChristoph Wurst2020-03-251-2/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Mode to modern phpunitRoeland Jago Douma2019-11-272-2/+2
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Make phpunit8 compatibleRoeland Jago Douma2019-11-272-2/+2
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Some php-cs fixesRoeland Jago Douma2019-11-222-0/+2
| | | | | | | | | | | * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix the thorrtler whitelist bitmaskRoeland Jago Douma2019-02-111-0/+29
| | | | | | Before we actually didn't check each bit of the bitmask. Now we do. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add bruteforce capabilitiesRoeland Jago Douma2017-07-131-0/+68
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add missing spaceLukas Reschke2017-05-011-1/+1
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Mark IP as whitelisted if brute force protection is disabledLukas Reschke2017-05-011-8/+51
| | | | | | | | Currently, when disabling the brute force protection no new brute force attempts are logged. However, the ones logged within the last 24 hours will still be used for throttling. This is quite an unexpected behaviour and caused some support issues. With this change when the brute force protection is disabled also the existing attempts within the last 24 hours will be disregarded. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Add support for ratelimiting via annotationsLukas Reschke2017-04-131-45/+0
| | | | | | | | | | | | | This allows adding rate limiting via annotations to controllers, as one example: ``` @UserRateThrottle(limit=5, period=100) @AnonRateThrottle(limit=1, period=100) ``` Would mean that logged-in users can access the page 5 times within 100 seconds, and anonymous users 1 time within 100 seconds. If only an AnonRateThrottle is specified that one will also be applied to logged-in users. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Respect bruteforce settings in the ThrottlerRoeland Jago Douma2017-04-021-1/+89
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Fix getMock SecurityRoeland Jago Douma2016-09-071-3/+3
|
* Implement brute force protectionLukas Reschke2016-07-201-0/+123
Class Throttler implements the bruteforce protection for security actions in Nextcloud. It is working by logging invalid login attempts to the database and slowing down all login attempts from the same subnet. The max delay is 30 seconds and the starting delay are 200 milliseconds. (after the first failed login)
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-24 09:12:51 +0000