From d0d34d308a9d752d372fb9249b00014b8fa7f9a1 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Sat, 22 Apr 2017 08:12:54 +0200 Subject: Add at most 10 password reset requests per 5 minutes and IP range Signed-off-by: Lukas Reschke --- core/Controller/LostController.php | 1 + 1 file changed, 1 insertion(+) (limited to 'core/Controller') diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php index 8d26f2c1942..27491b88235 100644 --- a/core/Controller/LostController.php +++ b/core/Controller/LostController.php @@ -206,6 +206,7 @@ class LostController extends Controller { /** * @PublicPage * @BruteForceProtection(action=passwordResetEmail) + * @AnonRateThrottle(limit=10, period=300) * * @param string $user * @return JSONResponse -- cgit v1.2.3