From e5e139f5a6f1512a854e44ffd3ba6df788b14d3d Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 30 Nov 2023 12:52:35 +0100 Subject: fix(bruteforce-protection): Don't throw a 500 when MaxDelayReached is thrown Signed-off-by: Joas Schilling --- index.php | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'index.php') diff --git a/index.php b/index.php index f57cc03dd5e..235a33c8317 100644 --- a/index.php +++ b/index.php @@ -29,6 +29,8 @@ * */ require_once __DIR__ . '/lib/versioncheck.php'; + +use OCP\Security\Bruteforce\MaxDelayReached; use Psr\Log\LoggerInterface; try { @@ -77,6 +79,21 @@ try { exit(); } OC_Template::printErrorPage($ex->getMessage(), $ex->getMessage(), 401); +} catch (MaxDelayReached $ex) { + $request = \OC::$server->getRequest(); + /** + * Routes with the @CORS annotation and other API endpoints should + * not return a webpage, so we only print the error page when html is accepted, + * otherwise we reply with a JSON array like the BruteForceMiddleware would do. + */ + if (stripos($request->getHeader('Accept'), 'html') === false) { + http_response_code(429); + header('Content-Type: application/json; charset=utf-8'); + echo json_encode(['message' => $ex->getMessage()]); + exit(); + } + http_response_code(429); + OC_Template::printGuestPage('core', '429'); } catch (Exception $ex) { \OC::$server->get(LoggerInterface::class)->error($ex->getMessage(), [ 'app' => 'index', -- cgit v1.2.3