From f1ea56b5024729e01050249a0c4ee7ac28faca83 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Mon, 11 Feb 2019 23:22:20 +0100 Subject: Fix the thorrtler whitelist bitmask Before we actually didn't check each bit of the bitmask. Now we do. Signed-off-by: Roeland Jago Douma --- lib/private/Security/Bruteforce/Throttler.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'lib/private/Security/Bruteforce') diff --git a/lib/private/Security/Bruteforce/Throttler.php b/lib/private/Security/Bruteforce/Throttler.php index 3282121d967..ec56b4f7ee2 100644 --- a/lib/private/Security/Bruteforce/Throttler.php +++ b/lib/private/Security/Bruteforce/Throttler.php @@ -177,8 +177,10 @@ class Throttler { $part = ord($addr[(int)($i/8)]); $orig = ord($ip[(int)($i/8)]); - $part = $part & (15 << (1 - ($i % 2))); - $orig = $orig & (15 << (1 - ($i % 2))); + $bitmask = 1 << (7 - ($i % 8)); + + $part = $part & $bitmask; + $orig = $orig & $bitmask; if ($part !== $orig) { $valid = false; -- cgit v1.2.3