Merge pull request #61886 from nextcloud/backport/61686/stable34

[stable34] fix(bruteforce): Don't throttle requests with failing CSRF
2026-07-15 04:51:46 -04:00 · 2026-07-07 20:01:36 +02:00 · 2026-07-07 20:01:36 +02:00 · 2f6d8bc5e3
commit 2f6d8bc5e3
parent eefefe589e 8a8feead27
2 changed files with 1 additions and 1 deletions
--- a/core/Controller/LoginController.php
+++ b/core/Controller/LoginController.php
@ -319,6 +319,7 @@ class LoginController extends Controller {
 				// case when a user has already logged-in, in another tab.
 				return $this->generateRedirect($redirect_url);
 			}
+			$throttle = false;
 			$error = self::LOGIN_MSG_CSRFCHECKFAILED;
 		}

--- a/tests/Core/Controller/LoginControllerTest.php
+++ b/tests/Core/Controller/LoginControllerTest.php
@ -597,7 +597,6 @@ class LoginControllerTest extends TestCase {
 		$response = $this->loginController->tryLogin($loginChain, $trustedDomainHelper, 'Jane', $password, $rememberme, $originalUrl);

 		$expected = new RedirectResponse('');
-		$expected->throttle(['user' => 'Jane']);
 		$this->assertEquals($expected, $response);
 	}