upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-22 14:50:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 53

fix(bruteforce-protection): Don't throw a 500 when MaxDelayReached is thrown

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2023-11-30 12:52:35 +01:00
parent 84af629fa5
commit 2fd8cf4b15
No known key found for this signature in database
GPG key ID: 74434EFE0D2E2205
2 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
index.php
View file

@ -30,6 +30,8 @@
*/
require_once __DIR__ . '/lib/versioncheck.php';
use OCP\Security\Bruteforce\MaxDelayReached;
try {
require_once __DIR__ . '/lib/base.php';
@ -67,6 +69,21 @@ try {
exit();
}
OC_Template::printErrorPage($ex->getMessage(), $ex->getMessage(), 401);
} catch (MaxDelayReached $ex) {
$request = \OC::$server->getRequest();
/**
* Routes with the @CORS annotation and other API endpoints should
* not return a webpage, so we only print the error page when html is accepted,
* otherwise we reply with a JSON array like the BruteForceMiddleware would do.
*/
if (stripos($request->getHeader('Accept'), 'html') === false) {
http_response_code(429);
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['message' => $ex->getMessage()]);
exit();
}
http_response_code(429);
OC_Template::printGuestPage('core', '429');
} catch (Exception $ex) {
\OC::$server->getLogger()->logException($ex, ['app' => 'index']);

6
ocs/v1.php
View file

@ -41,8 +41,9 @@ if (\OCP\Util::needUpgrade()
exit;
}
use Symfony\Component\Routing\Exception\ResourceNotFoundException;
use OCP\Security\Bruteforce\MaxDelayReached;
use Symfony\Component\Routing\Exception\MethodNotAllowedException;
use Symfony\Component\Routing\Exception\ResourceNotFoundException;
/*
* Try the appframework routes
@ -62,6 +63,9 @@ try {
}
OC::$server->get(\OC\Route\Router::class)->match('/ocsapp'.\OC::$server->getRequest()->getRawPathInfo());
} catch (MaxDelayReached $ex) {
$format = \OC::$server->getRequest()->getParam('format', 'xml');
OC_API::respond(new \OC\OCS\Result(null, OCP\AppFramework\Http::STATUS_TOO_MANY_REQUESTS, $ex->getMessage()), $format);
} catch (ResourceNotFoundException $e) {
OC_API::setContentType();