upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-27 17:18:48 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 31

Add bruteforce protection to password reset page

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2023-01-20 13:10:09 +01:00
parent 41148acf83
commit 704eb3aa6c
No known key found for this signature in database
GPG key ID: 74434EFE0D2E2205
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
core/Controller/LostController.php
View file

@ -128,6 +128,8 @@ class LostController extends Controller {
*
* @PublicPage
* @NoCSRFRequired
* @BruteForceProtection(action=passwordResetEmail)
* @AnonRateThrottle(limit=10, period=300)
*/
public function resetform(string $token, string $userId): TemplateResponse {
try {
@ -137,12 +139,14 @@ class LostController extends Controller {
|| ($e instanceof InvalidTokenException
&& !in_array($e->getCode(), [InvalidTokenException::TOKEN_NOT_FOUND, InvalidTokenException::USER_UNKNOWN]))
) {
return new TemplateResponse(
$response = new TemplateResponse(
'core', 'error', [
"errors" => [["error" => $e->getMessage()]]
],
TemplateResponse::RENDER_AS_GUEST
);
$response->throttle();
return $response;
}
return new TemplateResponse('core', 'error', [
'errors' => [['error' => $this->l10n->t('Password reset is disabled')]]