Skip to content

Send "429 Too Many Requests" in case of brute force protection - #22280

Merged
MorrisJobke merged 15 commits into
masterfrom
bugfix/noid/429-on-brute-force-maximum
Aug 19, 2020
Merged

Send "429 Too Many Requests" in case of brute force protection#22280
MorrisJobke merged 15 commits into
masterfrom
bugfix/noid/429-on-brute-force-maximum

Conversation

@nickvergessen

@nickvergessennickvergessen commented Aug 18, 2020

Copy link
Copy Markdown
Member

No description provided.

@nickvergessennickvergessen added this to the Nextcloud 20 milestone Aug 18, 2020
MorrisJobke
MorrisJobke approved these changes Aug 18, 2020
View reviewed changes

@MorrisJobkeMorrisJobke left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice 👍 Also the move of the count functionality into the SQL statement is a good catch 🚀

@nickvergessen
Send "429 Too Many Requests" in case of brute force protection
e66bc4a
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Let the database count the entries
cdb36c8
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Split delay calculation from getting the attempts
c8fea66
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Make Throttler strict
64539a6
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Make the throttling O(2^n) instead of O(n^n)
6f751d0
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Only throw when also the last 30 mins were attacking
8376c48
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Fix wrong doc + type hint
dfeee3b
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Simplify array filter
d9c4c9e
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Add missing default
931aca2
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Correctly return ms delay when at max
770381c
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Fix CS
35a8519
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Fix unit tests
41d8a7e
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
Update autoloader
6f5f71d
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen
nickvergessenforce-pushed the bugfix/noid/429-on-brute-force-maximum branch from 4bdae65 to 6f5f71dCompareAugust 19, 2020 09:21
@nickvergessen

nickvergessen commented Aug 19, 2020

Copy link
Copy Markdown
MemberAuthor

Rebased and fixed the tests

@nickvergessen
More test fixing
a9f22ac
Signed-off-by: Joas Schilling <coding@schilljs.com>
@nickvergessen

nickvergessen commented Aug 19, 2020

Copy link
Copy Markdown
MemberAuthor

Not sure whats going on with the psalm thing and how to fix this. @MorrisJobke

MorrisJobke
MorrisJobke reviewed Aug 19, 2020
View reviewed changes
Comment threadlib/public/AppFramework/Http/TooManyRequestsResponse.php
@MorrisJobke
Fix the return type of OC_Template->fetchPage() to be string only
e93bf71
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
@faily-bot

faily-botBot commented Aug 19, 2020

Copy link
Copy Markdown

🤖 beep boop beep 🤖

Here are the logs for the failed build:

Status of 31983: failure

mysql8.0-php7.2

Show full log
There were 2 warnings:
1) Test\Files\ViewTest::testRenameFailDeleteTargetKeepSource
Trying to configure method "writeStream" which cannot be configured because it does not exist, has not been specified, is final, or is static
2) Test\Files\ViewTest::testCopyFailDeleteTargetKeepSource
Trying to configure method "writeStream" which cannot be configured because it does not exist, has not been specified, is final, or is static
--
There was 1 failure:
1) Test\Files\Cache\UpdaterLegacyTest::testWriteWithMountPoints
Failed asserting that two strings are not identical.
/drone/src/tests/lib/Files/Cache/UpdaterLegacyTest.php:139

@MorrisJobke

MorrisJobke commented Aug 19, 2020

Copy link
Copy Markdown
Member

The fix for the static code analysis is in #22304

MorrisJobke
MorrisJobke approved these changes Aug 19, 2020
View reviewed changes

@MorrisJobkeMorrisJobke left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From me again 👍

@MorrisJobke
MorrisJobke merged commit 4c6eb96 into masterAug 19, 2020
@MorrisJobke
MorrisJobke deleted the bugfix/noid/429-on-brute-force-maximum branch August 19, 2020 16:21
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rullzerrullzerrullzer approved these changes
@MorrisJobkeMorrisJobkeMorrisJobke approved these changes
@ChristophWurstChristophWurstAwaiting requested review from ChristophWurst

Assignees

No one assigned

Labels

3. to reviewWaiting for reviewsbugfeature: authenticationsecurity

Projects

None yet

Milestone

Nextcloud 20

Development

Successfully merging this pull request may close these issues.

3 participants

@nickvergessen@MorrisJobke@rullzer