sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Only throw when also the last 30 mins were attacking 

Signed-off-by: Joas Schilling <coding@schilljs.com>
pull/22280/head
Joas Schilling 2020-03-19 13:42:31 +07:00
parent 6f751d01db
commit 8376c4891f
No known key found for this signature in database
GPG Key ID: 7076EA9751AACDDA
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
lib/private/Security/Bruteforce/Throttler.php
Unescape Escape View File

@ -96,12 +96,12 @@ class Throttler {
/**
* Calculate the cut off timestamp
*
* @param int $maxAgeHours
* @param float $maxAgeHours
* @return int
*/
private function getCutoffTimestamp(int $maxAgeHours): int {
private function getCutoffTimestamp(float $maxAgeHours): int {
return (new \DateTime())
->sub($this->getCutoff($maxAgeHours * 3600))
->sub($this->getCutoff((int) ($maxAgeHours * 3600)))
->getTimestamp();
}
@ -220,10 +220,10 @@ class Throttler {
*
* @param string $ip
* @param string $action optionally filter by action
* @param int $maxAgeHours
* @param float $maxAgeHours
* @return int
*/
public function getAttempts(string $ip, string $action = '', int $maxAgeHours = 12): int {
public function getAttempts(string $ip, string $action = '', float $maxAgeHours = 12): int {
$ipAddress = new IpAddress($ip);
if ($this->isIPWhitelisted((string)$ipAddress)) {
return 0;
@ -329,8 +329,8 @@ class Throttler {
}
/**
* Will sleep for the defined amount of time unless maximum is reached
* In case of maximum a "429 Too Many Request" response is thrown
* Will sleep for the defined amount of time unless maximum was reached in the last 30 minutes
* In this case a "429 Too Many Request" exception is thrown
*
* @param string $ip
* @param string $action optionally filter by action
@ -339,7 +339,8 @@ class Throttler {
*/
public function sleepDelayOrThrowOnMax(string $ip, string $action = ''): int {
$delay = $this->getDelay($ip, $action);
if ($delay === self::MAX_DELAY * 1000) {
if (($delay === self::MAX_DELAY * 1000) && $this->getAttempts($ip, $action, 0.5) > self::MAX_ATTEMPTS) {
// If the ip made too many attempts within the last 30 mins we don't execute anymore
throw new MaxDelayReached('Reached maximum delay');
}
usleep($delay * 1000);