aa5f037af7
chore: apply changes from Nextcloud coding standards 1.1.1
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
2023-11-23 10:36:13 +07:00
f313ca92e7
Refactors lib/private/Security.
...
Mainly using PHP8's constructor property promotion.
Signed-off-by: Faraz Samapoor <fsa@adlas.at>
2023-09-27 09:03:15 +07:00
124588d4a6
fix: Make bypass function public API
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-08-21 16:40:24 +07:00
fd9b2d488e
feat: Expose if the own IP is allowed to bypass bruteforce protection
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-08-21 16:36:04 +07:00
abc98d343c
feat(security): Add a "testing mode" for bruteforce protection that doesn't sleep
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-08-21 16:36:03 +07:00
a95800c647
feat(security): Add a bruteforce protection backend base on memcache
...
Similar to the ratelimit backend
Signed-off-by: Joas Schilling <coding@schilljs.com>
2023-08-21 16:36:03 +07:00
e7cc7653b8
Refactors "strpos" calls in lib/private to improve code readability.
...
Signed-off-by: Faraz Samapoor <fsamapoor@gmail.com>
2023-05-15 15:17:19 +07:00
426c0341ff
Use typed version of IConfig::getSystemValue as much as possible
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-04-05 12:50:08 +07:00
f5c361cf44
composer run cs:fix
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2023-01-20 11:45:08 +07:00
c0f47af2d0
Add a public interface for the bruteforce throttler and register for injection
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-07-28 10:57:10 +07:00
8274c05e19
Only ignore attempts of the same action
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-07-07 09:35:14 +07:00
69b36fc2c5
Don't inject Bruteforce capability info in the webui
...
This capability do DB access and as far I know is not used by the webui.
This remove one DB query for each page load.
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
2022-04-07 17:33:29 +07:00
6be7aa112f
Migrate from ILogger to LoggerInterface in lib/private
...
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
2022-03-24 16:21:25 +07:00
b8e0a3dbdd
Use the new option to signaling insensitivity
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-02-07 13:54:54 +07:00
c6d000f87f
Log bruteforce throttle and blocking
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2022-01-18 10:10:19 +07:00
1d550ab95e
Don't query the bruteforce attempts when we just deleted them
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2021-12-01 18:01:22 +07:00
215aef3cbd
Update php licenses
...
Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
2021-06-04 22:02:41 +07:00
ca7b37ce5a
Make Security module strict
...
Signed-off-by: J0WI <J0WI@users.noreply.github.com>
2021-04-19 17:31:12 +07:00
d89a75be0b
Update all license headers for Nextcloud 21
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-12-16 18:48:22 +07:00
f5501ca276
Avoid checking for brute force protection capabilities when upgrading
...
This might happen a releases that doesn't have this table yet
Signed-off-by: Julius Härtl <jus@bitgrid.net>
2020-12-09 12:13:33 +07:00
8fae2beece
Limit throttler to 48 hours
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-10-08 19:51:13 +07:00
6c1b542def
Add cleanup job for old brutefoce attempts
...
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-10-08 19:51:13 +07:00
d9015a8c94
Format code to a single space around binary operators
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-10-05 20:25:24 +07:00
99c9423766
Remove @suppress SqlInjectionChecker
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-09-16 15:53:56 +07:00
c25063dc07
Don't break when the IP is empty
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-09-10 14:20:27 +07:00
2a054e6c04
Update the license headers for Nextcloud 20
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-08-24 14:54:25 +07:00
35a8519591
Fix CS
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
770381c0c6
Correctly return ms delay when at max
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
931aca2fee
Add missing default
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
d9c4c9eb99
Simplify array filter
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
dfeee3b850
Fix wrong doc + type hint
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
8376c4891f
Only throw when also the last 30 mins were attacking
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
6f751d01db
Make the throttling O(2^n) instead of O(n^n)
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
64539a6ee1
Make Throttler strict
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:36 +07:00
c8fea66d65
Split delay calculation from getting the attempts
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:35 +07:00
cdb36c8ead
Let the database count the entries
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:35 +07:00
e66bc4a8a7
Send "429 Too Many Requests" in case of brute force protection
...
Signed-off-by: Joas Schilling <coding@schilljs.com>
2020-08-19 11:20:35 +07:00
e57bca31ad
Merge pull request #20005 from joeried/occ-remove-bruteforce-attempts-by-ip
...
Implement occ command to reset bruteforce attemps from a given IP address
2020-05-25 14:04:18 +07:00
bd997a105c
Fix code style
...
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2020-05-25 14:03:21 +07:00
cb057829f7
Update license headers for 19
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-29 11:57:22 +07:00
28f8eb5dba
Add visibility to all constants
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 16:54:27 +07:00
caff1023ea
Format control structures, classes, methods and function
...
To continue this formatting madness, here's a tiny patch that adds
unified formatting for control structures like if and loops as well as
classes, their methods and anonymous functions. This basically forces
the constructs to start on the same line. This is not exactly what PSR2
wants, but I think we can have a few exceptions with "our" style. The
starting of braces on the same line is pracrically standard for our
code.
This also removes and empty lines from method/function bodies at the
beginning and end.
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 14:19:56 +07:00
14c996d982
Use elseif instead of else if
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 10:35:09 +07:00
afbd9c4e6e
Unify function spacing to PSR2 recommendation
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-09 13:54:22 +07:00
0c38569c83
Implement occ command security:bruteforceattemps:reset-for-ip
...
Signed-off-by: Johannes Riedel <joeried@users.noreply.github.com>
2020-03-19 16:20:22 +07:00
5bf3d1bb38
Update license headers
...
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-12-05 15:38:45 +07:00
68748d4f85
Some php-cs fixes
...
* Order the imports
* No leading slash on imports
* Empty line before namespace
* One line per import
* Empty after imports
* Emmpty line at bottom of file
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-11-22 20:52:10 +07:00
f1ea56b502
Fix the thorrtler whitelist bitmask
...
Before we actually didn't check each bit of the bitmask. Now we do.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2019-02-11 23:22:20 +07:00
ad66c6bf08
Fix #9864 : Decrease $maxDelay in Throttler.php
...
Signed-off-by: Mark Berezovsky <xpnf@yandex.ru>
2018-06-15 04:58:08 +07:00
5a270c2715
Reset bruteforce attempt table on successful login
...
* only clear the entries that come from the same subnet, same action and same metadata
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-24 14:58:57 +07:00
Joas Schilling
Faraz Samapoor
Faraz Samapoor
Côme Chilliet
Carl Schwan
John Molakvoæ (skjnldsv)
J0WI
Christoph Wurst
Julius Härtl
Roeland Jago Douma
Morris Jobke
Johannes Riedel
Mark Berezovsky