Merge pull request #36574 from nextcloud/backport/36489/stable24

[stable24] Add bruteforce protection to password reset page
nextcloud · Feb 7, 2023 · c81f672 · c81f672
2 parents 4de06c5 + f89eacb
commit c81f672
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php
@@ -134,6 +134,8 @@ public function __construct(
 	 *
 	 * @PublicPage
 	 * @NoCSRFRequired
+	 * @BruteForceProtection(action=passwordResetEmail)
+	 * @AnonRateThrottle(limit=10, period=300)
 	 *
 	 * @param string $token
 	 * @param string $userId
@@ -147,12 +149,14 @@ public function resetform($token, $userId) {
 				|| ($e instanceof InvalidTokenException
 					&& !in_array($e->getCode(), [InvalidTokenException::TOKEN_NOT_FOUND, InvalidTokenException::USER_UNKNOWN]))
 			) {
-				return new TemplateResponse(
+				$response = new TemplateResponse(
 					'core', 'error', [
 						"errors" => [["error" => $e->getMessage()]]
 					],
 					TemplateResponse::RENDER_AS_GUEST
 				);
+				$response->throttle();
+				return $response;
 			}
 			return new TemplateResponse('core', 'error', [
 				'errors' => [['error' => $this->l10n->t('Password reset is disabled')]]

diff --git a/tests/Core/Controller/LostControllerTest.php b/tests/Core/Controller/LostControllerTest.php
@@ -170,6 +170,7 @@ public function testResetFormTokenError() {
 				]
 			],
 			'guest');
+		$expectedResponse->throttle();
 		$this->assertEquals($expectedResponse, $response);
 	}
-Original file line number
+Diff line change
@@ Expand Up / @@ -170,6 +170,7 @@ public function testResetFormTokenError() { @@
     				]
     			],
     			'guest');
+    		$expectedResponse->throttle();
     		$this->assertEquals($expectedResponse, $response);
     	}
@@ Expand Down @@