github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-28 10:41:25 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

DEV: Move logic for rate limiting user second factor to one place (#11941)

Browse Source 
This moves all the rate limiting for user second factor (based on `params[:second_factor_token]` existing) to the one place, which rate limits by IP and also by username if a user is found.
This commit is contained in:
Martin Brennan
2021-02-04 09:03:30 +10:00
committed by GitHub
parent 61f5d501cb
commit e58f9f7a55
7 changed files with 132 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
app/controllers/users_controller.rb
View File

@ -729,9 +729,7 @@ class UsersController < ApplicationController
token = params[:token]
password_reset_find_user(token, committing_change: true)
if params[:second_factor_token].present?
RateLimiter.new(nil, "second-factor-min-#{request.remote_ip}", 3, 1.minute).performed!
end
rate_limit_second_factor!(@user)
# no point doing anything else if we can't even find
# a user from the token
@ -1389,9 +1387,7 @@ class UsersController < ApplicationController
totp_data = secure_session["staged-totp-#{current_user.id}"]
totp_object = current_user.get_totp_object(totp_data)
[request.remote_ip, current_user.id].each do |key|
RateLimiter.new(nil, "second-factor-min-#{key}", 3, 1.minute).performed!
end
rate_limit_second_factor!(current_user)
authenticated = !auth_token.blank? && totp_object.verify(
auth_token,