From 0d89c1491164a3ee33bd85839eae963d51b45a36 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Mon, 14 Nov 2016 15:26:23 +0100
Subject: [PATCH] Add bruteforce checker to Person.php
Also check for attempts on this endpoint
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
---
lib/private/OCS/Person.php | 3 +++
1 file changed, 3 insertions(+)
diff --git a/lib/private/OCS/Person.php b/lib/private/OCS/Person.php
index bbb4a39e1e8..d14465c5ce9 100644
--- a/lib/private/OCS/Person.php
+++ b/lib/private/OCS/Person.php
@@ -31,10 +31,13 @@ class Person {
$login = isset($_POST['login']) ? $_POST['login'] : false;
$password = isset($_POST['password']) ? $_POST['password'] : false;
if($login && $password) {
+ $remoteIp = \OC::$server->getRequest()->getRemoteAddress();
+ \OC::$server->getBruteForceThrottler()->sleepDelay($remoteIp);
if(\OC_User::checkPassword($login, $password)) {
$xml['person']['personid'] = $login;
return new Result($xml);
} else {
+ \OC::$server->getBruteForceThrottler()->registerAttempt('login', $remoteIp);
return new Result(null, 102);
}
} else {
--
GitLab