mirror_html/filegator
1
0
Fork 0
mirror of https://github.com/filegator/filegator.git synced 2025-08-05 21:37:37 +02:00
Code Issues Projects Releases Wiki Activity

lockout bugfix and version bump

Browse Source
This commit is contained in:
Milos Stojanovic
2023-01-20 16:45:35 +01:00
parent 16a856a14b
commit d0936b92c1
4 changed files with 36 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@@ -2,6 +2,9 @@
## Upcoming... ## Upcoming...
## 7.9.1 - 2023-01-20
* Lockout bugfix
## 7.9.0 - 2023-01-20 ## 7.9.0 - 2023-01-20
* Added configurable lockout for incorrect login attempts (see configuration_sample.php) * Added configurable lockout for incorrect login attempts (see configuration_sample.php)

16
backend/Controllers/AuthController.php
View File

@@ -33,14 +33,6 @@ class AuthController
$password = $request->input('password'); $password = $request->input('password');
$ip = $request->getClientIp(); $ip = $request->getClientIp();
if ($auth->authenticate($username, $password)) {
$this->logger->log("Logged in {$username} from IP ".$ip);
return $response->json($auth->user());
}
$this->logger->log("Login failed for {$username} from IP ".$ip);
$lockfile = md5($ip).'.lock'; $lockfile = md5($ip).'.lock';
$lockout_attempts = $config->get('lockout_attempts', 5); $lockout_attempts = $config->get('lockout_attempts', 5);
$lockout_timeout = $config->get('lockout_timeout', 15); $lockout_timeout = $config->get('lockout_timeout', 15);
@@ -55,6 +47,14 @@ class AuthController
return $response->json('Not Allowed', 429); return $response->json('Not Allowed', 429);
} }
if ($auth->authenticate($username, $password)) {
$this->logger->log("Logged in {$username} from IP ".$ip);
return $response->json($auth->user());
}
$this->logger->log("Login failed for {$username} from IP ".$ip);
$tmpfs->write($lockfile, 'x', true); $tmpfs->write($lockfile, 'x', true);
return $response->json('Login failed, please try again', 422); return $response->json('Login failed, please try again', 422);

2
dist/index.php vendored
View File

@@ -41,7 +41,7 @@ if (! defined('APP_PUBLIC_PATH')) {
} }
define('APP_PUBLIC_DIR', __DIR__); define('APP_PUBLIC_DIR', __DIR__);
define('APP_VERSION', '7.9.0'); define('APP_VERSION', '7.9.1');
use Filegator\App; use Filegator\App;
use Filegator\Config\Config; use Filegator\Config\Config;

41
tests/backend/Feature/AuthTest.php
View File

@@ -41,35 +41,42 @@ class AuthTest extends TestCase
public function testBruteForceLogin() public function testBruteForceLogin()
{ {
// standard 422 bad response code
$this->sendRequest('POST', '/login', [ $this->sendRequest('POST', '/login', [
'username' => 'fake', 'username' => 'bad',
'password' => 'fake', 'password' => 'bad',
], [], ['REMOTE_ADDR' => '10.10.10.10']); ], [], ['REMOTE_ADDR' => '10.10.10.10']);
$this->assertUnprocessable(); $this->assertStatus(422);
// too many requests should change the response code to 429
for ($i = 0; $i < 20; $i++) { for ($i = 0; $i < 20; $i++) {
$this->sendRequest('POST', '/login', [ $this->sendRequest('POST', '/login', [
'username' => 'fake', 'username' => 'bad',
'password' => 'fake', 'password' => 'bad',
], [], ['REMOTE_ADDR' => '10.10.10.10']); ], [], ['REMOTE_ADDR' => '10.10.10.10']);
} }
$this->assertStatus(429); $this->assertStatus(429);
for ($i = 0; $i < 20; $i++) { // now even the good one from this ip should fail as 429
$this->sendRequest('POST', '/login', [ $this->sendRequest('POST', '/login', [
'username' => 'fake', 'username' => 'john@example.com',
'password' => 'fake', 'password' => 'john123',
], [], ['REMOTE_ADDR' => '2001:db8:3333:4444:5555:6666:7777:8888']); ], [], ['REMOTE_ADDR' => '10.10.10.10']);
}
$this->assertStatus(429); $this->assertStatus(429);
// another ip should fail as a standard 422 bad response (unaffected)
// new ip should be ok
$this->sendRequest('POST', '/login', [ $this->sendRequest('POST', '/login', [
'username' => 'fake', 'username' => 'bad',
'password' => 'fake', 'password' => 'bad',
], [], ['REMOTE_ADDR' => '10.10.10.1']); ], [], ['REMOTE_ADDR' => '2001:db8:3333:4444:5555:6666:7777:8888']);
$this->assertUnprocessable(); $this->assertStatus(422);
// another ip with valid credentials should be ok (unaffected)
$this->sendRequest('POST', '/login', [
'username' => 'john@example.com',
'password' => 'john123',
], [], ['REMOTE_ADDR' => '20.20.20.20']);
$this->assertOk();
} }
public function testAlreadyLoggedIn() public function testAlreadyLoggedIn()