Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-06 10:50:21 +08:00
Code Packages Activity Actions 9

SECURITY: do cookie auth rate limiting earlier

Browse source
This commit is contained in:
Sam 2016-08-09 10:02:18 +10:00
parent 277e7383f3
commit 5cc8bb535b
2 changed files with 16 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/auth/default_current_user_provider.rb
View file

@ -38,14 +38,18 @@ class Auth::DefaultCurrentUserProvider
current_user = nil
if auth_token && auth_token.length == 32
current_user = User.where(auth_token: auth_token)
limiter = RateLimiter.new(nil, "cookie_auth_#{request.ip}", COOKIE_ATTEMPTS_PER_MIN ,60)
if limiter.can_perform?
current_user = User.where(auth_token: auth_token)
.where('auth_token_updated_at IS NULL OR auth_token_updated_at > ?',
SiteSetting.maximum_session_age.hours.ago)
.first
end
unless current_user
begin
RateLimiter.new(nil, "cookie_auth_#{request.ip}", COOKIE_ATTEMPTS_PER_MIN ,60).performed!
limiter.performed!
rescue RateLimiter::LimitExceeded
raise Discourse::InvalidAccess
end