Page MenuHomePhabricator
Files F15441160

D19997.id47733.diff
No OneTemporary
Actions

D19997.id47733.diff
View Options

diff --git a/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php b/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php
--- a/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php
+++ b/src/applications/auth/provider/PhabricatorPasswordAuthProvider.php
@@ -255,18 +255,39 @@
$viewer = $request->getUser();
$content_source = PhabricatorContentSource::newFromRequest($request);
+ $captcha_limit = 5;
+ $hard_limit = 32;
+ $limit_window = phutil_units('15 minutes in seconds');
+
+ $failed_attempts = PhabricatorUserLog::loadRecentEventsFromThisIP(
+ PhabricatorUserLog::ACTION_LOGIN_FAILURE,
+ $limit_window);
+
+ // If the same remote address has submitted several failed login attempts
+ // recently, require a they provide a CAPTCHA response for new attempts.
$require_captcha = false;
$captcha_valid = false;
if (AphrontFormRecaptchaControl::isRecaptchaEnabled()) {
- $failed_attempts = PhabricatorUserLog::loadRecentEventsFromThisIP(
- PhabricatorUserLog::ACTION_LOGIN_FAILURE,
- 60 * 15);
- if (count($failed_attempts) > 5) {
+ if (count($failed_attempts) > $captcha_limit) {
$require_captcha = true;
$captcha_valid = AphrontFormRecaptchaControl::processCaptcha($request);
}
}
+ // If the user has submitted quite a few failed login attempts recently,
+ // give them a hard limit.
+ if (count($failed_attempts) > $hard_limit) {
+ $dialog = $controller->newDialog()
+ ->setTitle(pht('Too Many Login Attempts'))
+ ->appendParagraph(
+ pht(
+ 'Your remote address has failed too many login attempts '.
+ 'recently. Wait a few minutes before trying again.'))
+ ->addCancelButton('/auth/start/', pht('Wait Patiently'));
+
+ return array(null, $dialog);
+ }
+
$response = null;
$account = null;
$log_user = null;

File Metadata

Mime Type
text/plain
Expires
Thu, Mar 27, 4:43 PM (1 w, 2 d ago)
Storage Engine
blob
Storage Format
Encrypted (AES-256-CBC)
Storage Handle
7718920
Default Alt Text
D19997.id47733.diff (1 KB)

Event Timeline

Phabricator · Built by Phacility