From 4381920834e55d353de0ca57bc4a80d8845c3f68 Mon Sep 17 00:00:00 2001 From: Cristian Scheid Date: Thu, 30 Apr 2026 15:03:23 -0300 Subject: [PATCH] fix(slave-controller): add brute force protection and avoid saving token on debug log Signed-off-by: Cristian Scheid --- lib/Controller/SlaveController.php | 39 +++++++++++++++--------------- 1 file changed, 19 insertions(+), 20 deletions(-) diff --git a/lib/Controller/SlaveController.php b/lib/Controller/SlaveController.php index fa42dce5..fe1f98a2 100644 --- a/lib/Controller/SlaveController.php +++ b/lib/Controller/SlaveController.php @@ -104,10 +104,7 @@ public function __construct( * @PublicPage * @NoCSRFRequired * @UseSession - * - * @param string $jwt - * - * @return RedirectResponse + * @BruteForceProtection(action=autoLogin) */ public function autoLogin(string $jwt): RedirectResponse { $this->logger->debug('autologin incoming request with ' . $jwt); @@ -119,11 +116,10 @@ public function autoLogin(string $jwt): RedirectResponse { return new RedirectResponse(''); } - if ($this->gss->isMaster()) { - return new RedirectResponse($masterUrl); - } - if ($jwt === '') { - return new RedirectResponse($masterUrl); + if ($this->gss->isMaster() || $jwt === '') { + $response = new RedirectResponse($masterUrl); + $response->throttle(); + return $response; } try { @@ -162,12 +158,14 @@ public function autoLogin(string $jwt): RedirectResponse { } } catch (ExpiredException $e) { $this->logger->info('token expired'); - - return new RedirectResponse($masterUrl); + $response = new RedirectResponse($masterUrl); + $response->throttle(); + return $response; } catch (\Exception $e) { $this->logger->warning('issue during login process', ['exception' => $e]); - - return new RedirectResponse($masterUrl); + $response = new RedirectResponse($masterUrl); + $response->throttle(); + return $response; } $this->logger->debug('all good. creating session'); @@ -186,16 +184,15 @@ public function autoLogin(string $jwt): RedirectResponse { } /** - * Create app token - * * @PublicPage * @NoAdminRequired - * - * @return DataResponse + * @BruteForceProtection(action=createAppToken) */ - public function createAppToken($jwt) { + public function createAppToken($jwt): DataResponse { if ($this->gss->getMode() === 'master' || empty($jwt)) { - return new DataResponse([], Http::STATUS_BAD_REQUEST); + $response = new DataResponse([], Http::STATUS_BAD_REQUEST); + $response->throttle(); + return $response; } try { @@ -225,7 +222,9 @@ public function createAppToken($jwt) { $this->logger->info('issue while token creation', ['exception' => $e]); } - return new DataResponse([], Http::STATUS_BAD_REQUEST); + $response = new DataResponse([], Http::STATUS_BAD_REQUEST); + $response->throttle(); + return $response; } /**