From 98b1a9a3ed90424d2aa1ff6b25fd03defff1992d Mon Sep 17 00:00:00 2001 From: Cristian Scheid Date: Thu, 30 Apr 2026 15:03:23 -0300 Subject: [PATCH] fix(slave-controller): add brute force protection and avoid saving token on debug log Signed-off-by: Cristian Scheid --- lib/Controller/SlaveController.php | 33 +++++++++++++++++------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/lib/Controller/SlaveController.php b/lib/Controller/SlaveController.php index d2329cfb..fc999519 100644 --- a/lib/Controller/SlaveController.php +++ b/lib/Controller/SlaveController.php @@ -121,11 +121,9 @@ public function __construct($appName, * @PublicPage * @NoCSRFRequired * @UseSession - * - * @param string $jwt - * @return RedirectResponse + * @BruteForceProtection(action=autoLogin) */ - public function autoLogin($jwt) { + public function autoLogin(string $jwt): RedirectResponse { $masterUrl = $this->gss->getMasterUrl(); @@ -134,7 +132,9 @@ public function autoLogin($jwt) { } if ($jwt === '') { - return new RedirectResponse($masterUrl); + $response = new RedirectResponse($masterUrl); + $response->throttle(); + return $response; } try { @@ -166,10 +166,14 @@ public function autoLogin($jwt) { } catch (ExpiredException $e) { $this->logger->info('token expired', ['app' => 'globalsiteselector']); - return new RedirectResponse($masterUrl); + $response = new RedirectResponse($masterUrl); + $response->throttle(); + return $response; } catch (\Exception $e) { $this->logger->logException($e, ['app' => 'globalsiteselector']); - return new RedirectResponse($masterUrl); + $response = new RedirectResponse($masterUrl); + $response->throttle(); + return $response; } $this->userSession->createSessionToken($this->request, $uid, $uid, null, IToken::REMEMBER); @@ -179,17 +183,16 @@ public function autoLogin($jwt) { } /** - * Create app token - * * @PublicPage * @NoAdminRequired - * - * @return DataResponse + * @BruteForceProtection(action=createAppToken) */ - public function createAppToken($jwt) { + public function createAppToken($jwt): DataResponse { if($this->gss->getMode() === 'master' || empty($jwt)) { - return new DataResponse([], Http::STATUS_BAD_REQUEST); + $response = new DataResponse([], Http::STATUS_BAD_REQUEST); + $response->throttle(); + return $response; } try { @@ -217,7 +220,9 @@ public function createAppToken($jwt) { $this->logger->logException('Create app password: ' . $e, ['app' => 'globalsiteselector']); } - return new DataResponse([], Http::STATUS_BAD_REQUEST); + $response = new DataResponse([], Http::STATUS_BAD_REQUEST); + $response->throttle(); + return $response; }