Merge pull request #12029 from nextcloud/bugfix/noid/dont-bruteforce-…

…throttle-undefined fix(frontpage): Don't bruteforce protect "undefined"
nextcloud · Apr 10, 2024 · 297fd10 · 297fd10
2 parents f425841 + 2dfddf9
commit 297fd10
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php
@@ -205,8 +205,11 @@ protected function pageHandler(string $token = '', string $callUser = '', string
 				}
 			} catch (RoomNotFoundException $e) {
 				// Room not found, redirect to main page
+				$throttle = $token !== 'undefined';
+				if ($token === 'undefined') {
+					$this->logger->debug('User "' . ($this->userId ?? 'ANONYMOUS') . '" tried to access "undefined"', ['app' => 'spreed-bfp']);
+				}
 				$token = '';
-				$throttle = true;
 			}
 
 			if ($room instanceof Room && $room->hasPassword()) {
@@ -361,7 +364,13 @@ protected function guestEnterRoom(string $token, string $password): Response {
 			$response = new RedirectResponse($this->url->linkToRoute('core.login.showLoginForm', [
 				'redirect_url' => $redirectUrl,
 			]));
-			$response->throttle(['token' => $token, 'action' => 'talkRoomToken']);
+			if ($token !== 'undefined') {
+				// Logged-in user tried to access a chat they can not access
+				$this->logger->debug('User "' . ($this->userId ?? 'ANONYMOUS') . '" throttled for accessing "' . $token . '"', ['app' => 'spreed-bfp']);
+				$response->throttle(['token' => $token, 'action' => 'talkRoomToken']);
+			} else {
+				$this->logger->debug('User "' . ($this->userId ?? 'ANONYMOUS') . '" tried to access "undefined"', ['app' => 'spreed-bfp']);
+			}
 			return $response;
 		}
 

diff --git a/tests/integration/features/conversation-1/bruteforce-protection.feature b/tests/integration/features/conversation-1/bruteforce-protection.feature
@@ -72,6 +72,12 @@ Feature: conversation/bruteforce-protection
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200