fix(frontpage): Don't bruteforce protect "undefined"

It's a misbehaving bug in the frontend but we are yet unsure how it occurres

Signed-off-by: Joas Schilling <coding@schilljs.com>

lib/Controller/PageController.php

@@ -205,8 +205,11 @@ protected function pageHandler(string $token = '', string $callUser = '', string
 				}
 			} catch (RoomNotFoundException $e) {
 				// Room not found, redirect to main page
+				$throttle = $token !== 'undefined';
+				if ($token === 'undefined') {
+					$this->logger->debug('User "' . ($this->userId ?? 'ANONYMOUS') . '" tried to access "undefined"', ['app' => 'spreed-bfp']);
+				}
 				$token = '';
-				$throttle = true;
 			}
 
 			if ($room instanceof Room && $room->hasPassword()) {
@@ -361,7 +364,13 @@ protected function guestEnterRoom(string $token, string $password): Response {
 			$response = new RedirectResponse($this->url->linkToRoute('core.login.showLoginForm', [
 				'redirect_url' => $redirectUrl,
 			]));
-			$response->throttle(['token' => $token, 'action' => 'talkRoomToken']);
+			if ($token !== 'undefined') {
+				// Logged-in user tried to access a chat they can not access
+				$this->logger->debug('User "' . ($this->userId ?? 'ANONYMOUS') . '" throttled for accessing "' . $token . '"', ['app' => 'spreed-bfp']);
+				$response->throttle(['token' => $token, 'action' => 'talkRoomToken']);
+			} else {
+				$this->logger->debug('User "' . ($this->userId ?? 'ANONYMOUS') . '" tried to access "undefined"', ['app' => 'spreed-bfp']);
+			}
 			return $response;
 		}
 

tests/integration/features/conversation-1/bruteforce-protection.feature

@@ -72,6 +72,12 @@ Feature: conversation/bruteforce-protection
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
+    When user "participant2" views call-URL of room "undefined" with 200
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200
     When user "participant2" views call-URL of room "invalid" with 200