stian/gallery3
1
0
Fork 0
mirror of https://github.com/Pathduck/gallery3.git synced 2026-07-10 17:29:18 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

Protect REST login controller from brute force attacks too.

Browse Source 
And make the REST auth token less predictable by using a better source for randomness.
This commit is contained in:
Andy Staudacher
2010-01-30 21:42:57 -08:00
parent cb92e58d40
commit 1470b99d1f
3 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
modules/rest/controllers/rest.php
View File

@@ -22,11 +22,18 @@ class Rest_Controller extends Controller {
$username = Input::instance()->post("user");
$password = Input::instance()->post("password");
$user = identity::lookup_user_by_name($username);
if (empty($user) || !identity::is_correct_password($user, $password)) {
if (empty($username) || !auth::validate_too_many_failed_logins($username)) {
throw new Rest_Exception("Forbidden", 403);
}
$user = identity::lookup_user_by_name($username);
if (empty($user) || !identity::is_correct_password($user, $password)) {
module::event("user_login_failed", $username);
throw new Rest_Exception("Forbidden", 403);
}
auth::login($user);
$key = rest::get_access_token($user->id);
rest::reply($key->access_key);
}