Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-03 23:00:14 -05:00
Code Issues Activity

Merge pull request #3620 from ErisDS/issue-3589

Browse source 
Cleaner spam prevention error messages
This commit is contained in:
Sebastian Gierlinger 2014-08-06 11:17:29 +02:00
commit 3908dbdf8f
1 changed files with 25 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
core/server/middleware/middleware.js
View file

@ -140,6 +140,7 @@ var middleware = {
remoteAddress = req.connection.remoteAddress, remoteAddress = req.connection.remoteAddress,
deniedRateLimit = '', deniedRateLimit = '',
ipCount = '', ipCount = '',
message = 'Too many attempts.',
rateSigninPeriod = config.rateSigninPeriod || 3600, rateSigninPeriod = config.rateSigninPeriod || 3600,
rateSigninAttempts = config.rateSigninAttempts || 10; rateSigninAttempts = config.rateSigninAttempts || 10;
@ -159,7 +160,12 @@ var middleware = {
deniedRateLimit = (ipCount[remoteAddress] > rateSigninAttempts); deniedRateLimit = (ipCount[remoteAddress] > rateSigninAttempts);
if (deniedRateLimit) { if (deniedRateLimit) {
return next(new errors.UnauthorizedError('Only ' + rateSigninAttempts + ' tries per IP address every ' + rateSigninPeriod + ' seconds.')); errors.logError(
'Only ' + rateSigninAttempts + ' tries per IP address every ' + rateSigninPeriod + ' seconds.',
'Too many login attempts.'
);
message += rateSigninPeriod === 3600 ? ' Please wait 1 hour.' : ' Please try again later';
return next(new errors.UnauthorizedError(message));
} }
next(); next();
}, },
@ -176,6 +182,7 @@ var middleware = {
ipCount = '', ipCount = '',
deniedRateLimit = '', deniedRateLimit = '',
deniedEmailRateLimit = '', deniedEmailRateLimit = '',
message = 'Too many attempts.',
index = _.findIndex(forgottenSecurity, function (logTime) { index = _.findIndex(forgottenSecurity, function (logTime) {
return (logTime.ip === remoteAddress && logTime.email === email); return (logTime.ip === remoteAddress && logTime.email === email);
}); });
@ -203,12 +210,26 @@ var middleware = {
deniedEmailRateLimit = (forgottenSecurity[index].count > rateForgottenAttempts); deniedEmailRateLimit = (forgottenSecurity[index].count > rateForgottenAttempts);
} }
if (deniedEmailRateLimit) { if (deniedEmailRateLimit) {
return next(new errors.UnauthorizedError('Only ' + rateForgottenAttempts + ' forgotten password attempts per email every ' + rateForgottenPeriod + ' seconds.')); errors.logError(
'Only ' + rateForgottenAttempts + ' forgotten password attempts per email every ' +
rateForgottenPeriod + ' seconds.',
'Forgotten password reset attempt failed'
);
} }
if (deniedRateLimit) { if (deniedRateLimit) {
return next(new errors.UnauthorizedError('Only ' + rateForgottenAttempts + ' tries per IP address every ' + rateForgottenPeriod + ' seconds.')); errors.logError(
'Only ' + rateForgottenAttempts + ' tries per IP address every ' + rateForgottenPeriod + ' seconds.',
'Forgotten password reset attempt failed'
);
}
if (deniedEmailRateLimit || deniedRateLimit) {
message += rateForgottenPeriod === 3600 ? ' Please wait 1 hour.' : ' Please try again later';
return next(new errors.UnauthorizedError(message));
} }
next(); next();