davrot/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2025-07-28 20:00:10 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #23810 from overleaf/msm-ldap-login-rate-limiter

Browse source 
[SP] LDAP login rate limiter

GitOrigin-RevId: dedab17da85c0f91b280d002cdad796e95b9fd4f
This commit is contained in:
Miguel Serrano 2025-03-05 11:10:08 +01:00 • committed by Copybot
parent 2c91363745
commit 42ee56ecd4
3 changed files with 27 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

1
server-ce/hotfix/5.3.2/Dockerfile Normal file
View file

@ -0,0 +1 @@
FROM sharelatex/sharelatex:5.3.1

6
services/web/app/src/Features/Security/RateLimiterMiddleware.js
View file

@ -56,8 +56,9 @@ function rateLimit(rateLimiter, opts = {}) {
} }
} }
function loginRateLimitEmail(req, res, next) { function loginRateLimitEmail(emailField = 'email') {
const { email } = req.body return function (req, res, next) {
const email = req.body[emailField]
if (!email) { if (!email) {
return next() return next()
} }
@ -79,6 +80,7 @@ function loginRateLimitEmail(req, res, next) {
}) })
} }
}) })
}
} }
const RateLimiterMiddleware = { const RateLimiterMiddleware = {

4
services/web/app/src/router.mjs
View file

@ -218,7 +218,7 @@ async function initialize(webRouter, privateApiRouter, publicApiRouter) {
webRouter.post( webRouter.post(
'/login', '/login',
RateLimiterMiddleware.rateLimit(overleafLoginRateLimiter), // rate limit IP (20 / 60s) RateLimiterMiddleware.rateLimit(overleafLoginRateLimiter), // rate limit IP (20 / 60s)
RateLimiterMiddleware.loginRateLimitEmail, // rate limit email (10 / 120s) RateLimiterMiddleware.loginRateLimitEmail(), // rate limit email (10 / 120s)
CaptchaMiddleware.validateCaptcha('login'), CaptchaMiddleware.validateCaptcha('login'),
AuthenticationController.passportLogin AuthenticationController.passportLogin
) )
@ -243,7 +243,7 @@ async function initialize(webRouter, privateApiRouter, publicApiRouter) {
webRouter.post( webRouter.post(
'/login/legacy', '/login/legacy',
RateLimiterMiddleware.rateLimit(overleafLoginRateLimiter), // rate limit IP (20 / 60s) RateLimiterMiddleware.rateLimit(overleafLoginRateLimiter), // rate limit IP (20 / 60s)
RateLimiterMiddleware.loginRateLimitEmail, // rate limit email (10 / 120s) RateLimiterMiddleware.loginRateLimitEmail(), // rate limit email (10 / 120s)
CaptchaMiddleware.validateCaptcha('login'), CaptchaMiddleware.validateCaptcha('login'),
AuthenticationController.passportLogin AuthenticationController.passportLogin
) )