Browse Source
Fix the thorrtler whitelist bitmask
Before we actually didn't check each bit of the bitmask. Now we do.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
pull/14149/head
Roeland Jago Douma
8 years ago
No known key found for this signature in database
GPG Key ID: F941078878347C0C
2 changed files with
33 additions and
2 deletions
-
lib/private/Security/Bruteforce/Throttler.php
-
tests/lib/Security/Bruteforce/ThrottlerTest.php
|
|
|
@ -177,8 +177,10 @@ class Throttler { |
|
|
|
$part = ord($addr[(int)($i/8)]); |
|
|
|
$orig = ord($ip[(int)($i/8)]); |
|
|
|
|
|
|
|
$part = $part & (15 << (1 - ($i % 2))); |
|
|
|
$orig = $orig & (15 << (1 - ($i % 2))); |
|
|
|
$bitmask = 1 << (7 - ($i % 8)); |
|
|
|
|
|
|
|
$part = $part & $bitmask; |
|
|
|
$orig = $orig & $bitmask; |
|
|
|
|
|
|
|
if ($part !== $orig) { |
|
|
|
$valid = false; |
|
|
|
|
|
|
|
@ -100,6 +100,27 @@ class ThrottlerTest extends TestCase { |
|
|
|
], |
|
|
|
true, |
|
|
|
], |
|
|
|
[ |
|
|
|
'10.10.10.10', |
|
|
|
[ |
|
|
|
'whitelist_0' => '10.10.10.11/31', |
|
|
|
], |
|
|
|
true, |
|
|
|
], |
|
|
|
[ |
|
|
|
'10.10.10.10', |
|
|
|
[ |
|
|
|
'whitelist_0' => '10.10.10.9/31', |
|
|
|
], |
|
|
|
false, |
|
|
|
], |
|
|
|
[ |
|
|
|
'10.10.10.10', |
|
|
|
[ |
|
|
|
'whitelist_0' => '10.10.10.15/29', |
|
|
|
], |
|
|
|
true, |
|
|
|
], |
|
|
|
[ |
|
|
|
'dead:beef:cafe::1', |
|
|
|
[ |
|
|
|
@ -127,6 +148,14 @@ class ThrottlerTest extends TestCase { |
|
|
|
], |
|
|
|
true, |
|
|
|
], |
|
|
|
[ |
|
|
|
'dead:beef:cafe::1111', |
|
|
|
[ |
|
|
|
'whitelist_0' => 'dead:beef:cafe::1100/123', |
|
|
|
|
|
|
|
], |
|
|
|
true, |
|
|
|
], |
|
|
|
[ |
|
|
|
'invalid', |
|
|
|
[], |
|
|
|
|
