diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bug #40547 [RateLimiter] Security hardening - Rate limiter (jderusse)

Browse Source 
This PR was merged into the 5.2 branch.

Discussion
----------

[RateLimiter] Security hardening - Rate limiter

| Q             | A
| ------------- | ---
| Branch?       | 5.2
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | yes
| Tickets       | -
| License       | MIT
| Doc PR        | -

Commits
-------

e61553af4b Security hardening - Rate limiter
This commit is contained in:
Nyholm 2021-03-23 08:09:52 +01:00
commit 0f4870b23f
No known key found for this signature in database
GPG Key ID: D6332DE2B6F8FA38
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Symfony/Component/RateLimiter/RateLimiterFactory.php
View File

@ -46,7 +46,7 @@ final class RateLimiterFactory
public function create(?string $key = null): LimiterInterface
{
$id = $this->config['id'].$key;
$id = $this->config['id'].'-'.$key;
$lock = $this->lockFactory ? $this->lockFactory->createLock($id) : new NoLock();
switch ($this->config['policy']) {

2
src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php
View File

@ -41,7 +41,7 @@ final class DefaultLoginRateLimiter extends AbstractRequestRateLimiter
{
return [
$this->globalFactory->create($request->getClientIp()),
$this->localFactory->create($request->attributes->get(Security::LAST_USERNAME).$request->getClientIp()),
$this->localFactory->create($request->attributes->get(Security::LAST_USERNAME).'-'.$request->getClientIp()),
];
}
}