diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Security] Make Login Rate Limiter also case insensitive for non-ascii user identifiers

Browse Source
This commit is contained in:
Jordi Boggiano 2021-05-11 13:14:42 +02:00
parent ddb2d0158d
commit 3b7e7fbc7f
No known key found for this signature in database
GPG Key ID: 7BBD42C429EC80BC
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php
View File

@ -39,9 +39,12 @@ final class DefaultLoginRateLimiter extends AbstractRequestRateLimiter
protected function getLimiters(Request $request): array
{
$username = $request->attributes->get(Security::LAST_USERNAME);
$username = preg_match('//u', $username) ? mb_strtolower($username, 'UTF-8') : strtolower($username);
return [
$this->globalFactory->create($request->getClientIp()),
$this->localFactory->create(strtolower($request->attributes->get(Security::LAST_USERNAME)).'-'.$request->getClientIp()),
$this->localFactory->create($username.'-'.$request->getClientIp()),
];
}
}

1
src/Symfony/Component/Security/Http/composer.json
View File

@ -21,6 +21,7 @@
"symfony/security-core": "^5.2",
"symfony/http-foundation": "^5.2",
"symfony/http-kernel": "^5.2",
"symfony/polyfill-mbstring": "~1.0",
"symfony/polyfill-php80": "^1.15",
"symfony/property-access": "^4.4|^5.0"
},