From 39594c6dd4d4070bf24eca850541fb7c00276c27 Mon Sep 17 00:00:00 2001 From: Florent Torregrosa Date: Sun, 9 Aug 2015 20:56:31 +0200 Subject: [PATCH] Issue #2548229 by digitgopher, Grimreaper: Add flood control feature. --- protected_node.fork.inc | 9 +++++++++ protected_node.redirect.inc | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/protected_node.fork.inc b/protected_node.fork.inc index e2fcfd2..f0df314 100644 --- a/protected_node.fork.inc +++ b/protected_node.fork.inc @@ -165,8 +165,16 @@ function protected_node_enter_any_password() { * Validate callback. * * Verify that the user entered the correct password. + * + * For the flood control, @see user_login_authenticate_validate(). */ function protected_node_enter_any_password_validate($form, &$form_state) { + $max_attempt = variable_get('protected_node_failed_password_ip_limit', 50); + $flood_window = variable_get('protected_node_failed_password_ip_window', 3600); + if (!flood_is_allowed('failed_protected_node_attempt_ip', $max_attempt, $flood_window)) { + form_set_error('password', t('Sorry, too many failed password attempts from your IP address. This IP address is temporarily blocked. Try again later.')); + return; + } // Note that global password cannot work here since we couldn't know where // to send the user otherwise. $nids = protected_node_get_nids_from_protected_pages_parameter(); @@ -185,6 +193,7 @@ function protected_node_enter_any_password_validate($form, &$form_state) { ->fetchField(); if (empty($nid)) { + flood_register_event('failed_protected_node_attempt_ip', $flood_window); form_set_error('password', t('Incorrect password!')); } else { diff --git a/protected_node.redirect.inc b/protected_node.redirect.inc index 422677e..ec7d791 100644 --- a/protected_node.redirect.inc +++ b/protected_node.redirect.inc @@ -149,8 +149,16 @@ function protected_node_enterpassword() { /** * Verify that the user entered the correct password. + * + * For the flood control, @see user_login_authenticate_validate(). */ function protected_node_enterpassword_validate($form, &$form_state) { + $max_attempt = variable_get('protected_node_failed_password_ip_limit', 50); + $flood_window = variable_get('protected_node_failed_password_ip_window', 3600); + if (!flood_is_allowed('failed_protected_node_attempt_ip', $max_attempt, $flood_window)) { + form_set_error('password', t('Sorry, too many failed password attempts from your IP address. This IP address is temporarily blocked. Try again later.')); + return; + } // @todo We do not want to check the global password if there is a local // password (i.e. extract local password instead of comparing). // @todo The protected_node_nid parameter should be extracted from the @@ -203,6 +211,7 @@ function protected_node_enterpassword_validate($form, &$form_state) { } if (empty($nid)) { + flood_register_event('failed_protected_node_attempt_ip', $flood_window); form_set_error('password', t('Incorrect password!')); } } -- 2.1.4