mirror of
https://we.phorge.it/source/phorge.git
synced 2025-02-27 05:59:08 +01:00
0449a07f53
Summary:
I stumbled across this TODO and was worried that there was a glaring hole in MFA that I'd somehow forgotten about, but the TODO is just out of date.
These actions are rate limited properly by `PhabricatorAuthTryFactorAction`, which permits a maximum of 10 actions per hour.
- Remove the TODO.
- Add `bin/auth unlimit` to make it easier to reset rate limits if someone needs to do that for whatever reason.
Test Plan:
- Tried to brute force through MFA.
- Got rate limited properly after 10 failures.
- Reset rate limit with `bin/auth unlimit`.
- Saw the expected number of actions clear.
{F805288}
Reviewers: chad
Reviewed By: chad
Subscribers: joshuaspence
Differential Revision: https://secure.phabricator.com/D14105
67 lines
1.8 KiB
PHP
67 lines
1.8 KiB
PHP
<?php
|
|
|
|
final class PhabricatorAuthManagementUnlimitWorkflow
|
|
extends PhabricatorAuthManagementWorkflow {
|
|
|
|
protected function didConstruct() {
|
|
$this
|
|
->setName('unlimit')
|
|
->setExamples('**unlimit** --user __username__ --all')
|
|
->setSynopsis(
|
|
pht(
|
|
'Reset action counters so a user can continue taking '.
|
|
'rate-limited actions.'))
|
|
->setArguments(
|
|
array(
|
|
array(
|
|
'name' => 'user',
|
|
'param' => 'username',
|
|
'help' => pht('Reset action counters for this user.'),
|
|
),
|
|
array(
|
|
'name' => 'all',
|
|
'help' => pht('Reset all counters.'),
|
|
),
|
|
));
|
|
}
|
|
|
|
public function execute(PhutilArgumentParser $args) {
|
|
$username = $args->getArg('user');
|
|
if (!strlen($username)) {
|
|
throw new PhutilArgumentUsageException(
|
|
pht(
|
|
'Use %s to choose a user to reset actions for.', '--user'));
|
|
}
|
|
|
|
$user = id(new PhabricatorPeopleQuery())
|
|
->setViewer($this->getViewer())
|
|
->withUsernames(array($username))
|
|
->executeOne();
|
|
if (!$user) {
|
|
throw new PhutilArgumentUsageException(
|
|
pht(
|
|
'No user exists with username "%s".',
|
|
$username));
|
|
}
|
|
|
|
$all = $args->getArg('all');
|
|
if (!$all) {
|
|
// TODO: Eventually, let users reset specific actions. For now, we
|
|
// require `--all` so that usage won't change when you can reset in a
|
|
// more tailored way.
|
|
throw new PhutilArgumentUsageException(
|
|
pht(
|
|
'Specify %s to reset all action counters.', '--all'));
|
|
}
|
|
|
|
$count = PhabricatorSystemActionEngine::resetActions(
|
|
array(
|
|
$user->getPHID(),
|
|
));
|
|
|
|
echo pht('Reset %s action(s).', new PhutilNumber($count))."\n";
|
|
|
|
return 0;
|
|
}
|
|
|
|
}
|