Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use brute force detection for reset password action #19598

Merged
merged 1 commit into from Aug 5, 2022
Merged

Conversation

sgiehl
Copy link
Member

@sgiehl sgiehl commented Aug 4, 2022

Description:

In theory is would currently be possible to brute force the reset password token after a password reset was triggered.
Due to the length of the reset token it would take ages to guess the token correctly.

Performing the brute force detection upon a failed try won't hurt, but block the users after several tries and thus makes the process a bit more secure.

Note: I've avoided to also pass the provided login to the failed attempt, so only the IP address will be locked out.

Review

@sgiehl sgiehl added the c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. label Aug 4, 2022
@sgiehl sgiehl added this to the 4.12.0 milestone Aug 4, 2022
@sgiehl sgiehl added the Needs Review PRs that need a code review label Aug 4, 2022
Copy link
Contributor

@bx80 bx80 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bx80 bx80 removed the Needs Review PRs that need a code review label Aug 5, 2022
@sgiehl sgiehl merged commit c40b160 into 4.x-dev Aug 5, 2022
@sgiehl sgiehl deleted the resetpwbf branch August 5, 2022 05:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants