agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-05-23 09:09:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

Authentication: fix uid ldap login after email parsing was added to rate limiter

Browse Source
This commit is contained in:
yu-i-i
2026-03-15 23:11:14 +01:00
parent fdc092371b
commit 047b2d2fd2
2 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
services/web/modules/authentication/ldap/app/src/LDAPRateLimitMiddleware.mjs Normal file
View File

@@ -0,0 +1,24 @@
export function prepareLdapLoginForRateLimitEmail(field = 'email') {
return function (req, res, next) {
const value = req.body[field]
if (!value) return next()
if (!value.includes('@')) {
req._originalLogin = value
req.body[field] = `${value}@ldapfake.invalid`
}
next()
}
}
export function restoreLdapLoginAfterRateLimitEmail(field = 'email') {
return function (req, res, next) {
if (req._originalLogin !== undefined) {
req.body[field] = req._originalLogin
delete req._originalLogin
}
next()
}
}

5
services/web/modules/authentication/ldap/app/src/LDAPRouter.mjs
View File

@@ -4,13 +4,16 @@ import CaptchaMiddleware from '../../../../../app/src/Features/Captcha/CaptchaMi
import AuthenticationController from '../../../../../app/src/Features/Authentication/AuthenticationController.mjs'
import { overleafLoginRateLimiter } from '../../../../../app/src/infrastructure/RateLimiter.mjs'
import LDAPAuthenticationController from './LDAPAuthenticationController.mjs'
import { prepareLdapLoginForRateLimitEmail, restoreLdapLoginAfterRateLimitEmail } from './LDAPRateLimitMiddleware.mjs'
export default {
apply(webRouter) {
logger.debug({}, 'Init LDAP router')
webRouter.post('/login',
RateLimiterMiddleware.rateLimit(overleafLoginRateLimiter), // rate limit IP (20 / 60s)
RateLimiterMiddleware.loginRateLimitEmail(), // rate limit email (10 / 120s)
prepareLdapLoginForRateLimitEmail(), // for logins with uid
RateLimiterMiddleware.loginRateLimitEmail('email'), // rate limit email (10 / 120s)
restoreLdapLoginAfterRateLimitEmail(),
CaptchaMiddleware.validateCaptcha('login'),
LDAPAuthenticationController.passportLogin,
AuthenticationController.passportLogin,