Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Merge pull request from GHSA-q3rg-xx5v-4mxh

Browse source
This commit is contained in:
Claire 2024-05-30 14:14:04 +02:00 • committed by GitHub
parent 3ea4275ae3
commit 16249946ae
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 38 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
config/initializers/rack_attack.rb
View file

@ -30,13 +30,17 @@ class Rack::Attack
end
def authenticated_user_id
authenticated_token&.resource_owner_id
authenticated_token&.resource_owner_id || warden_user_id
end
def authenticated_token_id
authenticated_token&.id
end
def warden_user_id
@env['warden']&.user&.id
end
def unauthenticated?
!authenticated_user_id
end
@ -141,6 +145,10 @@ class Rack::Attack
req.session[:attempt_user_id] || req.params.dig('user', 'email').presence if req.post? && req.path_matches?('/auth/sign_in')
end
throttle('throttle_password_change/account', limit: 10, period: 10.minutes) do |req|
req.authenticated_user_id if req.put? || (req.patch? && req.path_matches?('/auth'))
end
self.throttled_responder = lambda do |request|
now = Time.now.utc
match_data = request.env['rack.attack.match_data']