mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-09-23 10:05:10 -07:00
152a74d3f4
- recordAttempt()/isBlocked() return false when maxAttempts <= 0 or windowSeconds <= 0, so the documented 'set to 0 to disable' actually disables instead of blocking every address permanently - Keys at their limit are rejected without recording, so repeated attempts at the attacker's pace cannot keep sliding the window and holding the lockout open; a block now clears once the recorded attempts age out of windowSeconds - Attempts map is bounded: an opportunistic prune (every 60s) erases keys whose attempts have fully aged out - Login is throttled before the work: isLoginRateLimited() (a new virtual on Server, backed by isBlocked()) gates loginUser(), so a locked-out address no longer burns a database round trip and password verification per attempt - recordAttemptAt()/isBlockedAt() time seams make the sliding-window behaviour deterministically testable; tests rewritten for the real semantics (no reliance on the maxAttempts=0 bug, no sleeps) |
||
|---|---|---|
| .. | ||
| game | ||
| CMakeLists.txt | ||
| room_message_type.h | ||
| server.cpp | ||
| server.h | ||
| server_abstractuserinterface.cpp | ||
| server_abstractuserinterface.h | ||
| server_database_interface.cpp | ||
| server_database_interface.h | ||
| server_player_reference.h | ||
| server_protocolhandler.cpp | ||
| server_protocolhandler.h | ||
| server_remoteuserinterface.cpp | ||
| server_remoteuserinterface.h | ||
| server_response_containers.cpp | ||
| server_response_containers.h | ||
| server_room.cpp | ||
| server_room.h | ||
| serverinfo_user_container.cpp | ||
| serverinfo_user_container.h | ||
| user_level.h | ||