mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-09-21 09:05:10 -07:00
152a74d3f4
- recordAttempt()/isBlocked() return false when maxAttempts <= 0 or windowSeconds <= 0, so the documented 'set to 0 to disable' actually disables instead of blocking every address permanently - Keys at their limit are rejected without recording, so repeated attempts at the attacker's pace cannot keep sliding the window and holding the lockout open; a block now clears once the recorded attempts age out of windowSeconds - Attempts map is bounded: an opportunistic prune (every 60s) erases keys whose attempts have fully aged out - Login is throttled before the work: isLoginRateLimited() (a new virtual on Server, backed by isBlocked()) gates loginUser(), so a locked-out address no longer burns a database round trip and password verification per attempt - recordAttemptAt()/isBlockedAt() time seams make the sliding-window behaviour deterministically testable; tests rewritten for the real semantics (no reliance on the maxAttempts=0 bug, no sleeps) |
||
|---|---|---|
| .. | ||
| card_zone_algorithms | ||
| carddatabase | ||
| loading_from_clipboard | ||
| movecard_tests | ||
| oracle | ||
| settings | ||
| clamped_arithmetic_test.cpp | ||
| CMakeLists.txt | ||
| deck_hash_performance_test.cpp | ||
| dummy_test.cpp | ||
| expression_test.cpp | ||
| password_hash_test.cpp | ||
| rate_limiter_test.cpp | ||
| server_card_counter_test.cpp | ||
| server_counter_test.cpp | ||
| test_age_formatting.cpp | ||