b0f0f7d8d0
Add normalized email identity rate limiting for registration and forgot-password requests, and refresh Sentinel status from restart broadcasts. Rework server sidebars and navbar for mobile menus and active status visibility.
48 lines
1.5 KiB
PHP
48 lines
1.5 KiB
PHP
<?php
|
|
|
|
use App\Models\InstanceSettings;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
InstanceSettings::query()->forceCreate(['id' => 0]);
|
|
});
|
|
|
|
it('rate limits repeated forgot password attempts from the same ip', function () {
|
|
foreach (range(1, 3) as $attempt) {
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.20'])
|
|
->post('/forgot-password', [
|
|
'email' => "user{$attempt}@example.com",
|
|
])
|
|
->assertSessionHasNoErrors();
|
|
}
|
|
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.20'])
|
|
->post('/forgot-password', [
|
|
'email' => 'blocked@example.com',
|
|
])
|
|
->assertTooManyRequests();
|
|
});
|
|
|
|
it('rate limits dotted plus-address forgot password variants of the same email identity across ips', function () {
|
|
$emails = [
|
|
'ke.vinmcfadden+one@btinternet.com',
|
|
'kevin.mcfadden+two@btinternet.com',
|
|
'k.e.v.i.n.m.c.f.a.d.d.e.n+three@btinternet.com',
|
|
];
|
|
|
|
foreach ($emails as $index => $email) {
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.'.($index + 30)])
|
|
->post('/forgot-password', [
|
|
'email' => $email,
|
|
])
|
|
->assertSessionHasNoErrors();
|
|
}
|
|
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.99'])
|
|
->post('/forgot-password', [
|
|
'email' => 'k.evin.mcfadden+four@btinternet.com',
|
|
])
|
|
->assertTooManyRequests();
|
|
});
|