b0f0f7d8d0
Add normalized email identity rate limiting for registration and forgot-password requests, and refresh Sentinel status from restart broadcasts. Rework server sidebars and navbar for mobile menus and active status visibility.
72 lines
2.3 KiB
PHP
72 lines
2.3 KiB
PHP
<?php
|
|
|
|
use App\Models\InstanceSettings;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
InstanceSettings::query()->forceCreate([
|
|
'id' => 0,
|
|
'is_registration_enabled' => true,
|
|
]);
|
|
|
|
User::factory()->create(['id' => 0, 'email' => 'root@example.com']);
|
|
});
|
|
|
|
it('rate limits repeated registration attempts from the same ip', function () {
|
|
foreach (range(1, 3) as $attempt) {
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.10'])
|
|
->post('/register', [
|
|
'name' => "Attack User {$attempt}",
|
|
'email' => "attacker{$attempt}@example.com",
|
|
'password' => 'Password1!@',
|
|
'password_confirmation' => 'Password1!@',
|
|
])
|
|
->assertRedirect();
|
|
|
|
auth()->logout();
|
|
$this->flushSession();
|
|
}
|
|
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.10'])
|
|
->post('/register', [
|
|
'name' => 'Blocked User',
|
|
'email' => 'blocked@example.com',
|
|
'password' => 'Password1!@',
|
|
'password_confirmation' => 'Password1!@',
|
|
])
|
|
->assertTooManyRequests();
|
|
});
|
|
|
|
it('rate limits dotted plus-address variants of the same email identity across ips', function () {
|
|
$emails = [
|
|
'ke.vinmcfadden+one@btinternet.com',
|
|
'kevin.mcfadden+two@btinternet.com',
|
|
'k.e.v.i.n.m.c.f.a.d.d.e.n+three@btinternet.com',
|
|
];
|
|
|
|
foreach ($emails as $index => $email) {
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.'.($index + 10)])
|
|
->post('/register', [
|
|
'name' => "Attack User {$index}",
|
|
'email' => $email,
|
|
'password' => 'Password1!@',
|
|
'password_confirmation' => 'Password1!@',
|
|
])
|
|
->assertRedirect();
|
|
|
|
auth()->logout();
|
|
$this->flushSession();
|
|
}
|
|
|
|
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.99'])
|
|
->post('/register', [
|
|
'name' => 'Blocked User',
|
|
'email' => 'k.evin.mcfadden+four@btinternet.com',
|
|
'password' => 'Password1!@',
|
|
'password_confirmation' => 'Password1!@',
|
|
])
|
|
->assertTooManyRequests();
|
|
});
|