Myth\Auth\LocalAuthentication::isThrottled()

Complexity

Conditions	13
Paths	31

Size

Total Lines	98
Code Lines	33

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	1	Features	0

<?php namespace Myth\Auth;
    public function isThrottled($email)
    {
        // Not throttling? Get outta here!
        if (! config_item('auth.allow_throttling'))
        {
            return false;
        }

        // Emails should NOT be case sensitive.
        $email = strtolower($email);

        // Have any attempts been made?
        $attempts = $this->ci->login_model->countLoginAttempts($email);

        // Grab the amount of time to add if the system thinks we're
        // under a distributed brute force attack.
        // Affect users that have at least 1 failure login attempt
        $dbrute_time = ($attempts === 0) ? 0 : $this->ci->login_model->distributedBruteForceTime();

        // If this user was found to possibly be under a brute
        // force attack, their account would have been banned
        // for 15 minutes.
        if ($time = isset($_SESSION['bruteBan']) ? $_SESSION['bruteBan'] : false)
        {
            // If the current time is less than the
            // the ban expiration, plus any distributed time
            // then the user can't login just yet.
            if ($time + $dbrute_time > time())
            {
                // The user is banned still...
                $this->error = lang('auth.bruteBan_notice');
                return ($time + $dbrute_time) - time();
            }

            // Still here? The the ban time is over...
            unset($_SESSION['bruteBan']);
        }

        // Grab the time of last attempt and
        // determine if we're throttled by amount of time passed.
        $last_time = $this->ci->login_model->lastLoginAttemptTime($email);

        $allowed = config_item('auth.allowed_login_attempts');

        // We're not throttling if there are 0 attempts or
        // the number is less than or equal to the allowed free attempts
        if ($attempts === 0 || $attempts <= $allowed)
        {
            // Before we can say there's nothing up here,
            // we need to check dbrute time.
            $time_left = $last_time + $dbrute_time - time();

            if ($time_left > 0)
            {
                return $time_left;
            }

            return false;
        }

        // If the number of attempts is excessive (above 100) we need
        // to check the elapsed time of all of these attacks. If they are
        // less than 1 minute it's obvious this is a brute force attack,
        // so we'll set a session flag and block that user for 15 minutes.
        if ($attempts > 100 && $this->ci->login_model->isBruteForced($email))
        {
            $this->error = lang('auth.bruteBan_notice');

            $ban_time = 60 * 15;    // 15 minutes
            $_SESSION['bruteBan'] = time() + $ban_time;
            return $ban_time;
        }

        // Get our allowed attempts out of the picture.
        $attempts = $attempts - $allowed;

        $max_time = config_item('auth.max_throttle_time');

        $add_time = 5 * pow(2, $attempts - 1);

        if ($add_time > $max_time)
        {
            $add_time = $max_time;
        }

        $next_time = $last_time + $add_time + $dbrute_time;

        $current = time();

        // We are NOT throttled if we are already
        // past the allowed time.
        if ($current > $next_time)
        {
            return false;
        }

        return $next_time - $current;
    }