owncloud / security

lib/Throttle.php

Spacing +4 added lines, -4 removed lines

@@ -79,14 +79,14 @@
      * @param string $ip

      * @throws LoginException

      */

-    public function applyBruteForcePolicy($uid ,$ip) {

+    public function applyBruteForcePolicy($uid, $ip) {

         $banPeriod = $this->config->getBruteForceProtectionBanPeriod();

-        $banUntil = $this->dbConnection->getLastFailedLoginAttemptTimeForIp($ip)+$banPeriod;

-        if($this->dbConnection->getSuspiciousActivityCountForUidIpCombination($uid, $ip) >=

+        $banUntil = $this->dbConnection->getLastFailedLoginAttemptTimeForIp($ip) + $banPeriod;

+        if ($this->dbConnection->getSuspiciousActivityCountForUidIpCombination($uid, $ip) >=

             $this->config->getBruteForceProtectionFailTolerance() &&

             $banUntil > $this->timeFactory->getTime()) {

             throw new LoginException($this->l->t("Too many failed login attempts. Try again in %s minutes.",

-                ceil($banPeriod/60))

+                ceil($banPeriod / 60))

             );

         }

     }

tests/ThrottleTest.php

Spacing +2 added lines, -2 removed lines

@@ -88,7 +88,7 @@ 
             ->will($this->returnValue($lastAttempt));

         $this->dbServiceMock->expects($this->once())

             ->method('getSuspiciousActivityCountForUidIpCombination')

-            ->with('test','192.168.1.1')

+            ->with('test', '192.168.1.1')

             ->will($this->returnValue($attemptCount));

         $this->configMock->expects($this->once())

             ->method('getBruteForceProtectionBanPeriod')

@@ -100,7 +100,7 @@ 
             ->method('getTime')

             ->will($this->returnValue($time));

         $this->expectException('OC\User\LoginException');

-        $this->throttle->applyBruteForcePolicy('test','192.168.1.1');

+        $this->throttle->applyBruteForcePolicy('test', '192.168.1.1');

     }

     public function bruteForceTestData() {

         return [

lib/Db/DbService.php

Spacing +8 added lines, -8 removed lines

@@ -62,7 +62,7 @@ 
     /**

      * @param string $uid

      */

-    public function addFailedLoginAttempt($uid, $ip){

+    public function addFailedLoginAttempt($uid, $ip) {

         $builder = $this->connection->getQueryBuilder();

         $builder->insert('failed_login_attempts')

             ->setValue('ip', $builder->createNamedParameter($ip))

@@ -78,7 +78,7 @@ 
      */

     public function getSuspiciousActivityCountForUidIpCombination($uid, $ip) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $attempts = $builder->selectAlias($builder->createFunction('COUNT(*)'), 'count')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

@@ -95,7 +95,7 @@ 
      */

     public function getSuspiciousActivityCountForUid($uid) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $attempts = $builder->selectAlias($builder->createFunction('COUNT(*)'), 'count')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

@@ -111,7 +111,7 @@ 
      */

     public function getSuspiciousActivityCountForIp($ip) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $attempts = $builder->selectAlias($builder->createFunction('COUNT(*)'), 'count')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

@@ -127,12 +127,12 @@ 
      */

     public function getLastFailedLoginAttemptTimeForIp($ip) {

         $builder = $this->connection->getQueryBuilder();

-        $thresholdTime = (new \DateTime())->modify("-". $this->config->getBruteForceProtectionTimeThreshold() . "second")->getTimestamp();

+        $thresholdTime = (new \DateTime())->modify("-".$this->config->getBruteForceProtectionTimeThreshold()."second")->getTimestamp();

         $lastAttempt = $builder->select('attempted_at')

             ->from('failed_login_attempts')

             ->where($builder->expr()->gt('attempted_at', $builder->createNamedParameter($thresholdTime)))

             ->andWhere($builder->expr()->eq('ip', $builder->createNamedParameter($ip)))

-            ->orderBy('attempted_at','DESC')

+            ->orderBy('attempted_at', 'DESC')

             ->setMaxResults(1)

             ->execute()

             ->fetch();

@@ -145,7 +145,7 @@ 
     public function deleteSuspiciousAttemptsForIp($ip) {

         $builder = $this->connection->getQueryBuilder();

         $builder->delete('failed_login_attempts')

-            ->where($builder->expr()->eq('ip',$builder->createNamedParameter($ip)))

+            ->where($builder->expr()->eq('ip', $builder->createNamedParameter($ip)))

             ->execute();

     }

 

@@ -156,7 +156,7 @@ 
     public function deleteSuspiciousAttemptsForUidIpCombination($uid, $ip) {

         $builder = $this->connection->getQueryBuilder();

         $builder->delete('failed_login_attempts')

-            ->where($builder->expr()->eq('uid',$builder->createNamedParameter($uid)))

+            ->where($builder->expr()->eq('uid', $builder->createNamedParameter($uid)))

             ->andWhere($builder->expr()->eq('ip', $builder->createNamedParameter($ip)))

             ->execute();

     }

tests/Db/DbServiceTest.php

Spacing +2 added lines, -2 removed lines

@@ -106,7 +106,7 @@ 
         $this->dbService->addFailedLoginAttempt("test1", "192.168.1.1");

         $this->dbService->addFailedLoginAttempt("test1", "192.168.1.1");

         $this->dbService->addFailedLoginAttempt("test2", "192.168.1.1");

-        $this->assertEquals(2, $this->dbService->getSuspiciousActivityCountForUidIpCombination('test1','192.168.1.1'));

+        $this->assertEquals(2, $this->dbService->getSuspiciousActivityCountForUidIpCombination('test1', '192.168.1.1'));

     }

 

     public function testGetLastFailedLoginAttemptTimeForIp() {

@@ -149,7 +149,7 @@ 
         $result = $query->execute()->fetchAll();

         $this->assertSame(2, count($result));

 

-        $this->dbService->deleteSuspiciousAttemptsForUidIpCombination('test1',"192.168.1.1");

+        $this->dbService->deleteSuspiciousAttemptsForUidIpCombination('test1', "192.168.1.1");

         $query = $builder->select('*')->from($this->dbTable)

             ->Where($builder->expr()->eq('ip', $builder->createNamedParameter("192.168.1.1")));

         $result = $query->execute()->fetchAll();