[TikiWiki-commits] [Git][tikiwiki/tiki][30.x] [FIX] Define missing bruteForceProperties closure in tiki-change_password.php

ushindi bienvenu pushed to branch 30.x at Tiki Wiki CMS Groupware / Tiki


Commits:
b54337bb by Espoir Baraka at 2026-08-22T12:48:32+00:00
[FIX] Define missing bruteForceProperties closure in tiki-change_password.php
---
* [FIX] Define missing bruteForceProperties closure in tiki-change_password.php

See merge request tikiwiki/tiki!11033

- - - - -


1 changed file:

- tiki-change_password.php


Changes:

=====================================
tiki-change_password.php
=====================================
@@ -41,6 +41,9 @@ if (! isset($_REQUEST["oldpass"])) {
 
 $user = $_REQUEST["user"];
 $secure_token = $_REQUEST["token"] ?? '';
+$bruteForceProperties = function () use ($tikilib) {
+    return ['ip' => $tikilib->get_ip_address()];
+};
 
 $pass_confirm = $userlib->getOne('select `pass_confirm` from `users_users` where binary `login`=?', [$user]);
 $must_change_password = ($pass_confirm === 0 || $pass_confirm === null);
@@ -88,14 +91,14 @@ $smarty->assign('secure_token', $secure_token);
 if (isset($_REQUEST["change"]) && $access->checkCsrf()) {
     $changePasswordProperties = $bruteForceProperties();
     if (($prefs['bruteforce_protection'] ?? 'n') === 'y') {
-        if (! $bruteForce->isOperationAllowed('change_password', ['ip' => $tikilib->get_ip_address()])) {
-            $nextAllowedTime = $bruteForce->getNextAllowedTime('change_password', ['ip' => $tikilib->get_ip_address()]);
-            $waitTime = $nextAllowedTime - time();
+        if (! $bruteForce->isOperationAllowed('change_password', $changePasswordProperties)) {
+            $waitTime = $bruteForce->getWaitTime('change_password', $changePasswordProperties);
             if ($waitTime > 60) {
                 $waitMessage = sprintf(tra('Too many password change attempts. Please try again in %d minutes and %d seconds.'), floor($waitTime / 60), $waitTime % 60);
             } else {
                 $waitMessage = sprintf(tra('Too many password change attempts. Please try again in %d seconds.'), $waitTime);
             }
+            http_response_code(429);
             $smarty->assign('msg', $waitMessage);
             $smarty->display('error.tpl');
             die;
@@ -197,6 +200,9 @@ if (isset($_REQUEST["change"]) && $access->checkCsrf()) {
             if ($res && $prefs['pass_history_management'] === 'y') {
                 $userlib->addPasswordHistory($user, $_REQUEST["pass"]);
             }
+            if (($prefs['bruteforce_protection'] ?? 'n') === 'y') {
+                $bruteForce->success('change_password', $changePasswordProperties);
+            }
 
             // One-time marker: do not allow reuse of the validation session for another change
             unset($_SESSION['pending_new_user_password'], $_SESSION['last_validation']);



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/b54337bb636328ddde2e35b19d3cb01460a5b70b

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/b54337bb636328ddde2e35b19d3cb01460a5b70b
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs