Jean
61005f52f5
All checks were successful
CI / check (push) Successful in 3m46s
REGISTER was rate-limited but RESEND and RESETPASS weren't — anyone could repeatedly request confirmation/reset codes for any account with an address on file, flooding the victim's inbox and burning the service's sender reputation. A per-account 60s cooldown (code_issue_wait, mirroring the vhost request throttle) now gates both paths; guessing was already infeasible (2^40 code + 5-try limit), so this closes the abuse, not an auth hole. |
||
|---|---|---|
| .. | ||
| botserv | ||
| chanfix | ||
| chanserv | ||
| diceserv | ||
| example | ||
| groupserv | ||
| helpserv | ||
| hostserv | ||
| infoserv | ||
| memoserv | ||
| nickserv | ||
| operserv | ||
| protocol/inspircd | ||
| reportserv | ||
| statserv | ||