Jean
61005f52f5
All checks were successful
CI / check (push) Successful in 3m46s
REGISTER was rate-limited but RESEND and RESETPASS weren't — anyone could repeatedly request confirmation/reset codes for any account with an address on file, flooding the victim's inbox and burning the service's sender reputation. A per-account 60s cooldown (code_issue_wait, mirroring the vhost request throttle) now gates both paths; guessing was already infeasible (2^40 code + 5-try limit), so this closes the abuse, not an auth hole.
44 lines
2.2 KiB
Rust
44 lines
2.2 KiB
Rust
use echo_api::{CodeKind, Store};
|
|
use echo_api::{Sender, ServiceCtx};
|
|
|
|
// RESETPASS <account>: email a reset code to the address on file.
|
|
// RESETPASS <account> <code> <newpassword>: complete the reset with that code.
|
|
pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
|
|
if !db.email_enabled() {
|
|
ctx.notice(me, from.uid, "Password reset by email isn't available here.");
|
|
return;
|
|
}
|
|
match (args.get(1), args.get(2), args.get(3)) {
|
|
(Some(&name), None, None) => {
|
|
let Some(canonical) = db.resolve_account(name).map(str::to_string) else {
|
|
ctx.notice(me, from.uid, format!("\x02{name}\x02 isn't registered."));
|
|
return;
|
|
};
|
|
let Some(email) = db.account(&canonical).and_then(|a| a.email.clone()) else {
|
|
ctx.notice(me, from.uid, "That account has no email on file, so it can't be reset.");
|
|
return;
|
|
};
|
|
let wait = db.code_issue_wait(&canonical);
|
|
if wait > 0 {
|
|
ctx.notice(me, from.uid, format!("A code was just sent — please wait \x02{wait}\x02s before requesting another."));
|
|
return;
|
|
}
|
|
let code = db.issue_code(&canonical, CodeKind::Reset);
|
|
let mail = echo_api::email::reset(db.email_brand(), db.email_accent(), db.email_logo(), &canonical, &code);
|
|
ctx.send_email(email, mail.subject, mail.text, Some(mail.html));
|
|
ctx.notice(me, from.uid, format!("A reset code has been emailed to the address on file for \x02{canonical}\x02."));
|
|
}
|
|
(Some(&name), Some(&code), Some(&newpass)) => {
|
|
let Some(canonical) = db.resolve_account(name).map(str::to_string) else {
|
|
ctx.notice(me, from.uid, format!("\x02{name}\x02 isn't registered."));
|
|
return;
|
|
};
|
|
if !db.take_code(&canonical, CodeKind::Reset, code) {
|
|
ctx.notice(me, from.uid, "Invalid or expired reset code.");
|
|
return;
|
|
}
|
|
ctx.defer_password(&canonical, newpass, me, from.uid);
|
|
}
|
|
_ => ctx.notice(me, from.uid, "Syntax: RESETPASS <account> [<code> <newpassword>]"),
|
|
}
|
|
}
|